How do I authenticate requests to the Cyberlop API?

Steps

1. Get a personal API token from an admin. See how to get a personal API token.
2. Add the header Authorization: Bearer YOUR_TOKEN to each request.
3. Test with GET /api/auth/me. It returns the current authenticated principal. In plain words, it tells you which user the API thinks is calling, which is a quick way to prove the token works before you try anything bigger.
4. Open the API Reference page and find the endpoint you want. The chip on the right shows the permission it needs.
5. When a call fails, compare that permission with your role.

Good to know

The reference says to authenticate with a session cookie or a Bearer API token. Scripts and CI jobs should use the token. A cookie comes from a browser session that signs in through the login route, and that route slows down repeated wrong guesses.

The token carries its owner's permissions and group scope, so a narrow role makes a safer token. If you can, make a dedicated user for automation and give that user only the permissions the job needs. Never put a token in client-side code. Keep it out of public repositories too.

Not sure which permission a call needs? Read how to find the endpoint and its permission. If a call returns a permission error, see why the API refuses a call.

Related questions

• How do I get a personal API token?
• How do I find the endpoint I need and the permission it requires?
• Why does my API call return a permission error?
• How do I launch a scan through the API?
• How do I download the API spec?

Full tutorial

Cyberlop API reference: authentication, permissions and the OpenAPI spec

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre