The Cyberlop API exposes the same actions as the web app: 78 endpoints in 15 groups. You can manage targets and profiles, launch and cancel scans, read and triage issues, schedule runs, pull reports, and administer users. Each endpoint checks one named permission.
The short version
Almost everything you click in the web app has an endpoint behind it. The API Reference page lists all 78, grouped into 15 sections, and each row shows the method, the path, a one-line description and the permission it needs.
How it works in Cyberlop
You sign in to the API with a session cookie or a Bearer API token. Scripts and pipelines use the token. Each route then checks the permission shown in its row, so a token can only do what its owner may do.
These are the main groups and what they let you do.
| Group | What you can do |
|---|---|
| Targets and Scan profiles | List, create and delete targets. Create, update and delete profiles. |
| Scans | Launch, refresh, cancel and delete scans. Download the PDF report and the diff. |
| Issues and findings | List issues, read one, and triage it. |
| Schedules, Groups, tags | Manage recurring runs, groups and tags. Search across the workspace. |
| Dashboard, activity, Export | Read posture numbers, the audit log and the activity feed. Export targets and issues. |
| Settings and Scan agents | Change organisation settings. Register and revoke agents. |
| Administration | Manage users, API tokens, roles and teams. |
| CI/CD integration | Trigger a scan and poll its result from a pipeline. |
The page also has a filter box. Type a path, a method or a permission to narrow the list. The JSON and OpenAPI buttons at the top right download the spec.
What to do next
- Start with a pipeline. Read how to trigger a scan from CI.
- Learn to sign requests in how to authenticate API requests.
- Check what a call needs in how to find an endpoint's permission.
For a full walkthrough of tokens, read API tokens and permissions. Any HTTP client works, so no special API library is needed.
Related questions
- How do I authenticate requests to the Cyberlop API?
- How do I find the endpoint I need and the permission it requires?
- How do I launch a scan through the API?
- How do I download the API spec?
- How do I trigger a Cyberlop scan from my CI pipeline?
Cyberlop API reference: authentication, permissions and the OpenAPI spec
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Wiring it into your pipeline?
Share what you are building and we will help you set up the right token, profile and job.