How do I find the endpoint I need and the permission it requires?

Steps

1. Pick API Reference from the sidebar.
2. Click the filter box. Its placeholder reads "Filter by path, method, permission...".
3. Type what you know. Try targets, POST or scan:run.
4. Read the matching rows. Each has a coloured method badge, the path, a short description and a chip with the permission.
5. Check that the owner of your token holds that permission.

Good to know

Badges follow a simple colour code, so you can scan the page quickly.

A path followed by "file" returns a file, such as a PDF report or an export. The page lists 78 endpoints in 15 sections, from Authentication to Health. Short sections like Schedules and Export hold only a handful of routes, whereas Administration splits into two groups for users and tokens, and for roles and teams.

Permissions read as area:action. For example, target:read lets a caller list targets, while scan:run lets a caller launch a scan. Some routes are public or only need a signed-in session, and the chip says so.

If you filter by a permission, you also learn which routes a role with that permission can reach. That helps when you design a narrow role for automation. The key format has its own page: what a permission key looks like. A refused call has one too, why the API says no, and it is worth keeping both open while you build your first integration.

Related questions

• How are permissions named?
• How do I download the API spec?
• Why does my API call return a permission error?
• What can I do with the Cyberlop API?
• How do I authenticate requests to the Cyberlop API?

Full tutorial

Cyberlop API reference: authentication, permissions and the OpenAPI spec

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre