Referencia API

API RESTful

Integre CyberSec Pro en sus flujos de trabajo con nuestra API completa.

121

Total Endpoints

/api/v1

Base Path

Token or API key

Auth

20-300/min

Rate Limit

URL base

https://api.cyber-sec-pro.com/api/v1

Todos los endpoints usan HTTPS; las peticiones HTTP se redirigen. Se requiere TLS 1.3.

Autenticación

# Automation: an API key (Settings → API Keys)
Authorization: Bearer csp_...      # or  X-API-Key: csp_...

# Interactive: sign in for a 60-minute access token
POST /api/v1/auth/login
{ "email": "user@co.com", "password": "..." }
→ { "access_token": "eyJ...", "token_type": "Bearer", ... }
  (refresh token: httpOnly cookie; with two-factor on,
   → { "mfa_required": true, "mfa_ticket": "..." })

Códigos de error

200OK — Request succeeded
201Created — Resource created
400Bad Request — Invalid parameters
401Unauthorized — Invalid or missing token
402Payment Required — Your plan does not include this
403Forbidden — Your role may not do this (see the code field)
404Not Found — Resource doesn't exist
429Rate Limited — Too many requests
500Server Error — Internal failure

Límite de peticiones

/api/v1/ai/, /api/v1/chatbot/20 req/min
/api/v1/scans/30 req/min
/api/v1/auth/60 req/min
Everything else300 req/min

Los límites se aplican por cliente y son iguales en todos los planes. Al superar un límite, la API responde 429 con una cabecera Retry-After, en segundos.

Puntos de acceso

121 endpoints en 12 grupos. Haz clic en un grupo para desplegarlo.

POST/api/v1/auth/register
PUBLIC
POST/api/v1/auth/login
PUBLIC
POST/api/v1/auth/mfa/challenge
PUBLIC
POST/api/v1/auth/refresh
PUBLIC
POST/api/v1/auth/logout
POST/api/v1/auth/logout-all
GET/api/v1/auth/me
PUT/api/v1/auth/profile
POST/api/v1/auth/change-password
POST/api/v1/auth/forgot-password
PUBLIC
POST/api/v1/auth/reset-password
PUBLIC
POST/api/v1/auth/resend-verification
GET/api/v1/auth/verify-email
PUBLIC
POST/api/v1/auth/avatar
GET/api/v1/auth/avatar/:user_id
POST/api/v1/auth/mfa/setup
POST/api/v1/auth/mfa/verify-setup
GET/api/v1/auth/mfa/status
POST/api/v1/auth/mfa/disable
POST/api/v1/auth/mfa/regenerate-backup
POST/api/v1/auth/google
PUBLIC
POST/api/v1/auth/github
PUBLIC
POST/api/v1/auth/linkedin
PUBLIC
GET/api/v1/auth/sso/saml/init
PUBLIC
GET/api/v1/auth/sso/oidc/init
PUBLIC
POST/api/v1/auth/sso/ldap
PUBLIC

Ejemplos de petición y respuesta

POST /api/v1/scans

// Request
{
  "tool": "nmap",
  "target": "scanme.nmap.org",
  "parameters": {
    "scan_type": "-sT",
    "timing": "-T4",
    "port_spec": "--top-ports 1000",
    "service_detection": true
  }
}
// A target that is not a public practice host also needs
// "authorization": { "confirmed": true, "scope_statement": "..." }
// with the statement from POST /api/v1/authorizations/preview.

// Response 201
{
  "success": true,
  "message": "Scan started",
  "scan_id": "4f9c…",
  "status": "running",
  "command": "nmap -sT -T4 --top-ports 1000 -sV scanme.nmap.org",
  ...
}

GET /api/v1/scan/:id/result

// Response 200
{
  "scan": {
    "id": "4f9c…",
    "status": "completed",
    "tool_name": "nmap",
    "target": "scanme.nmap.org",
    "output": "Starting Nmap 7.99 ...",
    "error_log": null,
    ...
  },
  "execution_result": {
    "status": "completed",
    "output": "...",
    "findings": { ... }
  }
}

// findings is stored in one of two shapes: the scan
// engine's { "services": [...], "vulnerabilities": [...] },
// or a list of scanner lines [{ "type": "finding",
// "value": "22/tcp open ssh" }, ...]. Handle both.

Paginación

GET /api/v1/scans?page=1&per_page=25&status=completed

// per_page is at most 100. Response:
{
  "scans": [...],
  "total": 142,
  "page": 1,
  "per_page": 25
}

Eventos de webhook

// Webhook integration: POST to your URL
{
  "event": "scan_completed",
  "timestamp": "2026-10-02T14:45:00+00:00",
  "source": "cybersec-pro",
  "data": {
    "scan_id": "4f9c…",
    "tool": "nuclei",
    "target": "staging.example.com",
    "status": "completed",
    "findings": { "total": 12, "critical": 1, "high": 3 }
  }
}

// Events: scan_completed, scan_failed,
// vulnerability_critical, vulnerability_high.
// Each integration receives only the events you pick.