REST API
Read and change AutoCISO data over HTTPS: guides for common integrations and a reference page for every endpoint.
Guides
- REST API QuickstartMake your first AutoCISO REST call in cURL, TypeScript, Go or Java — list SBOMs, upload a manifest, and read leaver items that need attention.
- Upload an SBOM from CISend a dependency manifest (go.sum, pom.xml, Gradle, package.json or requirements.txt) to AutoCISO from your pipeline so its components are inventoried and matched against known vulnerabilities.
- Poll Leaver Items NightlyA copy-paste recipe that reads leaver items still outstanding or in discrepancy every night, de-duplicates them by itemKey, and hands only new ones to your ticketing tool.
API reference
Off-boarding
- List leaver casesLists leaver (off-boarding) cases with a reconciled summary of their items.
- Get a leaver caseReturns one leaver case with its reconciled summary.
- List the items of a leaver caseLists the reconciled items of one leaver case.
- List leaver items across cases (feed)Flat feed of reconciled leaver items across cases, for polling.
On-boarding
- List joiner casesLists joiner (on-boarding) cases with a reconciled summary of their items: GRANTED when the access is detected in the inventory, ATTESTED when a person confirmed it, else PENDING.
- Get a joiner caseReturns one joiner case with its reconciled summary.
- List the items of a joiner caseLists the reconciled items of one joiner case.
- List joiner items across cases (feed)Flat feed of reconciled joiner items across cases, for polling.
SBOMs
- List SBOMsList every SBOM in the organization.
- Create SBOMRegister an SBOM record without uploading a manifest, for example when components are attached by a later process.
- Upload SBOM manifestUpload a dependency manifest as `multipart/form-data`.
- Get SBOMFetch one SBOM by id, including its component count and the per-severity finding counts refreshed by the last CVE matching run.
- Delete SBOMDelete an SBOM together with its components and every vulnerability finding raised against it.
- List SBOM componentsList the resolved components of one SBOM.
Findings
Vendors
Supplier questionnaires
- List supplier questionnairesList the questionnaires of the organization, newest change first: the built-in questionnaire (always the first row of an unfiltered first page) and every authored version, drafts included.
- Create a questionnaireCreate a new, empty questionnaire as a draft with one section.
- Clone a questionnaireCopy an existing questionnaire into a new draft of a new questionnaire.
- Get a questionnaireFetch one questionnaire version by `templateId` with its sections, questions, options and scoring fields (`weight`, `riskValue`, `findingSeverity`, `controlIds`), the structural `limits` and the `revision` to send with an edit.
- Get a questionnaire versionFetch one numbered version of a questionnaire.
- Compare two questionnaire versionsList what changed between two versions of one questionnaire: added, removed and modified questions and options, with the before and after of each changed field.
- Validate a draftCheck the content of a questionnaire without changing anything and without a request body.
- Preview publishing a draftA dry run of publishing, without a request body and without any change: the scoring impact of the draft against the latest published version (the built-in questionnaire for a first publish), the same violations and warnings as validate plus the weight-raised warning `W6_WEIGHT_RAISED_3X`, and the permissions of the caller.
- Open a draft of a published questionnaireReopen a published version for editing: a new draft in the same questionnaire family with a copy of its content (`version` 0, `parentVersion` the published version).
- Edit the title, description and modes of a draftChange the title, the description and the assessment modes of a draft.
- Add a section to a draftAppend an empty section to a draft.
- Rename a section of a draftReplace the title of a section (`title.en` required).
- Delete a section of a draftDelete a section and its questions from a draft.
- Translate one questionnaire fieldMachine-translate one piece of questionnaire text into a target language.
- Add a question to a section of a draftAppend a question to a section of a draft.
- Edit a question of a draftChange fields of one question of a draft: `text`, `help`, `evidenceHint` (each replaces the whole localised object), `answerType`, `required`, `modes`, `domain`, `weight`, `controlIds` and `allowNotApplicable`.
- Delete a question of a draftRemove a question and its options from a draft.
- Add an option to a choice question of a draftAppend an answer option to a `single_select` or `multi_select` question of a draft.
- Edit an option of a draft questionChange fields of one answer option of a draft: `label`, `riskValue` (0 to 4), `findingSeverity`, `finding` and `notApplicable`.
- Delete an option of a draft questionRemove one answer option from a question of a draft.
- Submit a draft for approvalSend a draft to the people who can publish it.
- Withdraw a submitted draftReturn a version that is awaiting approval to `draft` so it can be edited again.
API Tokens
- List API tokensEvery API token of the organization, including revoked ones (`revokedAt` set).
- Create an API tokenCreate a token with the given scopes.
- List assignable token scopesThe scope catalogue used by the token dialog: every scope that POST /tokens accepts, its group and resource, whether it needs an expiry (and the maximum lifetime in days, 0 for no maximum), which roles may grant it and whether its public routes are live (`enabled`).
- Revoke an API tokenRevoke a token (not from a support session: SUPPORT_SESSION_NO_MINT).
Health
Access
Assets
Audit trail
Compliance
Employees
ISO projects
- List ISO projectsRequires the `iso:read` scope.
- Get one ISO projectRequires the `iso:read` scope.
- List a project's evidence metadataRequires the `evidence:read` scope.
- List a project's gap controlsRequires the `iso:read` scope.
- List a project's policies with acknowledgement countsRequires the `iso:read` scope.
- Get a project's audit readiness (codes and counts)Requires the `iso:read` scope.
- List a project's roadmap tasksRequires the `iso:read` scope.
- List a project's Statement of Applicability entriesRequires the `iso:read` scope.