How do I manage scan agents through the API?

Steps

1. Send your Bearer token with each request.
2. List agents with GET /api/agents. Each one comes back with live online or offline status, and the call needs profile:read.
3. Register an agent with POST /api/agents. The response carries a one-time enrollment token that you see once, so save it straight away. This needs settings:update.
4. Run the agent container inside your network with that token. After first start it trades the token for a durable key and shows as online.
5. Retire an agent with DELETE /api/agents/:id, again with settings:update.

Good to know

Revoking invalidates the agent's key at once, and any profile that used it goes back to the Cyberlop cloud. Check who relies on an agent before you remove it. A profile that scans a private app will then try to reach it from outside your network.

The agent talks to Cyberlop over outbound HTTPS only, so no inbound ports need opening. The messages between agent and cloud use the agent key, and you never call them yourself. The operator routes above are the supported way to manage agents.

The same actions live in the app under Settings → Scan Agents, where the Add agent button gives you the token and a ready-made container command. Prefer clicking? Read the self-hosted scan agents guide. For API basics, start with how to authenticate requests.

Related questions

• How do I authenticate requests to the Cyberlop API?
• How do I find the endpoint I need and the permission it requires?
• How do I launch a scan through the API?
• Why does my API call return a permission error?
• What can I do with the Cyberlop API?

Full tutorial

Cyberlop self-hosted scan agents: scan private apps from inside your network

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre