AYAsec API Endpoints

Browse the AYAsec public API reference for targets, scans, reports, alerts, vulnerabilities, members, and audit logs.

The interactive API explorer loads in the browser. This static reference keeps the public endpoint inventory available to search engines, link previews, and non-JavaScript readers.

Endpoint groups

  • alerts
  • assets
  • audit
  • discovery
  • findings
  • members
  • notifications
  • reports
  • roles
  • scans
  • schedules
  • stats
  • target-groups
  • targets
  • techs
  • triggers
  • vulnerabilities
  • webhooks
  • workspaces

Paths

  • GET /alerts - List grade-regression alerts visible to this token, each joined to its originating event.
  • GET /alerts/{id} - Fetch one alert with its full originating event.
  • PATCH /alerts/{id}/acknowledge - Acknowledge an open alert.
  • PATCH /alerts/{id}/resolve - Resolve an alert (marked resolved by the token's user).
  • POST /alerts/bulk-acknowledge - Acknowledge many open alerts at once. Out-of-scope or non-open ids are skipped.
  • POST /alerts/bulk-resolve - Resolve many alerts at once. Out-of-scope or already-resolved ids are skipped.
  • GET /events - List the immutable grade-change event log visible to this token (regressions + recoveries).
  • GET /vulnerabilities - List CVE findings across the token's targets. Sourced from run CVE checks (see the endpoint note); joined to scan_jobs for workspace scoping.
  • GET /vulnerabilities/{id} - Fetch one CVE finding by its result id.
  • PATCH /vulnerabilities/{id} - Set a vulnerability's triage status (open, acknowledged, resolved, or false_positive).
  • POST /vulnerabilities/bulk-update-status - Set the triage status for many vulnerabilities at once. Out-of-scope ids are skipped.
  • GET /stats - Posture, scan-activity and open-alert aggregates for the token's scope. Org-wide tokens also receive a per-workspace breakdown; workspace-bound tokens see only their workspaces.
  • GET /target-groups - List target groups visible to this token, each with member count and worst-of composite grade.
  • POST /target-groups - Create a target group. Workspace-bound tokens must set workspaceId to one of their workspaces; org-wide tokens may create org-level groups (workspaceId null) or any-workspace groups.
  • GET /target-groups/{id} - Fetch one group with its members (each carrying its latest grade/score).
  • PATCH /target-groups/{id} - Update a group's name, description, color or icon.
  • DELETE /target-groups/{id} - Delete a group. Membership rows are removed; the targets themselves are untouched.
  • POST /target-groups/{id}/members - Add targets to a group. For a workspace group, only targets in that workspace are eligible.
  • DELETE /target-groups/{id}/members/{targetId} - Remove one target from a group.
  • POST /target-groups/{id}/scan - Launch the selected scan types across every member of the group, applying in-group and DB apex-inheritance. (target, type) pairs that already have an active scan are skipped.
  • GET /schedules - List scheduled scan tasks visible to this token.
  • POST /schedules - Create a scheduled scan task (cron minute must be a fixed value - at most once per hour).
  • PATCH /schedules/{id} - Update a scheduled task.
  • DELETE /schedules/{id} - Delete a scheduled task.
  • GET /triggers - List event-based triggers visible to this token.
  • POST /triggers - Create an event-based trigger (runs the given scan types when the event fires).
  • PATCH /triggers/{id} - Update a trigger.
  • DELETE /triggers/{id} - Delete a trigger.
  • GET /receivers - List notification receivers. Requires an org-wide token.
  • POST /receivers - Create a notification receiver (must have an e-mail address or a webhook URL). Requires an org-wide token.
  • PATCH /receivers/{id} - Update a notification receiver. Requires an org-wide token.
  • DELETE /receivers/{id} - Delete a notification receiver. Requires an org-wide token.
  • POST /receivers/{id}/test - Send a test notification through a receiver. Requires an org-wide token.
