API Reference

REST API for every Sectora feature. JSON in, JSON out. Authenticated with API keys; rate-limited per key. Same API the dashboard uses.

The interactive explorer lets you try every endpoint live against your account. The page below is the static reference summarizing what exists.

Base URL

https://api.sectora.io

Authentication

Authorization: Bearer sect_live_...

Generate keys at Settings → API Keys. Each key has explicit scopes — see Authentication for the scope catalogue.

Endpoint categories

Scans

GET    /api/v1/scans                           List all scans
POST   /api/v1/scans                           Create DAST scan
GET    /api/v1/scans/:id                       Get scan details
DELETE /api/v1/scans/:id                       Cancel scan
GET    /api/v1/scans/:id/diff                  Diff vs baseline
GET    /api/v1/scans/:id/coverage              Coverage report

POST   /api/v1/sast/scans                      Create SAST scan
POST   /api/v1/sca/scans                       Create SCA scan
POST   /api/v1/secrets/scans                   Create Secrets scan
POST   /api/v1/api-scans                       Create API scan
POST   /api/v1/cve-scans                       Create CVE-targeted scan

POST   /api/v1/scan-schedules                  Create schedule
GET    /api/v1/scan-schedules                  List schedules
PATCH  /api/v1/scan-schedules/:id              Update schedule
DELETE /api/v1/scan-schedules/:id              Delete schedule

Vulnerabilities

GET    /api/v1/vulnerabilities                 List + filter
GET    /api/v1/vulnerabilities/:id             Detail
PATCH  /api/v1/vulnerabilities/:id             Update status, FP, notes
POST   /api/v1/vulnerabilities/:id/verify      Run verify-fix
POST   /api/v1/vulnerabilities/:id/ticket      Create tracker ticket
POST   /api/v1/vulnerabilities/:id/virtual-patch  Deploy Shield rule

Shield

See Shield API for the dedicated breakdown.

Integrations + identity

GET    /api/v1/integrations                    List connected providers
POST   /api/v1/integrations/:provider/connect  OAuth start
DELETE /api/v1/integrations/:id                Disconnect

GET    /api/v1/me                              Current user
GET    /api/v1/orgs/current                    Current org
GET    /api/v1/orgs/current/members            List members
POST   /api/v1/orgs/current/invite             Invite user

Webhooks

GET    /api/v1/webhooks                        List webhooks
POST   /api/v1/webhooks                        Create webhook
DELETE /api/v1/webhooks/:id                    Delete

# Inbound (Sectora receives):
POST   /api/v1/webhooks/stripe                 Stripe billing events
POST   /api/v1/webhooks/github                 GitHub repo events

Standards

  • Pagination — cursor-based. ?limit=50&cursor=...; next cursor in response pagination.next.
  • Filtering — query params with the same name as the field. Multi-value with comma (e.g. ?severity=high,critical).
  • Errors — standard { "error": { "code": "...", "message": "...", "details": {} } } shape with appropriate HTTP status.
  • Idempotency — mutating endpoints accept Idempotency-Key header; same key within 24h replays the original response.
  • Rate limits — 100 req/min per key default; 30/min for analytics endpoints. 429 with Retry-After.
  • Versioning — URL-based (/api/v1/). v1 is stable; deprecations announced 6 months in advance.

SDKs

  • Node.js — npm install @sectora/sdk
  • Python — pip install sectora
  • Go — go get github.com/sectora/sectora-go
  • Terraform provider — sectora/sectora on the registry; manage scans + Shield rules as IaC

What's next