docs

API reference

The AutoCISO REST API is a JSON API over HTTPS. Every operation has its own page with parameters, response fields, errors and copy-paste examples. The OpenAPI document is published as YAML and JSON.

Base URL

https://api.autociso.io/api/v1

All paths in this reference are relative to the base URL. The published OpenAPI file now declares servers as https://api.autociso.io/api/v1 and carries the /jml/... and /sscs/... prefixes in its path keys, where it used to put /jml into the server URL. The full URLs are unchanged, so existing integrations and generated clients keep working.

Authentication

Send an API token in the Authorization header. Create tokens, and pick their scopes, as described in API Tokens. What each scope and plan allows is in Access Model & Scopes.

Header Value Required
Authorization Bearer <your-api-token> Always
Content-Type application/json On requests with a body

Response envelope

Responses use the envelope { data, error, meta }. On success data holds the payload, error is null and meta carries pagination or summary values. On failure data is null and error is { code, message }. The Supply Chain (SSCS) operations return a success body with data only and omit error and meta; the reference page of each operation shows its exact shape. Failures of every operation use the error codes in Errors & Rate Limits.

Pagination

List operations that paginate report it in meta. Which shape applies is stated on the operation page.

Style Request parameters meta
Offset limit, offset { total, limit, offset }
Cursor limit, cursor { limit, hasMore, nextCursor }

Cursor pagination is coming with the registry routes: no operation in this reference uses it yet. SSCS list operations return the whole list and do not paginate.

Filtering and sorting

Operations that support filters take them as filter[field][op]=value, for example filter[status][in]=OUTSTANDING,DISCREPANCY. The operators are eq, ne, gt, gte, lt, lte, in, nin, re and exists. Sorting is sort[field]=asc or sort[field]=desc, and q=term searches. Each operation page lists the fields it accepts; an unknown field is rejected with VALIDATION_FAILED.

Response headers

Header Status
Retry-After Sent on 429 RATE_LIMITED, in whole seconds (at least 1). Wait that long before retrying.
X-Request-ID Not yet sent by the API.
RateLimit-* Not yet sent by the API. Limits are described in Errors & Rate Limits.

Operations

71 operations. Scope is the token scope the operation requires; Plan is the lowest plan that includes it.

Off-boarding

  • GET
    List leaver cases/jml/offboarding/casesLists leaver (off-boarding) cases with a reconciled summary of their items.
    Scope jml:read Plan Seed+
  • GET
    Get a leaver case/jml/offboarding/cases/{caseId}Returns one leaver case with its reconciled summary.
    Scope jml:read Plan Seed+
  • GET
    List the items of a leaver case/jml/offboarding/cases/{caseId}/itemsLists the reconciled items of one leaver case.
    Scope jml:read Plan Seed+
  • GET
    List leaver items across cases (feed)/jml/offboarding/itemsFlat feed of reconciled leaver items across cases, for polling.
    Scope jml:read Plan Seed+

On-boarding

  • GET
    List joiner cases/jml/onboarding/casesLists joiner (on-boarding) cases with a reconciled summary of their items: GRANTED when the access is detected in the inventory, ATTESTED when a person confi…
    Scope jml:read Plan Seed+
  • GET
    Get a joiner case/jml/onboarding/cases/{caseId}Returns one joiner case with its reconciled summary.
    Scope jml:read Plan Seed+
  • GET
    List the items of a joiner case/jml/onboarding/cases/{caseId}/itemsLists the reconciled items of one joiner case.
    Scope jml:read Plan Seed+
  • GET
    List joiner items across cases (feed)/jml/onboarding/itemsFlat feed of reconciled joiner items across cases, for polling.
    Scope jml:read Plan Seed+

SBOMs

  • GET
    List SBOMs/sscs/sbomsList every SBOM in the organization.
    Scope sbom:read Plan Growth+
  • POST
    Create SBOM/sscs/sbomsRegister an SBOM record without uploading a manifest, for example when components are attached by a later process.
    Scope sbom:write Plan Growth+
  • POST
    Upload SBOM manifest/sscs/sboms/uploadUpload a dependency manifest as multipart/form-data.
    Scope sbom:write Plan Growth+
  • GET
    Get SBOM/sscs/sboms/{sbomId}Fetch one SBOM by id, including its component count and the per-severity finding counts refreshed by the last CVE matching run.
    Scope sbom:read Plan Growth+
  • DELETE
    Delete SBOM/sscs/sboms/{sbomId}Delete an SBOM together with its components and every vulnerability finding raised against it.
    Scope sbom:write Plan Growth+
  • GET
    List SBOM components/sscs/sboms/{sbomId}/componentsList the resolved components of one SBOM.
    Scope sbom:read Plan Growth+

Findings

  • GET
    List findings/sscs/findingsList vulnerability findings.
    Scope sbom:read Plan Growth+
  • GET
    Findings summary/sscs/findings/summaryCounts of open findings grouped by severity: the number behind a dashboard tile.
    Scope sbom:read Plan Growth+
  • PATCH
    Update finding status/sscs/findings/{findingId}/statusMove a finding through its triage workflow.
    Scope sbom:write Plan Growth+

Vendors

  • GET
    List vendors/sscs/vendorsList every tracked software vendor.
    Scope sbom:read Plan Growth+
  • POST
    Create vendor/sscs/vendorsRegister a software vendor.
    Scope sbom:write Plan Growth+
  • GET
    Vendor risk summary/sscs/vendors/risk-summaryOpen findings aggregated per vendor: the third-party risk view.
    Scope sbom:read Plan Growth+
  • PUT
    Update vendor/sscs/vendors/{vendorId}Update a vendor.
    Scope sbom:write Plan Growth+

