How do I list my targets through the API?

Steps

1. Send your Bearer token with the request.
2. Call GET /api/targets. It needs target:read.
3. Read each entry. It includes the latest-scan rollup and severity counts, which matches the dots and counts you see on the Targets page.
4. For one application, call GET /api/targets/:id.
5. To get a file, call GET /api/export/targets and add ?format=json or ?format=csv.

Good to know

The list shows targets within the permissions and group scope of the token's owner. Two tokens can therefore return different lists from the same organisation.

Targets never change after you create them. The API reference says as much: a target is immutable. There is no update route, only create with POST /api/targets and delete with DELETE /api/targets/:id. Be careful with delete, because it also removes the target's profiles, schedules, scans and findings.

Use the list to build a dashboard of your own, to check that every app you care about has a recent scan, or to feed a ticket system with severity counts. For a ready-made overview, the app has its Dashboard, and the dashboard endpoint gives you the same figures. When a call fails, read why the API says no.

Related questions

• How do I get the Dashboard numbers through the API?
• How do I export my list of targets?
• How do I find the endpoint I need and the permission it requires?
• How do I authenticate requests to the Cyberlop API?
• Why does my API call return a permission error?

Full tutorial

Cyberlop API reference: authentication, permissions and the OpenAPI spec

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre