Getting Started Product Console Reference REST API Developers

autociso.io Console

Developers

An API token reaches four surfaces: the supply-chain and supplier-questionnaire REST endpoints, the read-only employee lifecycle (JML) endpoints, and the MCP server for AI clients. Everything else answers 403 by design — start with API Tokens and the Access Model.

Start here

API TokensCreate, store, rotate and revoke AutoCISO API tokens for CI pipelines, scripts and AI clients, and choose a safe expiry for each scope.
Access Model & ScopesWhat an AutoCISO API token can reach, the eight original scopes, the nine newer read scopes, who may grant each, and what each grants, how the plan gates every call, and which actions stay human-only — with the full REST and MCP scope matrices.
Errors & Rate LimitsThe REST response envelope, every error code an API token can receive, and the rate limits that apply per IP, per token and per organisation.
Employee Identity (pii:read)What the Owner-granted pii:read scope unlocks over MCP and REST, how to grant it, resolve employee IDs to names and emails, audit every use, and rotate the token.

MCP

Platform

How AutoCISO WorksThe data flow from employee list and access imports to findings and evidence, how an API request is checked, how SBOM uploads are processed, and how tenants are isolated.