Modify Data

Table of Contents

• Agent & MCP

• Data Types & Auth Types

Agent & MCP

#	API	Description
1	POST /api/createCollection	Create a new Agentic Collection in Akto.
2	POST /api/createCustomCollection	Create a custom Agentic Collection by grouping selected Agentic Components.
3	POST /api/addApisToCustomCollection	Add Agentic Components to an existing custom agentic collection.
4	POST /api/saveCollectionDescription	Save or update the description of an agentic collection.
5	POST /api/updateEnvType	Update the environment type (e.g., prod, staging) for an agentic collection.
6	POST /api/toggleCollectionsOutOfTestScope	Mark/unmark agentic collections as out of scan scope.
7	POST /api/deactivateCollections	Deactivate specific agentic collections so they are no longer active.
8	POST /api/deleteMultipleCollections	Delete multiple agentic collections at once.
9	POST /api/redactCollection	Redact sensitive data within an agentic collection.
10	POST /api/saveEndpointDescription	Save or update the description of a specific Agentic component.
11	POST /api/loadParamsOfEndpoint	Load the Agentic Parameters (query, path, body) of a given Agentic component.
12	POST /api/loadSensitiveParameters	Load Agentic Parameters identified as sensitive for a given agentic component/collection.
13	POST /api/importDataFromOpenApiSpec	Import Agentic components and Agentic Collections from an OpenAPI specification file.
14	POST /api/uploadHar	Upload a HAR (HTTP Archive) file to create or update Agentic Component data in Akto.
15	POST /api/importDataFromPostmanFile	Import Agentic Component data from a Postman agentic collection file.
16	POST /api/importPostmanWorkspace	Import Agentic Components from a Postman workspace.
17	POST /api/addSensitiveField	Add or mark a field as containing Sensitive in Response data.
18	POST /api/saveAktoDataType	Save or update a custom data type configuration.
19	POST /api/addMcpRegistryIntegration	Adds or updates MCP registry integrations with validation for duplicate names/URLs and maximum limits (10 registries max).
20	POST /api/createAgentRun	Creates a new agent run with initialization data, checking for existing running agents and validating the model.
21	POST /api/deleteAgentModel	Deletes an agent model by name with audit logging.
22	POST /api/deleteAgentRun	Deletes an agent run (only allowed for SCHEDULED, RUNNING, or STOPPED states) and associated subprocesses.
23	POST /api/feedDataToAgent	Polling endpoint for agent to get initialization data or next subprocess task.
24	POST /api/feedDiscoveryDataToAgent	Polling endpoint for discovery agent to get initialization or next discovery subprocess task.
25	POST /api/initiateAIAgentConnectorImport	Initiates a recurring import job for AI agent connector data with connector-specific validation and configuration.
26	POST /api/saveAgentModel	Saves a new AI model configuration with type-specific validation.
27	POST /api/updateAgentHealthCheck	Updates agent health check status with instance ID, version, and process information.
28	POST /api/updateAgentRun	Updates the state of an agent run, setting appropriate timestamps for RUNNING and COMPLETED states.
29	POST /api/updateAgentSubprocess	Updates subprocess state, heading, and user input with upsert behavior and validation. RE_ATTEMPT state is only allowed if current state is COMPLETED.
30	POST /api/updateStateOfDiscoveryAgentRun	Updates state and optionally results for a discovery agent run.
31	POST /api/createSensitiveResponseDataTypes	Asynchronously creates custom Sensitive in Response data types from detected data in Agentic Responses using pattern matching and machine learning.
32	POST /api/createSubProcessNew	Creates a new discovery subprocess with user input data for hostname and auth token.
33	POST /api/initiateMCPRecon	Initiates MCP reconnaissance for specified IP ranges, creating a pending reconnaissance request.
34	POST /api/initiateMCPScan	Initiates an MCP server scan by creating an Agentic Collection and scheduling a MCP tools sync job.
35	POST /api/saveVulnerabilities	Saves source code vulnerabilities found by agent to the database for tracking and remediation.
36	POST /api/activateCollections	Activate one or more Agentic Collections.
37	POST /api/deleteApis	Delete one or more Agentic Components.
38	POST /api/removeApisFromCustomCollection	Remove Agentic Components from a custom agentic collection.
39	POST /api/computeCustomCollections	Compute and create custom Agentic Collections based on criteria.
40	POST /api/uploadTcp	Upload TCP traffic data (HAR format).
41	POST /api/updateCustomCollection	Update details of a custom agentic collection.
42	POST /api/deleteCollection	Delete an entire Agentic Collection.
43	POST /api/deleteUntrackedCollections	Delete agentic collections that are not being tracked.
44	POST /api/updateUserCollections	Update user permissions for agentic collections.
45	POST /api/addApiCollectionNameMapper	Add a mapping for Agentic Collection names.
46	POST /api/deleteApiCollectionNameMapper	Delete an Agentic Collection name mapper.
47	POST /api/deMergeApi	Separate a merged Agentic Component into individual components.
48	POST /api/bulkDeMergeApis	Bulk de-merge multiple Agentic Components.
49	POST /api/undoDemergedApis	Undo de-merging of Agentic Components.
50	POST /api/editCollectionName	Edit the name of an Agentic Collection.
51	POST /api/deleteApisBasedOnHeader	Delete Agentic Components based on header matching criteria.
52	POST /api/syncExtractedAPIs	Sync Agentic Components extracted from code analysis.

POST request for endpoint /api/addApisToCustomCollection

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

collectionNamestringOptional

Name of the existing custom collection to add APIs into

Example: Critical APIs

apiListobject[]Optional

List of API endpoints to add

Responses

200

APIs added to collection

application/json

Sample description

apiCollectionsobject[]Optional

post/api/addApisToCustomCollection

POST /api/addApisToCustomCollection HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 49

{
  "collectionName": "Critical APIs",
  "apiList": [
    {}
  ]
}

200

APIs added to collection

{
  "apiCollections": [
    {}
  ]
}

POST request for endpoint /api/saveEndpointDescription

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

apiCollectionIdintegerOptionalExample: 1770879436

urlstringOptionalExample: /api/users/{id}

methodstring · enumOptionalExample: GETPossible values:

descriptionstringOptionalExample: Returns user profile for the given ID

Responses

200

Endpoint description saved

application/json

Sample description

statusstringOptionalExample: SUCCESS

post/api/saveEndpointDescription

POST /api/saveEndpointDescription HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 123

{
  "apiCollectionId": 1770879436,
  "url": "/api/users/{id}",
  "method": "GET",
  "description": "Returns user profile for the given ID"
}

200

Endpoint description saved

{
  "status": "SUCCESS"
}

POST request for endpoint /api/updateEnvType

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

apiCollectionIdsinteger[]OptionalExample: [1770879436,1234567890]

envTypeobject[]Optional

List of environment tags to apply

resetEnvTypesbooleanOptional

If true, clears all existing environment tags

Default: false

Responses

200

Environment types updated

application/json

Sample description

responseobjectOptional

post/api/updateEnvType

POST /api/updateEnvType HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 81

{
  "apiCollectionIds": [
    1770879436,
    1234567890
  ],
  "envType": [
    {}
  ],
  "resetEnvTypes": false
}

200

Environment types updated

{
  "response": {}
}

POST request for endpoint /api/toggleCollectionsOutOfTestScope

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

apiCollectionIdsinteger[]OptionalExample: [1770879436]

currentIsOutOfTestingScopeValbooleanOptional

Current value being toggled FROM

Example: true

Responses

200

Test scope toggled successfully

application/json

Sample description

post/api/toggleCollectionsOutOfTestScope

POST /api/toggleCollectionsOutOfTestScope HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 70

{
  "apiCollectionIds": [
    1770879436
  ],
  "currentIsOutOfTestingScopeVal": true
}

200

Test scope toggled successfully

{
  "response": {
    "success": true
  }
}

POST request for endpoint /api/uploadHar

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

apiCollectionIdintegerOptional

ID of an existing collection to import into

Example: 1770879436

apiCollectionNamestringOptional

Name for a new collection to create

Example: HAR Import

harStringstringOptional

HAR file contents as a JSON string

contentobjectOptional

Alternative to harString — HAR contents as parsed JSON

Responses

200

HAR uploaded and processing started

application/json

Sample description

harErrorsstring[]Optional

Non-fatal warnings during HAR parsing

post/api/uploadHar

POST /api/uploadHar HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 95

{
  "apiCollectionId": 1770879436,
  "apiCollectionName": "HAR Import",
  "harString": "text",
  "content": {}
}

200

HAR uploaded and processing started

{
  "harErrors": []
}

POST request for endpoint /api/deleteMultipleCollections

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

Responses

200

Collections deleted successfully

application/json

Sample description

statusstringOptionalExample: SUCCESS

post/api/deleteMultipleCollections

POST /api/deleteMultipleCollections HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 62

{
  "apiCollections": [
    {
      "id": 1770879436,
      "name": "Old Collection"
    }
  ]
}

200

Collections deleted successfully

{
  "status": "SUCCESS"
}

POST request for endpoint /api/saveCollectionDescription

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

apiCollectionIdintegerOptionalExample: 1770879436

descriptionstringOptionalExample: Main production API collection for e-commerce platform

Responses

200

Description saved successfully

application/json

Sample description

statusstringOptionalExample: SUCCESS

post/api/saveCollectionDescription

POST /api/saveCollectionDescription HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 101

{
  "apiCollectionId": 1770879436,
  "description": "Main production API collection for e-commerce platform"
}

200

Description saved successfully

{
  "status": "SUCCESS"
}

POST request for endpoint /api/loadSensitiveParameters

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

apiCollectionIdinteger · int32OptionalExample: 1684477780

Responses

200

description

application/json

Sample description

post/api/loadSensitiveParameters

POST /api/loadSensitiveParameters HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 30

{
  "apiCollectionId": 1684477780
}

200

description

{
  "data": {
    "endpoints": [
      {
        "isUrlParam": false,
        "method": "POST",
        "maxValue": -9223372036854675000,
        "count": 4,
        "sensitive": true,
        "apiCollectionId": 1684477780,
        "isPrivate": true,
        "url": "/dashboard/testing",
        "responseCode": 200,
        "duration": 0,
        "minValue": 9223372036854675000,
        "lastSeen": 1684477851,
        "publicCount": 0,
        "param": "testingRun#userEmail",
        "subTypeString": "JWT",
        "isHeader": true,
        "domain": "ENUM",
        "subType": {
          "sensitiveAlways": true,
          "name": "JWT",
          "swaggerSchemaClass": "class io.swagger.v3.oas.models.media.EmailSchema",
          "sensitivePosition": [
            "RESPONSE_PAYLOAD"
          ],
          "superType": "CUSTOM"
        },
        "uniqueCount": 0,
        "timestamp": 1684477851
      }
    ]
  }
}

POST request for endpoint /api/loadParamsOfEndpoint

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

methodstringOptionalExample: POST

apiCollectionIdinteger · int32OptionalExample: 1684477780

urlstringOptionalExample: /api/fetchQuickStartPageState

Responses

200

description

application/json

Sample description

post/api/loadParamsOfEndpoint

POST /api/loadParamsOfEndpoint HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 84

{
  "method": "POST",
  "apiCollectionId": 1684477780,
  "url": "/api/fetchQuickStartPageState"
}

200

description

{
  "data": {
    "params": [
      {
        "isUrlParam": false,
        "method": "POST",
        "maxValue": -9223372036854675000,
        "values": {
          "elements": [
            "http://localhost:8080"
          ]
        },
        "count": 5,
        "isPrivate": true,
        "apiCollectionId": 1684477780,
        "sensitive": false,
        "url": "/api/fetchQuickStartPageState",
        "responseCode": 200,
        "duration": 0,
        "minValue": 9223372036854675000,
        "lastSeen": 1684477861,
        "publicCount": 0,
        "param": "date",
        "isHeader": true,
        "subTypeString": "GENERIC",
        "domain": "ENUM",
        "subType": {
          "sensitiveAlways": false,
          "name": "GENERIC",
          "swaggerSchemaClass": "class io.swagger.v3.oas.models.media.StringSchema",
          "sensitivePosition": [
            "RESPONSE_PAYLOAD"
          ],
          "superType": "STRING"
        },
        "timestamp": 1684477861,
        "uniqueCount": 0
      }
    ]
  }
}

POST request for endpoint /api/createCollection

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

collectionNamestringOptional

Collection name. Rules: alphanumeric characters plus hyphen (-), dot (.), underscore (_), and spaces only. Max 60 characters.

Example: Production APIs

Responses

200

Collection created successfully

application/json

Sample description

post/api/createCollection

POST /api/createCollection HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 36

{
  "collectionName": "Production APIs"
}

200

Collection created successfully

{
  "apiCollections": [
    {
      "id": 1770879436,
      "name": "Production APIs"
    }
  ]
}

POST request for endpoint /api/redactCollection

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

apiCollectionIdintegerOptionalExample: 1770879436

redactedbooleanOptional

true to redact (delete sample data), false to un-redact

Example: true

Responses

200

Redaction flag updated. Sample data deletion is async.

application/json

Sample description

statusstringOptionalExample: SUCCESS

post/api/redactCollection

POST /api/redactCollection HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 46

{
  "apiCollectionId": 1770879436,
  "redacted": true
}

200

Redaction flag updated. Sample data deletion is async.

{
  "status": "SUCCESS"
}

POST request for endpoint /api/importDataFromOpenApiSpec

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

apiCollectionIdintegerOptional

Target collection ID. Use 0 or -1 to auto-create

Default: 0Example: 0

openAPIStringstringOptional

Full OpenAPI/Swagger spec as JSON or YAML string

triggeredWithAIAgentbooleanOptional

Set to true if triggered by the Discovery AI Agent

Default: false

skipLiveReplaybooleanOptional

Skip replaying live traffic against imported endpoints

Default: false

Responses

200

Import initiated (async processing)

application/json

Sample description

uploadIdstringOptional

File upload ID to track import progress

Example: 6473a8f1b2c3d4e5f6a7b8c9

post/api/importDataFromOpenApiSpec

POST /api/importDataFromOpenApiSpec HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 96

{
  "apiCollectionId": 0,
  "openAPIString": "text",
  "triggeredWithAIAgent": false,
  "skipLiveReplay": false
}

200

Import initiated (async processing)

{
  "uploadId": "6473a8f1b2c3d4e5f6a7b8c9"
}

POST request for endpoint /api/createCustomCollection

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

collectionNamestringOptionalExample: Admin APIs

conditionsobject[]Optional

List of conditions to match APIs into this collection

Responses

200

Custom collection created

application/json

Sample description

apiCollectionsobject[]Optional

post/api/createCustomCollection

POST /api/createCustomCollection HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 49

{
  "collectionName": "Admin APIs",
  "conditions": [
    {}
  ]
}

200

Custom collection created

{
  "apiCollections": [
    {}
  ]
}

POST request for endpoint /api/deactivateCollections

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

Responses

200

Collections deactivated successfully

application/json

Sample description

statusstringOptionalExample: SUCCESS

post/api/deactivateCollections

POST /api/deactivateCollections HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 57

{
  "apiCollections": [
    {
      "id": 1770879436,
      "deactivated": true
    }
  ]
}

200

Collections deactivated successfully

{
  "status": "SUCCESS"
}

POST request for endpoint /api/importDataFromPostmanFile

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

postmanCollectionFilestringOptionalExample: { "info": { "_postman_id": "c144967f-ca7f-4d01-a2a3-b171512d11e7", "name": "test01", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "_exporter_id": "16638923" }, "item": [ { "name": "req01", "request": { "method": "GET", "header": [], "url": { "raw": "url01?p01=v01&p02&p03", "host": [ "url01" ], "query": [ { "key": "p01", "value": "v01" }, { "key": "p02", "value": null }, { "key": "p03", "value": null } ] } }, "response": [] }, { "name": "re02", "request": { "auth": { "type": "apikey", "apikey": [ { "key": "value", "value": "", "type": "string" }, { "key": "key", "value": "k01", "type": "string" } ] }, "method": "POST", "header": [ { "key": "h01", "value": "", "type": "default" }, { "key": "h02", "value": "", "type": "default" } ], "url": { "raw": "re102?p01&p02&p03&p04", "host": [ "re102" ], "query": [ { "key": "p01", "value": null }, { "key": "p02", "value": null }, { "key": "p03", "value": null }, { "key": "p04", "value": null } ] } }, "response": [] }, { "name": "r03", "request": { "method": "DELETE", "header": [], "url": { "raw": "d01?p01", "host": [ "d01" ], "query": [ { "key": "p01", "value": null } ] } }, "response": [] } ] }

allowReplaybooleanOptionalExample: true

Responses

200

description

application/json

Sample description

postmanCredstringOptionalExample: {}

aktoDashboardStackNamestringOptionalExample: null

configuredItemsstring[]OptionalExample: BURP

aktoDashboardRoleNamestringOptionalExample: null

post/api/importDataFromPostmanFile

POST /api/importDataFromPostmanFile HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2668

{
  "postmanCollectionFile": "{\n\t\"info\": {\n\t\t\"_postman_id\": \"c144967f-ca7f-4d01-a2a3-b171512d11e7\",\n\t\t\"name\": \"test01\",\n\t\t\"schema\": \"https://schema.getpostman.com/json/collection/v2.1.0/collection.json\",\n\t\t\"_exporter_id\": \"16638923\"\n\t},\n\t\"item\": [\n\t\t{\n\t\t\t\"name\": \"req01\",\n\t\t\t\"request\": {\n\t\t\t\t\"method\": \"GET\",\n\t\t\t\t\"header\": [],\n\t\t\t\t\"url\": {\n\t\t\t\t\t\"raw\": \"url01?p01=v01&p02&p03\",\n\t\t\t\t\t\"host\": [\n\t\t\t\t\t\t\"url01\"\n\t\t\t\t\t],\n\t\t\t\t\t\"query\": [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"key\": \"p01\",\n\t\t\t\t\t\t\t\"value\": \"v01\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"key\": \"p02\",\n\t\t\t\t\t\t\t\"value\": null\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"key\": \"p03\",\n\t\t\t\t\t\t\t\"value\": null\n\t\t\t\t\t\t}\n\t\t\t\t\t]\n\t\t\t\t}\n\t\t\t},\n\t\t\t\"response\": []\n\t\t},\n\t\t{\n\t\t\t\"name\": \"re02\",\n\t\t\t\"request\": {\n\t\t\t\t\"auth\": {\n\t\t\t\t\t\"type\": \"apikey\",\n\t\t\t\t\t\"apikey\": [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"key\": \"value\",\n\t\t\t\t\t\t\t\"value\": \"\",\n\t\t\t\t\t\t\t\"type\": \"string\"\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"key\": \"key\",\n\t\t\t\t\t\t\t\"value\": \"k01\",\n\t\t\t\t\t\t\t\"type\": \"string\"\n\t\t\t\t\t\t}\n\t\t\t\t\t]\n\t\t\t\t},\n\t\t\t\t\"method\": \"POST\",\n\t\t\t\t\"header\": [\n\t\t\t\t\t{\n\t\t\t\t\t\t\"key\": \"h01\",\n\t\t\t\t\t\t\"value\": \"\",\n\t\t\t\t\t\t\"type\": \"default\"\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\t\"key\": \"h02\",\n\t\t\t\t\t\t\"value\": \"\",\n\t\t\t\t\t\t\"type\": \"default\"\n\t\t\t\t\t}\n\t\t\t\t],\n\t\t\t\t\"url\": {\n\t\t\t\t\t\"raw\": \"re102?p01&p02&p03&p04\",\n\t\t\t\t\t\"host\": [\n\t\t\t\t\t\t\"re102\"\n\t\t\t\t\t],\n\t\t\t\t\t\"query\": [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"key\": \"p01\",\n\t\t\t\t\t\t\t\"value\": null\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"key\": \"p02\",\n\t\t\t\t\t\t\t\"value\": null\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"key\": \"p03\",\n\t\t\t\t\t\t\t\"value\": null\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"key\": \"p04\",\n\t\t\t\t\t\t\t\"value\": null\n\t\t\t\t\t\t}\n\t\t\t\t\t]\n\t\t\t\t}\n\t\t\t},\n\t\t\t\"response\": []\n\t\t},\n\t\t{\n\t\t\t\"name\": \"r03\",\n\t\t\t\"request\": {\n\t\t\t\t\"method\": \"DELETE\",\n\t\t\t\t\"header\": [],\n\t\t\t\t\"url\": {\n\t\t\t\t\t\"raw\": \"d01?p01\",\n\t\t\t\t\t\"host\": [\n\t\t\t\t\t\t\"d01\"\n\t\t\t\t\t],\n\t\t\t\t\t\"query\": [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"key\": \"p01\",\n\t\t\t\t\t\t\t\"value\": null\n\t\t\t\t\t\t}\n\t\t\t\t\t]\n\t\t\t\t}\n\t\t\t},\n\t\t\t\"response\": []\n\t\t}\n\t]\n}",
  "allowReplay": true
}

200

description

{
  "postmanCred": "{}",
  "aktoDashboardStackName": "null",
  "configuredItems": [
    "BURP"
  ],
  "aktoDashboardRoleName": "null"
}

POST request for endpoint /api/importPostmanWorkspace

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

workspace_idstringOptionalExample: 48dada0a-f1c4-499d-8d4b-0bcbc2ff016f

api_keystringOptionalExample: PMAK-646733223asdasas579bbdd-dca753sdufhgy98erhwui245f12102

allowReplaybooleanOptionalExample: true

Responses

200

description

application/json

Sample description

postmanCredstringOptionalExample: {}

workspacesstringOptionalExample: null

post/api/importPostmanWorkspace

POST /api/importPostmanWorkspace HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 146

{
  "workspace_id": "48dada0a-f1c4-499d-8d4b-0bcbc2ff016f",
  "api_key": "PMAK-646733223asdasas579bbdd-dca753sdufhgy98erhwui245f12102",
  "allowReplay": true
}

200

description

{
  "postmanCred": "{}",
  "workspaces": "null"
}

POST request for endpoint /api/addSensitiveField

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

isUrlParambooleanOptionalExample: false

methodstringOptionalExample: POST

maxValueinteger · int32OptionalExample: 1000000

countinteger · int32OptionalExample: 9

apiCollectionIdinteger · int32OptionalExample: 1684477780

isPrivatebooleanOptionalExample: true

sensitivebooleanOptionalExample: true

urlstringOptionalExample: /api/retrieveAllCollectionTests

responseCodeinteger · int32OptionalExample: -1

durationinteger · int32OptionalExample: 0

minValueinteger · int32OptionalExample: 1000000

lastSeeninteger · int32OptionalExample: 1684477801

publicCountinteger · int32OptionalExample: 0

paramstringOptionalExample: account

isHeaderbooleanOptionalExample: true

subTypeStringstringOptionalExample: INTEGER_32

domainstringOptionalExample: ENUM

timestampinteger · int32OptionalExample: 1684477791

uniqueCountinteger · int32OptionalExample: 0

Responses

200

description

application/json

Sample description

datastringOptionalExample: null

post/api/addSensitiveField

POST /api/addSensitiveField HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 558

