Read Endpoints for Platform Data in the Public API

Read-only access to platform data

Plans: Depends on the feature behind each endpoint; see below Where: API Tokens; /api/v1/... Who benefits: CTOs, IT managers, BI teams and auditors who want AutoCISO data in their own scripts and dashboards.

The nine read scopes asset:read, risk:read, supplier:read, iso:read, compliance:read, evidence:read, access_review:read, employee:read and audit_log:read are now live for every organisation. Until now a token could hold them, but the endpoints were switched off. The Not live yet badge in the create-token dialog is gone for them.

Every endpoint is read-only and has a page in the API reference. Which scope opens which operation, who may grant it and the longest expiry are listed in Read scopes for platform data.

Things to know

• Plans still apply. A scope never unlocks a feature your plan lacks. The call returns 402 with the code FEATURE_GATED, and error.args.minTierName names the lowest plan that includes it.
• Employee names and emails need pii:read. employee:read returns employee records without identity values. A token that also holds pii:read receives names and emails, within a personal-data limit per token and hour. See Employee identity for the limit.
• Reads are audited. Listing the Audit Trail, and any read that returns employee identity, is recorded in your Audit Trail.
• Owner-only scopes. access_review:read, employee:read and audit_log:read can be granted only by an Owner.

How to use it

1. Click the user menu, then API Tokens and Create Token. Tick the scopes you need and choose an expiry within the longest allowed for them.
2. Call an operation, for example List suppliers, with Authorization: Bearer <token>.
3. Page through a list by passing meta.nextCursor of the previous page as cursor.