Supplier questionnaires

  • GET
    List supplier questionnaires/supplier-assessment-templatesList the questionnaires of the organization, newest change first: the built-in questionnaire (always the first row of an unfiltered first page) and every aut…
    Scope supplier_template:read Plan Growth+
  • POST
    Create a questionnaire/supplier-assessment-templatesCreate a new, empty questionnaire as a draft with one section.
    Scope supplier_template:write Plan Growth+
  • POST
    Clone a questionnaire/supplier-assessment-templates/cloneCopy an existing questionnaire into a new draft of a new questionnaire.
    Scope supplier_template:write Plan Growth+
  • GET
    Get a questionnaire/supplier-assessment-templates/{templateId}Fetch one questionnaire version by `templateId` with its sections, questions, options and scoring fields (`weight`, `riskValue`, `findingSeverity`, `controlI…
    Scope supplier_template:read Plan Growth+
  • GET
    Get a questionnaire version/supplier-assessment-templates/{templateId}/versions/{version}Fetch one numbered version of a questionnaire.
    Scope supplier_template:read Plan Growth+
  • GET
    Compare two questionnaire versions/supplier-assessment-templates/{templateId}/versions/{version}/diff/{otherVersion}List what changed between two versions of one questionnaire: added, removed and modified questions and options, with the before and after of each changed field.
    Scope supplier_template:read Plan Growth+
  • POST
    Validate a draft/supplier-assessment-templates/{templateId}/validateCheck the content of a questionnaire without changing anything and without a request body.
    Scope supplier_template:read Plan Growth+
  • POST
    Preview publishing a draft/supplier-assessment-templates/{templateId}/publish/previewA dry run of publishing, without a request body and without any change: the scoring impact of the draft against the latest published version (the built-in qu…
    Scope supplier_template:read Plan Growth+
  • POST
    Open a draft of a published questionnaire/supplier-assessment-templates/{templateId}/draftReopen a published version for editing: a new draft in the same questionnaire family with a copy of its content (version 0, parentVersion the published v…
    Scope supplier_template:write Plan Growth+
  • PATCH
    Edit the title, description and modes of a draft/supplier-assessment-templates/{templateId}/metaChange the title, the description and the assessment modes of a draft.
    Scope supplier_template:write Plan Growth+
  • POST
    Add a section to a draft/supplier-assessment-templates/{templateId}/sectionsAppend an empty section to a draft.
    Scope supplier_template:write Plan Growth+
  • PATCH
    Rename a section of a draft/supplier-assessment-templates/{templateId}/sections/{sectionId}Replace the title of a section (title.en required).
    Scope supplier_template:write Plan Growth+
  • DELETE
    Delete a section of a draft/supplier-assessment-templates/{templateId}/sections/{sectionId}Delete a section and its questions from a draft.
    Scope supplier_template:write Plan Growth+
  • POST
    Translate one questionnaire field/supplier-assessment-templates/translateMachine-translate one piece of questionnaire text into a target language.
    Scope supplier_template:write Plan Growth+
  • POST
    Add a question to a section of a draft/supplier-assessment-templates/{templateId}/questionsAppend a question to a section of a draft.
    Scope supplier_template:write Plan Growth+
  • PATCH
    Edit a question of a draft/supplier-assessment-templates/{templateId}/questions/{questionId}Change fields of one question of a draft: `text`, `help`, `evidenceHint` (each replaces the whole localised object), `answerType`, `required`, `modes`, `doma…
    Scope supplier_template:write Plan Growth+
  • DELETE
    Delete a question of a draft/supplier-assessment-templates/{templateId}/questions/{questionId}Remove a question and its options from a draft.
    Scope supplier_template:write Plan Growth+
  • POST
    Add an option to a choice question of a draft/supplier-assessment-templates/{templateId}/questions/{questionId}/optionsAppend an answer option to a single_select or multi_select question of a draft.
    Scope supplier_template:write Plan Growth+
  • PATCH
    Edit an option of a draft question/supplier-assessment-templates/{templateId}/questions/{questionId}/options/{optionId}Change fields of one answer option of a draft: label, riskValue (0 to 4), findingSeverity, finding and notApplicable.
    Scope supplier_template:write Plan Growth+
  • DELETE
    Delete an option of a draft question/supplier-assessment-templates/{templateId}/questions/{questionId}/options/{optionId}Remove one answer option from a question of a draft.
    Scope supplier_template:write Plan Growth+
  • POST
    Submit a draft for approval/supplier-assessment-templates/{templateId}/submitSend a draft to the people who can publish it.
    Scope supplier_template:write Plan Growth+
  • POST
    Withdraw a submitted draft/supplier-assessment-templates/{templateId}/withdrawReturn a version that is awaiting approval to draft so it can be edited again.
    Scope supplier_template:write Plan Growth+

API Tokens

  • GET
    List API tokens/tokensEvery API token of the organization, including revoked ones (revokedAt set).
    Console session (Owner or Manager)
  • POST
    Create an API token/tokensCreate a token with the given scopes.
    Console session (Owner or Manager)
  • GET
    List assignable token scopes/tokens/scopesThe scope catalogue used by the token dialog: every scope that POST /tokens accepts, its group and resource, whether it needs an expiry (and the maximum life…
    Console session (Owner or Manager)
  • DELETE
    Revoke an API token/tokens/{tokenId}Revoke a token (not from a support session: SUPPORT_SESSION_NO_MINT).
    Console session (Owner or Manager)

Health

  • GET
    Check API health/healthAnswers 200 with data.status set to ok while the API is running.
    None (public)

Access

Assets

  • GET
    List assets/assetsRequires the asset:read scope.
    Scope asset:read

Audit trail

Compliance

Employees

ISO projects

Monitoring

Risk records

  • GET
    List risk records/risk/recordsRequires the risk:read scope.
    Scope risk:read Plan Growth+
  • GET
    Get one risk record/risk/records/{id}Requires the risk:read scope.
    Scope risk:read Plan Growth+

Suppliers

Last reviewed: 2026-10-18

Was this page helpful?

Esc