{
  "isUrlParam": false,
  "method": "POST",
  "maxValue": 1000000,
  "values": {
    "elements": [
      1000000
    ]
  },
  "count": 9,
  "apiCollectionId": 1684477780,
  "isPrivate": true,
  "sensitive": true,
  "url": "/api/retrieveAllCollectionTests",
  "responseCode": -1,
  "duration": 0,
  "minValue": 1000000,
  "lastSeen": 1684477801,
  "publicCount": 0,
  "param": "account",
  "isHeader": true,
  "subTypeString": "INTEGER_32",
  "domain": "ENUM",
  "subType": {
    "sensitiveAlways": false,
    "name": "INTEGER_32",
    "swaggerSchemaClass": "class io.swagger.v3.oas.models.media.IntegerSchema",
    "superType": "INTEGER"
  },
  "timestamp": 1684477791,
  "uniqueCount": 0
}

200

description

{
  "data": "null"
}

POST request for endpoint /api/saveAktoDataType

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

sensitiveAlwaysbooleanOptionalExample: false

namestringOptionalExample: EMAIL

sensitivePositionstring[]OptionalExample: RESPONSE_PAYLOAD

Responses

200

description

application/json

Sample description

totalSampleDataCountinteger · int32OptionalExample: 0

dataTypesstringOptionalExample: null

currentProcessedinteger · int32OptionalExample: 0

customSubTypeMatchesstringOptionalExample: null

customDataTypestringOptionalExample: null

allDataTypesstringOptionalExample: null

sensitivePositionstring[]OptionalExample: RESPONSE_PAYLOAD

post/api/saveAktoDataType

POST /api/saveAktoDataType HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 81

{
  "sensitiveAlways": false,
  "name": "EMAIL",
  "sensitivePosition": [
    "RESPONSE_PAYLOAD"
  ]
}

200

description

{
  "totalSampleDataCount": 0,
  "dataTypes": "null",
  "currentProcessed": 0,
  "customSubTypeMatches": "null",
  "customDataType": "null",
  "allDataTypes": "null",
  "sensitivePosition": [
    "RESPONSE_PAYLOAD"
  ],
  "aktoDataType": {
    "sensitiveAlways": false,
    "name": "EMAIL",
    "ignoreData": {
      "ignoredKeysInSelectedAPIs": "{}"
    },
    "sensitivePosition": [
      "RESPONSE_PAYLOAD"
    ],
    "timestamp": 1684478117
  }
}

POST request for endpoint /api/addMcpRegistryIntegration

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Responses

200

Registry integrations added. Returns the current configuration.

application/json

post/api/addMcpRegistryIntegration

POST /api/addMcpRegistryIntegration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 100

{
  "registries": [
    {
      "id": "registry-001",
      "name": "My MCP Registry",
      "url": "https://registry.example.com"
    }
  ]
}

200

Registry integrations added. Returns the current configuration.

{
  "mcpRegistryConfig": {
    "registries": [
      {
        "id": "text",
        "name": "text",
        "url": "text"
      }
    ]
  }
}

POST request for endpoint /api/createAgentRun

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

agentstringRequired

Required agent type/name. Must be a valid Agent enum value.

Example: DISCOVERY_AGENT

dataobjectRequired

Agent initialization document with configuration.

Example: {"apiCollectionId":1001,"depth":2}

modelNamestringOptional

Optional AI model name to use. Defaults to AKTO_AGENT_MODEL.

Example: gpt-4o

githubAccessTokenstringOptional

Optional GitHub token for source code agents.

Example: ghp_xxxxxx

Responses

200

Agent run created successfully.

application/json

post/api/createAgentRun

POST /api/createAgentRun HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 123

{
  "agent": "DISCOVERY_AGENT",
  "data": {
    "apiCollectionId": 1001,
    "depth": 2
  },
  "modelName": "gpt-4o",
  "githubAccessToken": "ghp_xxxxxx"
}

200

Agent run created successfully.

{
  "agentRun": {
    "processId": "proc-12345",
    "agent": "DISCOVERY_AGENT",
    "state": "SCHEDULED",
    "createdTs": 1712300000,
    "startedTs": 0
  }
}

POST request for endpoint /api/deleteAgentModel

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

namestringRequired

Model name to delete (must exist).

Example: gpt-4o

Responses

200

Model deleted successfully.

application/json

objectOptional

Empty response body on success.

post/api/deleteAgentModel

POST /api/deleteAgentModel HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 17

{
  "name": "gpt-4o"
}

200

Model deleted successfully.

{}

POST request for endpoint /api/deleteAgentRun

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

processIdstringRequired

Process ID of agent run to delete.

Example: proc-12345

Responses

200

Agent run deleted successfully.

application/json

objectOptional

Empty response body on success.

post/api/deleteAgentRun

POST /api/deleteAgentRun HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 26

{
  "processId": "proc-12345"
}

200

Agent run deleted successfully.

{}

POST request for endpoint /api/feedDataToAgent

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

No request body required.

Responses

200

Returns initialization data or next subprocess task for the agent.

application/json

post/api/feedDataToAgent

POST /api/feedDataToAgent HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

Returns initialization data or next subprocess task for the agent.

{
  "response": {
    "type": "init",
    "data": {
      "apiCollectionId": 1001
    }
  }
}

POST request for endpoint /api/feedDiscoveryDataToAgent

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

processIdstringOptional

Optional discovery agent process ID.

Example: proc-12345

Responses

200

Returns initialization or discovery subprocess task data.

application/json

post/api/feedDiscoveryDataToAgent

POST /api/feedDiscoveryDataToAgent HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 26

{
  "processId": "proc-12345"
}

200

Returns initialization or discovery subprocess task data.

{
  "response": {
    "type": "init",
    "data": {
      "hostname": "api.example.com"
    },
    "apiToken": "token123"
  }
}

POST request for endpoint /api/initiateAIAgentConnectorImport

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

connectorTypestringRequired

Connector type. One of: N8N, LANGCHAIN, COPILOT_STUDIO, SNOWFLAKE, DATABRICKS, VERTEX_AI_CUSTOM_DEPLOYED_MODEL, SALESFORCE.

Example: N8N

dataIngestionUrlstringRequired

Required data ingestion service URL.

Example: https://ingest.example.com

recurringIntervalSecondsintegerOptional

Optional recurring interval in seconds (defaults to 3600).

Example: 3600

n8nUrlstringOptional

Required for N8N connector.

Example: https://n8n.example.com

n8nApiKeystringOptional

Required for N8N connector.

Example: n8n_key_xxxxxxx

langsmithUrlstringOptional

Required for LANGCHAIN connector.

Example: https://api.smith.langchain.com

langsmithApiKeystringOptional

Required for LANGCHAIN connector.

Example: ls_key_xxxxxxx

dataverseEnvironmentUrlstringOptional

Required for COPILOT_STUDIO connector.

Example: https://org.crm.dynamics.com

dataverseTenantIdstringOptional

Required for COPILOT_STUDIO connector.

dataverseClientIdstringOptional

Required for COPILOT_STUDIO connector.

dataverseClientSecretstringOptional

Required for COPILOT_STUDIO connector.

snowflakeAccountUrlstringOptional

Required for SNOWFLAKE connector.

Example: https://xy12345.us-east-1.snowflakecomputing.com

snowflakeAuthTypestringOptional

SNOWFLAKE auth type: PASSWORD, TOKEN, KEYPAIR.

Example: PASSWORD

snowflakeUsernamestringOptional

SNOWFLAKE username.

snowflakePasswordstringOptional

SNOWFLAKE password (for PASSWORD auth).

snowflakeTokenstringOptional

SNOWFLAKE token (for TOKEN auth).

snowflakePrivateKeystringOptional

SNOWFLAKE private key (for KEYPAIR auth).

snowflakePrivateKeyPassphrasestringOptional

SNOWFLAKE private key passphrase (for KEYPAIR auth).

snowflakeWarehousestringOptional

SNOWFLAKE warehouse name.

snowflakeDatabasestringOptional

SNOWFLAKE database name.

snowflakeSchemastringOptional

SNOWFLAKE schema name.

databricksHoststringOptional

Required for DATABRICKS connector.

Example: https://xy12345.cloud.databricks.com

databricksClientIdstringOptional

Required for DATABRICKS connector.

databricksClientSecretstringOptional

Required for DATABRICKS connector.

databricksCatalogstringOptional

DATABRICKS catalog name.

databricksSchemastringOptional

DATABRICKS schema name.

databricksPrefixstringOptional

DATABRICKS table prefix.

vertexAIProjectIdstringOptional

Required for VERTEX_AI_CUSTOM_DEPLOYED_MODEL.

Example: my-gcp-project

vertexAIBigQueryDatasetstringOptional

VERTEX_AI BigQuery dataset.

vertexAIBigQueryTablestringOptional

VERTEX_AI BigQuery table.

vertexAIJsonAuthFilePathstringOptional

Path to VERTEX_AI JSON auth file.

salesforceUrlstringOptional

Required for SALESFORCE connector.

Example: https://my-org.salesforce.com

salesforceConsumerKeystringOptional

Required for SALESFORCE connector.

salesforceConsumerSecretstringOptional

Required for SALESFORCE connector.

ingestionApiKeystringOptional

API key for data ingestion service.

Responses

200

Import job created and scheduled.

application/json

jobIdstringOptional

Created job ID in hex format.

Example: 64b1f2c3a4e5d6f7b8c9d0e1

post/api/initiateAIAgentConnectorImport

POST /api/initiateAIAgentConnectorImport HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 1192

{
  "connectorType": "N8N",
  "dataIngestionUrl": "https://ingest.example.com",
  "recurringIntervalSeconds": 3600,
  "n8nUrl": "https://n8n.example.com",
  "n8nApiKey": "n8n_key_xxxxxxx",
  "langsmithUrl": "https://api.smith.langchain.com",
  "langsmithApiKey": "ls_key_xxxxxxx",
  "dataverseEnvironmentUrl": "https://org.crm.dynamics.com",
  "dataverseTenantId": "text",
  "dataverseClientId": "text",
  "dataverseClientSecret": "text",
  "snowflakeAccountUrl": "https://xy12345.us-east-1.snowflakecomputing.com",
  "snowflakeAuthType": "PASSWORD",
  "snowflakeUsername": "text",
  "snowflakePassword": "text",
  "snowflakeToken": "text",
  "snowflakePrivateKey": "text",
  "snowflakePrivateKeyPassphrase": "text",
  "snowflakeWarehouse": "text",
  "snowflakeDatabase": "text",
  "snowflakeSchema": "text",
  "databricksHost": "https://xy12345.cloud.databricks.com",
  "databricksClientId": "text",
  "databricksClientSecret": "text",
  "databricksCatalog": "text",
  "databricksSchema": "text",
  "databricksPrefix": "text",
  "vertexAIProjectId": "my-gcp-project",
  "vertexAIBigQueryDataset": "text",
  "vertexAIBigQueryTable": "text",
  "vertexAIJsonAuthFilePath": "text",
  "salesforceUrl": "https://my-org.salesforce.com",
  "salesforceConsumerKey": "text",
  "salesforceConsumerSecret": "text",
  "ingestionApiKey": "text"
}

200

Import job created and scheduled.

{
  "jobId": "64b1f2c3a4e5d6f7b8c9d0e1"
}

POST request for endpoint /api/saveAgentModel

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

namestringRequired

Model name (required, must be unique).

Example: gpt-4o

modelstringRequired

Model identifier (e.g., 'gpt-4o', 'claude-3').

Example: gpt-4o

typestringRequired

Model type. One of: OPENAI, AZURE_OPENAI, ANTHROPIC, OLLAMA, DATABRICKS.

Example: OPENAI

apiKeystringOptional

API key (not required for OLLAMA).

Example: sk-xxxxxxx

azureOpenAIEndpointstringOptional

Required for AZURE_OPENAI type.

Example: https://myresource.openai.azure.com

ollamaAIEndpointstringOptional

Required for OLLAMA type.

Example: http://localhost:11434

databricksEndpointstringOptional

Required for DATABRICKS type.

Example: https://mybricks.databricks.com

Responses

200

Model saved successfully.

application/json

objectOptional

Empty response body on success.

post/api/saveAgentModel

POST /api/saveAgentModel HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 231

{
  "name": "gpt-4o",
  "model": "gpt-4o",
  "type": "OPENAI",
  "apiKey": "sk-xxxxxxx",
  "azureOpenAIEndpoint": "https://myresource.openai.azure.com",
  "ollamaAIEndpoint": "http://localhost:11434",
  "databricksEndpoint": "https://mybricks.databricks.com"
}

200

Model saved successfully.

{}

POST request for endpoint /api/updateAgentHealthCheck

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

instanceIdstringRequired

Agent instance ID.

Example: instance-001

versionstringRequired

Agent version.

Example: 1.0.0

processIdstringRequired

Process ID being executed.

Example: proc-12345

Responses

200

Health check status updated.

application/json

objectOptional

Empty response body on success.

post/api/updateAgentHealthCheck

POST /api/updateAgentHealthCheck HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 72

{
  "instanceId": "instance-001",
  "version": "1.0.0",
  "processId": "proc-12345"
}

200

Health check status updated.

{}

POST request for endpoint /api/updateAgentRun

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

processIdstringRequired

Process ID of agent run to update.

Example: proc-12345

statestringRequired

New state for the agent.

Example: RUNNING

Responses

200

Agent run state updated successfully.

application/json

post/api/updateAgentRun

POST /api/updateAgentRun HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 44

{
  "processId": "proc-12345",
  "state": "RUNNING"
}

200

Agent run state updated successfully.

{
  "agentRun": {
    "processId": "proc-12345",
    "state": "RUNNING",
    "startedTs": 1712300100
  }
}

POST request for endpoint /api/updateAgentSubprocess

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

processIdstringRequired

Process ID of agent run.

Example: proc-12345

subProcessIdstringRequired

Sub-process ID.

Example: sub-001

attemptIdintegerRequired

Attempt ID.

Example: 1

statestringRequired

New state. Allowed: ACCEPTED, DISCARDED, RE_ATTEMPT (only if current is COMPLETED).

Example: ACCEPTED

subProcessHeadingstringOptional

Optional subprocess heading to update.

Example: Validate API endpoints

dataobjectOptional

Optional user input data.

Example: {"feedback":"approved"}

agentstringOptional

Agent type (for discovery agent handling).

Example: DISCOVERY_AGENT

Responses

200

Subprocess updated successfully.

application/json

post/api/updateAgentSubprocess

POST /api/updateAgentSubprocess HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 186

{
  "processId": "proc-12345",
  "subProcessId": "sub-001",
  "attemptId": 1,
  "state": "ACCEPTED",
  "subProcessHeading": "Validate API endpoints",
  "data": {
    "feedback": "approved"
  },
  "agent": "DISCOVERY_AGENT"
}

200

Subprocess updated successfully.

{
  "subprocess": {
    "state": "ACCEPTED",
    "subProcessHeading": "Validate API endpoints"
  }
}

POST request for endpoint /api/updateStateOfDiscoveryAgentRun

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

processIdstringRequired

Discovery agent run process ID.

Example: proc-12345

statestringRequired

New state for the discovery agent run.

Example: COMPLETED

resultsobjectOptional

Optional discovery results to store.

Example: {"findings":5,"status":"success"}

Responses

200

Discovery agent run state updated.

application/json

post/api/updateStateOfDiscoveryAgentRun

POST /api/updateStateOfDiscoveryAgentRun HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 90

{
  "processId": "proc-12345",
  "state": "COMPLETED",
  "results": {
    "findings": 5,
    "status": "success"
  }
}

200

Discovery agent run state updated.

{
  "response": {
    "status": "success"
  }
}

POST request for endpoint /api/createSensitiveResponseDataTypes

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

dataTypeKeysstring[]Required

List of data type keys to create as custom data types.

Example: ["ssn","credit_card","email"]

Responses

200

Data types creation scheduled asynchronously.

application/json

objectOptional

Empty response body on success; processing happens asynchronously.

post/api/createSensitiveResponseDataTypes

POST /api/createSensitiveResponseDataTypes HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 46

{
  "dataTypeKeys": [
    "ssn",
    "credit_card",
    "email"
  ]
}

200

Data types creation scheduled asynchronously.

{}

POST request for endpoint /api/createSubProcessNew

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

processIdstringRequired

Discovery agent run process ID.

Example: proc-12345

hostnamestringRequired

Target hostname to discover.

Example: api.example.com

authTokenstringRequired

Authentication token for the hostname.

Example: Bearer token123

Responses

200

Discovery subprocess created.

application/json

post/api/createSubProcessNew

POST /api/createSubProcessNew HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 85

{
  "processId": "proc-12345",
  "hostname": "api.example.com",
  "authToken": "Bearer token123"
}

200

Discovery subprocess created.

{
  "response": {
    "status": "success"
  }
}

POST request for endpoint /api/initiateMCPRecon

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

ipRangestringRequired

Required IP range(s) to perform reconnaissance on. Can be single IP or CIDR notation.

Example: 192.168.1.0/24

Responses

200

MCP reconnaissance initiated.

application/json

objectOptional

Empty response body on success.

post/api/initiateMCPRecon

POST /api/initiateMCPRecon HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 28

{
  "ipRange": "192.168.1.0/24"
}

200

MCP reconnaissance initiated.

{}

POST request for endpoint /api/initiateMCPScan

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

serverUrlstringRequired

Required MCP server URL to scan.

Example: https://mcp-server.example.com

dashboardUrlstringRequired

Dashboard URL for callbacks and result reporting.

Example: https://app.akto.io/dashboard

authKeystringOptional

Optional authentication header key.

Example: Authorization

authValuestringOptional

Optional authentication header value.

Example: Bearer token123

Responses

200

MCP scan initiated. Returns the created or updated API collection.

application/json

apiCollectionIdstringOptional

ID of the created collection.

Example: 1005

post/api/initiateMCPScan

POST /api/initiateMCPScan HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 149

{
  "serverUrl": "https://mcp-server.example.com",
  "dashboardUrl": "https://app.akto.io/dashboard",
  "authKey": "Authorization",
  "authValue": "Bearer token123"
}

200

MCP scan initiated. Returns the created or updated API collection.

{
  "createdCollection": {
    "id": 1005,
    "displayName": "MCP Server",
    "startTs": 1712300000
  },
  "apiCollectionId": "1005"
}

POST request for endpoint /api/saveVulnerabilities

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

agentProcessIdstringRequired

Agent process ID.

Example: proc-12345

totalApisScannedintegerRequired

Total APIs scanned.

Example: 250

Responses

200

Vulnerabilities saved successfully.

application/json

objectOptional

Empty response body on success.

post/api/saveVulnerabilities

POST /api/saveVulnerabilities HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 137

{
  "vulnerabilities": [
    {
      "id": "vuln-001",
      "output": "SQL injection vulnerability found"
    }
  ],
  "agentProcessId": "proc-12345",
  "totalApisScanned": 250
}

200

Vulnerabilities saved successfully.

{}

POST request for endpoint /api/activateCollections

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Responses

200

Collections activated successfully

application/json

objectOptional

post/api/activateCollections

POST /api/activateCollections HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 49

{
  "apiCollections": [
    {
      "_id": 1,
      "name": "Users API"
    }
  ]
}

200

Collections activated successfully

{}

POST request for endpoint /api/deleteApis

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Responses

200

APIs deleted successfully

application/json

deletedCountintegerOptionalExample: 3

post/api/deleteApis

POST /api/deleteApis HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 76

{
  "apiInfoKeys": [
    {
      "url": "/api/users",
      "method": "DELETE",
      "apiCollectionId": 1
    }
  ]
}

200

APIs deleted successfully

{
  "deletedCount": 3
}

POST request for endpoint /api/removeApisFromCustomCollection

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

customCollectionIdintegerOptionalExample: 1

Responses

200

APIs removed successfully

application/json

objectOptional

post/api/removeApisFromCustomCollection

POST /api/removeApisFromCustomCollection HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 96

{
  "customCollectionId": 1,
  "apiInfoKeys": [
    {
      "url": "/api/users",
      "method": "GET",
      "apiCollectionId": 1
    }
  ]
}

200

APIs removed successfully

{}

POST request for endpoint /api/computeCustomCollections

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Responses

200

Custom collections computed successfully

application/json

collectionIdintegerOptionalExample: 5

apiCountintegerOptionalExample: 45

post/api/computeCustomCollections

POST /api/computeCustomCollections HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 67

{
  "conditions": [
    {
      "key": "url",
      "operator": "CONTAINS",
      "value": "/api"
    }
  ]
}

200

Custom collections computed successfully

{
  "collectionId": 5,
  "apiCount": 45
}

POST request for endpoint /api/uploadTcp

post

Header parameters

content-typestringOptionalExample: multipart/form-data

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

filestring · binaryOptional

Responses

200

TCP data uploaded successfully

application/json

uploadIdstringOptionalExample: upload_123

statusstringOptionalExample: PROCESSING

post/api/uploadTcp

POST /api/uploadTcp HTTP/1.1
Content-Type: multipart/form-data
Accept: */*
Content-Length: 17

{
  "file": "binary"
}

200

TCP data uploaded successfully

{
  "uploadId": "upload_123",
  "status": "PROCESSING"
}

POST request for endpoint /api/updateCustomCollection

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

customCollectionIdintegerOptionalExample: 1

namestringOptionalExample: Updated Collection Name

descriptionstringOptionalExample: Updated description

Responses

200

Collection updated successfully

application/json

objectOptional

post/api/updateCustomCollection

POST /api/updateCustomCollection HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 93

{
  "customCollectionId": 1,
  "name": "Updated Collection Name",
  "description": "Updated description"
}

200

Collection updated successfully

{}

POST request for endpoint /api/deleteCollection

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

apiCollectionIdintegerOptionalExample: 1

Responses

200

Collection deleted successfully

application/json

objectOptional

post/api/deleteCollection

POST /api/deleteCollection HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 21

{
  "apiCollectionId": 1
}

200

Collection deleted successfully

{}

POST request for endpoint /api/deleteUntrackedCollections

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

Responses

200

Untracked collections deleted successfully

application/json

deletedCountintegerOptionalExample: 3

post/api/deleteUntrackedCollections

POST /api/deleteUntrackedCollections HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

Untracked collections deleted successfully

{
  "deletedCount": 3
}

POST request for endpoint /api/updateUserCollections

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

userIdstringOptionalExample: user_123

collectionIdsinteger[]OptionalExample: [1,2,3]

Responses

200

User collections updated successfully

application/json

objectOptional

post/api/updateUserCollections

POST /api/updateUserCollections HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 45

{
  "userId": "user_123",
  "collectionIds": [
    1,
    2,
    3
  ]
}

200

User collections updated successfully

{}

POST request for endpoint /api/addApiCollectionNameMapper

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

fromNamestringOptionalExample: old-api-name

toNamestringOptionalExample: new-api-name

apiCollectionIdintegerOptionalExample: 1

Responses

200

Collection name mapper added successfully

application/json

objectOptional

post/api/addApiCollectionNameMapper

POST /api/addApiCollectionNameMapper HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 71

{
  "fromName": "old-api-name",
  "toName": "new-api-name",
  "apiCollectionId": 1
}

200

Collection name mapper added successfully

{}

POST request for endpoint /api/deleteApiCollectionNameMapper

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

mapperIdstringOptionalExample: mapper_123

Responses

200

Collection name mapper deleted successfully

application/json

objectOptional

post/api/deleteApiCollectionNameMapper

POST /api/deleteApiCollectionNameMapper HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 25

{
  "mapperId": "mapper_123"
}

200

Collection name mapper deleted successfully

{}

POST request for endpoint /api/deMergeApi

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Responses

200

API de-merged successfully

application/json

objectOptional

post/api/deMergeApi

POST /api/deMergeApi HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 70

{
  "apiInfoKey": {
    "url": "/api/users",
    "method": "GET",
    "apiCollectionId": 1
  }
}

200

API de-merged successfully

{}

POST request for endpoint /api/bulkDeMergeApis

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Responses

200

APIs de-merged successfully

application/json

deMergedCountintegerOptionalExample: 5

post/api/bulkDeMergeApis

POST /api/bulkDeMergeApis HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 73

{
  "apiInfoKeys": [
    {
      "url": "/api/users",
      "method": "GET",
      "apiCollectionId": 1
    }
  ]
}

200

APIs de-merged successfully

{
  "deMergedCount": 5
}

POST request for endpoint /api/undoDemergedApis

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

deMergeGroupIdstringOptionalExample: demerge_group_123

Responses

200

De-merge undone successfully

application/json

objectOptional

post/api/undoDemergedApis

POST /api/undoDemergedApis HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 38

{
  "deMergeGroupId": "demerge_group_123"
}

200

De-merge undone successfully

{}

POST request for endpoint /api/editCollectionName

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

apiCollectionIdintegerOptionalExample: 1

newNamestringOptionalExample: New Collection Name

Responses

200

Collection name updated successfully

application/json

objectOptional

post/api/editCollectionName

POST /api/editCollectionName HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 53

{
  "apiCollectionId": 1,
  "newName": "New Collection Name"
}

200

Collection name updated successfully

{}

POST request for endpoint /api/deleteApisBasedOnHeader

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

headerKeystringOptionalExample: X-Custom-Header

headerValuestringOptionalExample: deprecated

Responses

200

APIs deleted based on header successfully

application/json

deletedCountintegerOptionalExample: 10

post/api/deleteApisBasedOnHeader

POST /api/deleteApisBasedOnHeader HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 58

{
  "headerKey": "X-Custom-Header",
  "headerValue": "deprecated"
}

200

APIs deleted based on header successfully

{
  "deletedCount": 10
}

POST request for endpoint /api/syncExtractedAPIs

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

analysisIdstringOptionalExample: analysis_123

apiCollectionIdintegerOptionalExample: 1

Responses

200

Extracted APIs synced successfully

application/json

syncedCountintegerOptionalExample: 15

post/api/syncExtractedAPIs

POST /api/syncExtractedAPIs HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 49

{
  "analysisId": "analysis_123",
  "apiCollectionId": 1
}

200

Extracted APIs synced successfully

{
  "syncedCount": 15
}

Data Types & Auth Types

#	API	Description
1	POST /api/convertSampleDataToCurl	Converts sample Agentic Request/Agentic Response data into a cURL command for easy reproduction.
2	POST /api/resetSampleData	Resets sample data for a specific Agentic component back to its default state.
3	POST /api/saveCustomDataType	Saves or updates a custom data type configuration with its matching patterns.
4	POST /api/resetDataType	Resets a custom data type to its original default configuration.
5	POST /api/reviewCustomDataType	Submits a custom data type for review and validation.
6	POST /api/resetDataTypeRetro	Retroactively resets and reprocesses data type configurations against historical data.
7	POST /api/toggleDataTypeActiveParam	Toggles the active parameter flag for a specific data type.
8	POST /api/addCustomAuthType	Adds a new custom authentication type with its header or parameter patterns.
9	POST /api/updateCustomAuthType	Updates an existing custom authentication type configuration.
10	POST /api/resetAllCustomAuthTypes	Resets all custom authentication types to their default configurations.
11	POST /api/updateCustomAuthTypeStatus	Updates the active/inactive status of a custom authentication type.
12	POST /api/bulkMarkSensitive	Bulk upsert sensitivity flags for a list of parameters to mark or unmark them as sensitive (PII).
13	POST /api/fillSensitiveDataTypes	Trigger a server-side asynchronous refresh of PII and sensitive data type definitions.

POST request for endpoint /api/convertSampleDataToCurl

post

Body

sampleDatastringRequired

Raw HTTP request/response sample string in Akto's Kafka message format

Example: {"method":"POST","requestPayload":"{\"email\":\"[e-mail]\"}","responsePayload":"{\"token\":\"[REDACTED_TOKEN]\"}","ip":"192.0.2.10","time":1766398064,"akto_account_id":"1000000","statusCode":200,"type":"HTTP/1.1","status":"OK","path":"/api/auth/login","requestHeaders":"{\"content-type\":\"application/json\"}","responseHeaders":"{\"content-type\":\"application/json\"}"}

Responses

200

curl command generated successfully

application/json

curlStringstringOptional

The equivalent curl command for the provided sample data

Example: curl -X POST 'https://api.example.com/api/auth/login' -H 'content-type: application/json' -d '{"email":"[e-mail]"}'

403

Forbidden — caller lacks SAMPLE_DATA / READ permission

422

Unprocessable — sample data string could not be parsed

application/json

post/api/convertSampleDataToCurl

POST /api/convertSampleDataToCurl HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 472

{
  "sampleData": "{\"method\":\"POST\",\"requestPayload\":\"{\\\"email\\\":\\\"[e-mail]\\\"}\",\"responsePayload\":\"{\\\"token\\\":\\\"[REDACTED_TOKEN]\\\"}\",\"ip\":\"192.0.2.10\",\"time\":1766398064,\"akto_account_id\":\"1000000\",\"statusCode\":200,\"type\":\"HTTP/1.1\",\"status\":\"OK\",\"path\":\"/api/auth/login\",\"requestHeaders\":\"{\\\"content-type\\\":\\\"application/json\\\"}\",\"responseHeaders\":\"{\\\"content-type\\\":\\\"application/json\\\"}\"}"
}

{
  "curlString": "curl -X POST 'https://api.example.com/api/auth/login' -H 'content-type: application/json' -d '{\"email\":\"[e-mail]\"}'"
}

POST request for endpoint /api/resetSampleData

post

Body

objectOptional

Responses

200

Sample data redaction completed successfully

application/json

objectOptional

403

Forbidden — caller lacks SENSITIVE_DATA / READ_WRITE permission

post/api/resetSampleData

POST /api/resetSampleData HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{}

POST request for endpoint /api/saveCustomDataType

post

Body

namestringRequired

Data type name. Uppercase letters, digits, spaces, and underscores only. Max 25 characters. Must be unique when createNew=true.

Example: API_KEY

createNewbooleanRequired

true to insert a new data type, false to update the existing one with this name

Example: true

sensitiveAlwaysbooleanOptional

If true, any parameter matching this type is always considered sensitive regardless of position

Example: true

operatorstring · enumRequired

Top-level operator combining key and value conditions. Valid values: AND, OR.

Example: ORPossible values:

keyOperatorstring · enumOptional

Operator for combining key predicates. Valid values: AND, OR. Required if keyConditionFromUsers is provided.

