On this page
- Who may call
- How a call is decided
- Routes
- account
- admin
- ai
- analytics
- api-keys
- approval-links
- auth
- charts
- chat
- communication
- dashboards
- detectors
- entitlements
- execution
- ingest
- ingestion
- integrations
- investigator
- logout
- manifests
- ownership
- password-reset-complete
- password-reset-request
- policies
- policy-templates
- refresh-token
- remediation
- secrets
- signin
- signup
- usage
- verify-email
- version
API reference#
<!-- Generated by scripts/api-reference.cjs. Do not edit by hand: run the script again. -->This page lists every route of the Hyvop API and the permission each one asks, as the backend decides it: the routes that need no session, the routes only an administrator may call, then the permission of each other route. It does not describe payloads.
There are 227 routes. A route served under two prefixes (/api/... and /api/v1/...) is listed once per prefix.
Who may call#
| Permission | Meaning | Held by |
|---|---|---|
OPEN |
Needs no session (sign-in, sign-up, password reset, the link mailed to an approver, the probes) | nobody (no session needed) |
SIGNED_IN |
Anybody signed in, for what is their own | viewer, user, administrator |
READ |
Read | viewer, user, administrator, API key |
OPERATE |
Operate | user, administrator |
ADMINISTER |
Administer | administrator |
API_CLIENT |
A machine holding an API key | API key |
A viewer reads. A user also operates (dashboards, remediation plans). An administrator also administers (accounts, connections, detectors, policies, settings). Whether a person may approve a given plan is not a matter of role: it is decided by who is confirmed as answering for the resource.
How a call is decided#
- A read (
GET,HEAD,OPTIONS) that no rule names asksREAD, except under/api/admin/**,/actuator/**,/api/api-keys/**, which are an administrator's. - A change (
POST,PUT,PATCH,DELETE) that no rule names asksADMINISTER, so a route added and forgotten is closed to everyone but an administrator. - Where two rules cover a call, the first decides. A few routes that set credentials have a second lock for administrators, whatever the table says. A route that only an administrator may call stays so for every caller.
- A route marked
OPENis served without a session; it may still refuse a call that carries no valid token or code.
Routes#
Paths use {name} for one path segment. Grouped by the first segment after /api and /v1.
account#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/account/{accountId}/appearance |
READ |
viewer, user, administrator, API key |
| PUT | /api/account/{accountId}/appearance |
SIGNED_IN |
viewer, user, administrator |
| GET | /api/account/{accountId}/billing |
READ |
viewer, user, administrator, API key |
| PUT | /api/account/{accountId}/billing |
ADMINISTER |
administrator |
| GET | /api/account/{accountId}/preferences |
READ |
viewer, user, administrator, API key |
| PUT | /api/account/{accountId}/preferences |
SIGNED_IN |
viewer, user, administrator |
| GET | /api/account/{accountId}/profile |
READ |
viewer, user, administrator, API key |
| PUT | /api/account/{accountId}/profile |
SIGNED_IN |
viewer, user, administrator |
admin#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/admin/ai/budget |
ADMINISTER |
administrator |
| PUT | /api/admin/ai/budget |
ADMINISTER |
administrator |
| GET | /api/admin/ai/execution |
ADMINISTER |
administrator |
| POST | /api/admin/ai/execution/custom |
ADMINISTER |
administrator |
| POST | /api/admin/ai/execution/mode |
ADMINISTER |
administrator |
| GET | /api/admin/ai/models |
ADMINISTER |
administrator |
| DELETE | /api/admin/ai/models/{tier} |
ADMINISTER |
administrator |
| PUT | /api/admin/ai/models/{tier} |
ADMINISTER |
administrator |
| POST | /api/admin/ai/models/{tier}/test |
ADMINISTER |
administrator |
| GET | /api/admin/ai/usage |
ADMINISTER |
administrator |
| GET | /api/admin/audit/events |
ADMINISTER |
administrator |
| GET | /api/admin/audit/remediations/{previewId} |
ADMINISTER |
administrator |
| GET | /api/admin/audit/types |
ADMINISTER |
administrator |
| DELETE | /api/admin/demo-data |
ADMINISTER |
administrator |
| GET | /api/admin/demo-data |
ADMINISTER |
administrator |
| DELETE | /api/admin/mail-config |
ADMINISTER |
administrator |
| GET | /api/admin/mail-config |
ADMINISTER |
administrator |
| PUT | /api/admin/mail-config |
ADMINISTER |
administrator |
| GET | /api/admin/mail-config/status |
ADMINISTER |
administrator |
| POST | /api/admin/mail-config/test |
ADMINISTER |
administrator |
| GET | /api/admin/users |
ADMINISTER |
administrator |
| POST | /api/admin/users |
ADMINISTER |
administrator |
| DELETE | /api/admin/users/{accountId} |
ADMINISTER |
administrator |
| GET | /api/admin/users/{accountId} |
ADMINISTER |
administrator |
| POST | /api/admin/users/{accountId}/password-reset |
ADMINISTER |
administrator |
| POST | /api/admin/users/{accountId}/resend-invitation |
ADMINISTER |
administrator |
| PATCH | /api/admin/users/{accountId}/role |
ADMINISTER |
administrator |
| PATCH | /api/admin/users/{accountId}/status |
ADMINISTER |
administrator |
ai#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/ai/status |
READ |
viewer, user, administrator, API key |
analytics#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/analytics/summary |
READ |
viewer, user, administrator, API key |
api-keys#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| DELETE | /api/api-keys |