  • GET /assets - Unified attack-surface inventory: registered targets (authoritative, from the DB) plus live subdomains discovered by the most recent discovery scans (best-effort, from storage). truncated flags indicate whether either source hit its cap.
  • GET /discovery - List the most recent completed discovery scan per domain. Fetch the full subdomain inventory for one via GET /api/v1/reports/{scanId}.
  • GET /techs - Technology inventory aggregated from CVE-check results, most findings first. Only covers technologies a CVE check has run against (see the endpoint note).
  • GET /webhooks - List outbound webhooks. Requires an org-wide token. Secrets are never returned.
  • POST /webhooks - Register an outbound webhook. Returns the signing secret once. Requires an org-wide token.
  • GET /webhooks/{id} - Fetch one webhook. Requires an org-wide token.
  • PATCH /webhooks/{id} - Update a webhook's URL, events or active flag. Requires an org-wide token.
  • DELETE /webhooks/{id} - Delete a webhook. Requires an org-wide token.
  • POST /webhooks/{id}/rotate-secret - Generate a new signing secret for a webhook, returned once. Requires an org-wide token.
  • POST /webhooks/{id}/test - Send a signed 'ping' test delivery to a webhook and report the result. Requires an org-wide token.
  • GET /findings - List findings across the token's targets, from every scan type. Joined to scan_jobs for workspace scoping.
  • GET /findings/{id} - Fetch one finding by its id.
  • PATCH /findings/{id} - Set a finding's triage status (open, acknowledged, resolved, or false_positive).
  • POST /findings/bulk-update-status - Set the triage status for many findings at once. Out-of-scope ids are skipped.
  • GET /workspaces - List workspaces visible to this token.
  • GET /scans - List scan jobs visible to this token, most recent first.
  • POST /scans - Queue a new scan for a target. Heavier operation — lower rate limit.
  • GET /scans/{id} - Fetch one scan job by id.
  • DELETE /scans/{id} - Delete a scan job. If subdomain scans inherited this scan's result, pass ?cascade=true to delete them too; otherwise the request is refused with 400.
  • POST /scans/batch - Queue all five scan types (tls, ports, dns, http, credibility) for a target as one batch, applying apex-inheritance. Heavier operation - lower rate limit.
  • GET /scans/{id}/progress - Live progress for a scan: percent complete, current task label, and the raw task log. Returns data:null when no progress has been recorded yet.
  • GET /targets - List targets visible to this token.
  • POST /targets - Register a new target.
  • GET /targets/{id} - Fetch one target by id.
  • PATCH /targets/{id} - Update a target's fields.
  • DELETE /targets/{id} - Delete a target. Scans already run against it are kept but unlinked.
  • POST /targets/{id}/verify - Attempt domain-ownership verification for a target, via DNS TXT record, well-known file, or meta tag.
  • GET /targets/{id}/workspaces - List the workspaces this target belongs to.
  • POST /targets/{id}/workspaces/{workspaceId} - Add a target to a workspace.
  • DELETE /targets/{id}/workspaces/{workspaceId} - Remove a target from a workspace. Refuses if it would leave the target with zero workspaces.
  • GET /reports/{id} - Fetch the full result body for a completed scan by scan id.
  • GET /members - List organisation members. Requires an org-wide token.
  • GET /roles - List roles defined in this organisation. Requires an org-wide token.
  • POST /members/invite - Invite a new organisation member by e-mail. Requires an org-wide token, and the token's own user must be an org_admin.
  • PATCH /members/{id} - Change a member's role (builtin or custom). Requires an org-wide token, and the token's own user must be an org_admin.
  • DELETE /members/{id} - Deactivate a member (soft delete - revokes sessions and personal API tokens, removes workspace memberships). Requires an org-wide token, and the token's own user must be an org_admin.
  • GET /audit-log - List audit log entries, filtered and paginated. Requires an org-wide token. Bounded by the org's plan retention window.