ADMINISTER |
administrator |
| POST | /api/api-keys |
ADMINISTER |
administrator |
approval-links#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/approval-links/{token} |
OPEN |
nobody (no session needed) |
| POST | /api/approval-links/{token} |
OPEN |
nobody (no session needed) |
auth#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| POST | /api/auth/change-password |
SIGNED_IN |
viewer, user, administrator |
| GET | /api/auth/config |
OPEN |
nobody (no session needed) |
| POST | /api/auth/exchange |
OPEN |
nobody (no session needed) |
| GET | /api/auth/init-check |
OPEN |
nobody (no session needed) |
| POST | /api/auth/invitation/complete |
OPEN |
nobody (no session needed) |
| GET | /api/auth/invitation/validate |
OPEN |
nobody (no session needed) |
| GET | /api/auth/permissions |
SIGNED_IN |
viewer, user, administrator |
| GET | /api/auth/status |
OPEN |
nobody (no session needed) |
charts#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/charts/{id} |
READ |
viewer, user, administrator, API key |
chat#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| POST | /api/chat |
SIGNED_IN |
viewer, user, administrator |
| POST | /api/chat/stream |
SIGNED_IN |
viewer, user, administrator |
communication#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/communication/channels |
READ |
viewer, user, administrator, API key |
| POST | /api/communication/channels/read |
READ |
viewer, user, administrator, API key |
| POST | /api/communication/handle-messaging |
SIGNED_IN |
viewer, user, administrator |
| POST | /api/communication/handle-messaging-stream |
SIGNED_IN |
viewer, user, administrator |
| GET | /api/communication/my-conversations |
READ |
viewer, user, administrator, API key |
dashboards#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/dashboards |
READ |
viewer, user, administrator, API key |
| POST | /api/dashboards |
OPERATE |
user, administrator |
| DELETE | /api/dashboards/{id} |
OPERATE |
user, administrator |
| GET | /api/dashboards/{id} |
READ |
viewer, user, administrator, API key |
| PATCH | /api/dashboards/{id} |
OPERATE |
user, administrator |
| POST | /api/dashboards/{id}/charts |
OPERATE |
user, administrator |
| DELETE | /api/dashboards/charts/{chartId} |
OPERATE |
user, administrator |
| PATCH | /api/dashboards/charts/{chartId} |
OPERATE |
user, administrator |
| GET | /api/dashboards/charts/{chartId}/data |
READ |
viewer, user, administrator, API key |
detectors#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/v1/detectors |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/detectors/{id} |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/detectors/{id}/enabled |
ADMINISTER |
administrator |
| GET | /api/v1/detectors/{id}/parameters |
READ |
viewer, user, administrator, API key |
| PUT | /api/v1/detectors/{id}/parameters |
ADMINISTER |
administrator |
| GET | /api/v1/detectors/{id}/runs |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/detectors/{id}/uninstall |
ADMINISTER |
administrator |
| POST | /api/v1/detectors/{id}/update |
ADMINISTER |
administrator |
| POST | /api/v1/detectors/build |
ADMINISTER |
administrator |
| GET | /api/v1/detectors/catalogue |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/detectors/install/{id} |
ADMINISTER |
administrator |
| POST | /api/v1/detectors/run |
ADMINISTER |
administrator |
| POST | /api/v1/detectors/save |
ADMINISTER |
administrator |
| POST | /api/v1/detectors/simulate |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/detectors/update-all |
ADMINISTER |
administrator |
entitlements#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/entitlements |
READ |
viewer, user, administrator, API key |
execution#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/execution/inefficiency-store |
READ |
viewer, user, administrator, API key |
| POST | /api/execution/setup |
ADMINISTER |
administrator |
| GET | /api/execution/status |
READ |
viewer, user, administrator, API key |
ingest#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| POST | /api/v1/ingest/aws/all |
ADMINISTER |
administrator |
| POST | /api/v1/ingest/billing |
ADMINISTER |
administrator |
| POST | /api/v1/ingest/inventory |
ADMINISTER |
administrator |
| POST | /api/v1/ingest/metrics |
ADMINISTER |
administrator |
| POST | /api/v1/ingest/pricing |
ADMINISTER |
administrator |
ingestion#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/ingestion/status |
READ |
viewer, user, administrator, API key |
integrations#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/integrations |
READ |
viewer, user, administrator, API key |
| PUT | /api/integrations/{type}/config |
ADMINISTER |
administrator |
| PUT | /api/integrations/{type}/test-connection |
ADMINISTER |
administrator |
| PUT | /api/integrations/{type}/toggle |
ADMINISTER |
administrator |
| GET | /api/integrations/AWS/role-setup |
ADMINISTER |
administrator |
| GET | /api/integrations/AZURE/role-setup |
ADMINISTER |
administrator |
| GET | /api/integrations/enabled |
READ |
viewer, user, administrator, API key |
| GET | /api/integrations/GCP/role-setup |
ADMINISTER |
administrator |
investigator#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| POST | /api/v1/investigator/agent/pause |
ADMINISTER |
administrator |
| POST | /api/v1/investigator/agent/resume |
ADMINISTER |
administrator |
| GET | /api/v1/investigator/agent/status |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/investigator/deployments |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/investigator/deployments/cleanup |
ADMINISTER |
administrator |
| GET | /api/v1/investigator/findings |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/investigator/findings/{resourceId} |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/investigator/integrations/available |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/investigator/integrations/connect |
ADMINISTER |
administrator |
| GET | /api/v1/investigator/integrations/connected |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/investigator/integrations/disconnect |
ADMINISTER |
administrator |
| GET | /api/v1/investigator/integrations/health |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/investigator/investigate-all |
ADMINISTER |
administrator |
| POST | /api/v1/investigator/investigate/{resourceId} |
OPERATE |
user, administrator |
| GET | /api/v1/investigator/thoughts/stream |
READ |
viewer, user, administrator, API key |
logout#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| POST | /api/logout |
OPEN |
nobody (no session needed) |
manifests#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| POST | /api/v1/manifests |
API_CLIENT |
API key |
ownership#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/v1/ownership/activity |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/agents |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/ownership/agents/{agentId}/execute |
ADMINISTER |
administrator |
| POST | /api/v1/ownership/agents/{agentId}/nodes/{nodeId}/run |
ADMINISTER |
administrator |
| POST | /api/v1/ownership/agents/{agentId}/nodes/run-all |
ADMINISTER |
administrator |
| POST | /api/v1/ownership/agents/{agentId}/toggle |
ADMINISTER |
administrator |
| GET | /api/v1/ownership/agents/estimate |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/ownership/agents/investigate-batch |
ADMINISTER |
administrator |
| GET | /api/v1/ownership/agents/pipeline |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/ownership/agents/rerun |
ADMINISTER |
administrator |
| POST | /api/v1/ownership/agents/rerun-all |
ADMINISTER |
administrator |
| POST | /api/v1/ownership/agents/reset |
ADMINISTER |
administrator |
| POST | /api/v1/ownership/agents/run |
ADMINISTER |
administrator |
| GET | /api/v1/ownership/agents/signals |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/ownership/agents/stop |
ADMINISTER |
administrator |
| GET | /api/v1/ownership/agents/stream |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/ownership/assignments/bulk |
ADMINISTER |
administrator |
| GET | /api/v1/ownership/escalations |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/findings/{id} |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/ownership/findings/search |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/graph |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/ownership/graph/node/search |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/graph/stats |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/knowledge/estimate |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/knowledge/preview |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/knowledge/runs |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/knowledge/runs/{jobId} |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/ownership/knowledge/runs/{jobId}/steps/{stepId}/retry |
ADMINISTER |
administrator |
| GET | /api/v1/ownership/knowledge/runs/latest |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/ownership/knowledge/start |
ADMINISTER |
administrator |
| GET | /api/v1/ownership/knowledge/status |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/knowledge/stream |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/people |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/people/{id} |
READ |
viewer, user, administrator, API key |
| PATCH | /api/v1/ownership/people/{id} |
ADMINISTER |
administrator |
| GET | /api/v1/ownership/people/{id}/resources |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/ownership/remediation-path/search |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/resources |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/resources/{id}/activity |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/resources/{id}/assignments |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/resources/{id}/findings |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/resources/{id}/timeline |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/ownership/resources/assign-role |
ADMINISTER |
administrator |
| POST | /api/v1/ownership/resources/search |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/ownership/resources/unassign-role |
ADMINISTER |
administrator |
| GET | /api/v1/ownership/search |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/ownership/suggestions/accept |
ADMINISTER |
administrator |
| POST | /api/v1/ownership/suggestions/reject |
ADMINISTER |
administrator |
| POST | /api/v1/ownership/suggestions/search |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/ownership/timeline/search |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/ownership/unassigned |
READ |
viewer, user, administrator, API key |
password-reset-complete#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| POST | /api/password-reset-complete |
OPEN |
nobody (no session needed) |
password-reset-request#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| POST | /api/password-reset-request |
OPEN |
nobody (no session needed) |
policies#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/policies |
READ |
viewer, user, administrator, API key |
| POST | /api/policies |
ADMINISTER |
administrator |
| DELETE | /api/policies/{id} |
ADMINISTER |
administrator |
| POST | /api/policies/draft |
ADMINISTER |
administrator |
| GET | /api/policies/evaluate |
READ |
viewer, user, administrator, API key |
| GET | /api/policies/exemptions |
READ |
viewer, user, administrator, API key |
| POST | /api/policies/from-template/{templateId} |
ADMINISTER |
administrator |
| GET | /api/policies/search |
READ |
viewer, user, administrator, API key |
| POST | /api/policies/simulate |
OPERATE |
user, administrator |
policy-templates#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/policy-templates |
READ |
viewer, user, administrator, API key |
refresh-token#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| POST | /api/refresh-token |
OPEN |
nobody (no session needed) |
remediation#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/remediation/governance |
READ |
viewer, user, administrator, API key |
| POST | /api/remediation/plan/{resourceId} |
OPERATE |
user, administrator |
| GET | /api/remediation/preview/{previewId} |
READ |
viewer, user, administrator, API key |
| GET | /api/remediation/preview/{previewId}/approval-requests |
READ |
viewer, user, administrator, API key |
| POST | /api/remediation/preview/{previewId}/approval-requests |
OPERATE |
user, administrator |
| POST | /api/remediation/preview/{previewId}/approve |
OPERATE |
user, administrator |
| GET | /api/remediation/preview/{previewId}/chain |
READ |
viewer, user, administrator, API key |
| POST | /api/remediation/preview/{previewId}/edit |
OPERATE |
user, administrator |
| POST | /api/remediation/preview/{previewId}/reject |
OPERATE |
user, administrator |
| GET | /api/remediation/preview/{previewId}/review |
READ |
viewer, user, administrator, API key |
| GET | /api/remediation/preview/latest/{resourceId} |
READ |
viewer, user, administrator, API key |
| GET | /api/remediation/previews |
READ |
viewer, user, administrator, API key |
| GET | /api/remediation/queue |
READ |
viewer, user, administrator, API key |
| GET | /api/remediation/resource/{resourceId}/preview |
READ |
viewer, user, administrator, API key |
| GET | /api/remediation/screens |
READ |
viewer, user, administrator, API key |
| GET | /api/remediation/stats |
READ |
viewer, user, administrator, API key |
| GET | /api/remediation/stream |
READ |
viewer, user, administrator, API key |
| GET | /api/remediation/thoughts/stream |
READ |
viewer, user, administrator, API key |
| GET | /api/remediation/ticket-destinations |
READ |
viewer, user, administrator, API key |
| GET | /api/remediation/tickets |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/remediation/governance |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/remediation/plan/{resourceId} |
OPERATE |
user, administrator |
| GET | /api/v1/remediation/preview/{previewId} |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/remediation/preview/{previewId}/approval-requests |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/remediation/preview/{previewId}/approval-requests |
OPERATE |
user, administrator |
| POST | /api/v1/remediation/preview/{previewId}/approve |
OPERATE |
user, administrator |
| GET | /api/v1/remediation/preview/{previewId}/chain |
READ |
viewer, user, administrator, API key |
| POST | /api/v1/remediation/preview/{previewId}/edit |
OPERATE |
user, administrator |
| POST | /api/v1/remediation/preview/{previewId}/reject |
OPERATE |
user, administrator |
| GET | /api/v1/remediation/preview/{previewId}/review |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/remediation/preview/latest/{resourceId} |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/remediation/previews |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/remediation/queue |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/remediation/resource/{resourceId}/preview |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/remediation/screens |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/remediation/stats |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/remediation/stream |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/remediation/thoughts/stream |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/remediation/ticket-destinations |
READ |
viewer, user, administrator, API key |
| GET | /api/v1/remediation/tickets |
READ |
viewer, user, administrator, API key |
secrets#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/secrets/status |
READ |
viewer, user, administrator, API key |
signin#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| POST | /api/signin |
OPEN |
nobody (no session needed) |
signup#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| POST | /api/signup |
OPEN |
nobody (no session needed) |
usage#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/usage |
READ |
viewer, user, administrator, API key |
verify-email#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| POST | /api/verify-email |
OPEN |
nobody (no session needed) |
version#
| Method | Path | Asks | Who may call |
|---|---|---|---|
| GET | /api/version |
READ |
viewer, user, administrator, API key |