Example: ORPossible values:

valueOperatorstring · enumOptional

Operator for combining value predicates. Valid values: AND, OR. Required if valueConditionFromUsers is provided.

Example: ORPossible values:

redactedbooleanOptional

If true, existing sample data matching this type will be redacted asynchronously

Example: false

activebooleanOptional

Whether the data type is active and should be applied during traffic analysis

Example: true

skipDataTypeTestTemplateMappingbooleanOptional

If true, skips automatic creation of test templates for this data type

Example: false

categoriesListstring[]Optional

Categories to assign to this data type (e.g., PII, AUTHENTICATION, TOKEN)

Example: ["AUTHENTICATION","TOKEN"]

dataTypePrioritystring · enumOptional

Severity/priority level for this data type

Example: HIGHPossible values:

iconStringstringOptional

Optional icon identifier string for UI display

Example: key

Responses

200

Custom data type saved successfully

application/json

403

Forbidden — caller lacks SENSITIVE_DATA / READ_WRITE permission

422

Unprocessable — validation error (duplicate name, invalid conditions, reserved name, etc.)

application/json

post/api/saveCustomDataType

POST /api/saveCustomDataType HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 508

{
  "name": "API_KEY",
  "createNew": true,
  "sensitiveAlways": true,
  "sensitivePosition": [
    "RESPONSE_PAYLOAD",
    "RESPONSE_HEADER"
  ],
  "operator": "OR",
  "keyOperator": "OR",
  "keyConditionFromUsers": [
    {
      "type": "REGEX",
      "valueMap": {
        "value": ".*api[-_]?key.*"
      }
    }
  ],
  "valueOperator": "OR",
  "valueConditionFromUsers": [
    {
      "type": "REGEX",
      "valueMap": {
        "value": "^[A-Za-z0-9_\\-]{20,60}$"
      }
    }
  ],
  "redacted": false,
  "active": true,
  "skipDataTypeTestTemplateMapping": false,
  "categoriesList": [
    "AUTHENTICATION",
    "TOKEN"
  ],
  "dataTypePriority": "HIGH",
  "iconString": "key"
}

{
  "customDataType": {
    "_id": "6a4c1b3dde8f92780c91637f",
    "name": "API_KEY",
    "active": true,
    "sensitiveAlways": true,
    "sensitivePosition": [
      "RESPONSE_PAYLOAD",
      "RESPONSE_HEADER"
    ],
    "operator": "OR",
    "keyConditions": {
      "operator": "OR",
      "predicates": [
        {
          "type": "REGEX",
          "value": ".*api[-_]?key.*"
        }
      ]
    },
    "redacted": false,
    "categoriesList": [
      "AUTHENTICATION",
      "TOKEN"
    ],
    "dataTypePriority": "HIGH",
    "timestamp": 1766398064,
    "creatorId": 1000000
  }
}

POST request for endpoint /api/resetDataType

post

Body

namestringRequired

Name of the custom or Akto built-in data type to clean up

Example: API_KEY

Responses

200

Data type reset completed successfully

application/json

objectOptional

403

Forbidden — caller lacks SENSITIVE_DATA / READ_WRITE permission

post/api/resetDataType

POST /api/resetDataType HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 18

{
  "name": "API_KEY"
}

{}

POST request for endpoint /api/reviewCustomDataType

post

Body

namestringRequired

Proposed data type name (used only for validation; not saved)

Example: API_KEY

sensitiveAlwaysbooleanOptionalExample: true

sensitivePositionstring[]OptionalExample: ["RESPONSE_PAYLOAD"]

operatorstring · enumRequiredExample: ORPossible values:

keyOperatorstring · enumOptionalExample: ORPossible values:

valueOperatorstring · enumOptionalExample: ORPossible values:

redactedbooleanOptionalExample: false

pageNumintegerRequired

1-based page number. Each page scans 1000 sample data records.

Example: 1

Responses

200

Review scan completed for the requested page

application/json

totalSampleDataCountintegerOptional

Estimated total number of sample data documents in the collection

Example: 5302

currentProcessedintegerOptional

Number of sample data records processed in this page

Example: 1000

403

Forbidden — caller lacks SENSITIVE_DATA / READ permission

422

Unprocessable — invalid data type definition (bad operator, empty conditions, etc.)

application/json

post/api/reviewCustomDataType

POST /api/reviewCustomDataType HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 342

{
  "name": "API_KEY",
  "sensitiveAlways": true,
  "sensitivePosition": [
    "RESPONSE_PAYLOAD"
  ],
  "operator": "OR",
  "keyOperator": "OR",
  "keyConditionFromUsers": [
    {
      "type": "REGEX",
      "valueMap": {
        "value": ".*api[-_]?key.*"
      }
    }
  ],
  "valueOperator": "OR",
  "valueConditionFromUsers": [
    {
      "type": "REGEX",
      "valueMap": {
        "value": "^[A-Za-z0-9_\\-]{20,60}$"
      }
    }
  ],
  "redacted": false,
  "pageNum": 1
}

{
  "customSubTypeMatches": [
    {
      "apiCollectionId": 1748293710,
      "url": "https://api.example.com/api/auth/token",
      "method": "POST",
      "key": "api_key",
      "value": "[REDACTED_MATCHED_VALUE]"
    }
  ],
  "totalSampleDataCount": 5302,
  "currentProcessed": 1000
}

POST request for endpoint /api/resetDataTypeRetro

post

Body

namestringRequired

Name of the custom or Akto built-in data type to retroactively reprocess

Example: API_KEY

Responses

200

Retroactive reprocessing job submitted successfully (runs asynchronously)

application/json

objectOptional

403

Forbidden — caller lacks SENSITIVE_DATA / READ_WRITE permission

422

Unprocessable — data type with given name not found

application/json

post/api/resetDataTypeRetro

POST /api/resetDataTypeRetro HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 18

{
  "name": "API_KEY"
}

{}

POST request for endpoint /api/toggleDataTypeActiveParam

post

Body

namestringRequired

Name of the custom data type to activate or deactivate

Example: API_KEY

activebooleanRequired

true to activate the data type, false to deactivate it

Example: false

Responses

200

Data type active status updated successfully

application/json

403

Forbidden — caller lacks SENSITIVE_DATA / READ_WRITE permission

422

Unprocessable — data type not found

application/json

post/api/toggleDataTypeActiveParam

POST /api/toggleDataTypeActiveParam HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 33

{
  "name": "API_KEY",
  "active": false
}

{
  "customDataType": {
    "_id": "6a4c1b3dde8f92780c91637f",
    "name": "API_KEY",
    "active": false,
    "sensitiveAlways": true,
    "redacted": false,
    "timestamp": 1766398064
  }
}

POST request for endpoint /api/addCustomAuthType

post

Body

namestringRequired

Unique name for the custom auth type

Example: X-Service-Token

headerKeysstring[]Optional

HTTP header names that carry authentication tokens for this auth type

Example: ["x-service-token","x-internal-auth"]

payloadKeysstring[]Optional

JSON payload keys that carry authentication tokens for this auth type

Example: ["serviceToken","internalAuth"]

Responses

200

Custom auth type created successfully; returns updated list of all auth types

application/json

403

Forbidden — caller lacks AUTH_TYPE / READ_WRITE permission

422

Unprocessable — auth type name already exists

application/json

post/api/addCustomAuthType

POST /api/addCustomAuthType HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 123

{
  "name": "X-Service-Token",
  "headerKeys": [
    "x-service-token",
    "x-internal-auth"
  ],
  "payloadKeys": [
    "serviceToken",
    "internalAuth"
  ]
}

{
  "customAuthType": {
    "_id": "7b5d2e4ffe9a38791da2748a",
    "name": "X-Service-Token",
    "headerKeys": [
      "x-service-token",
      "x-internal-auth"
    ],
    "payloadKeys": [
      "serviceToken",
      "internalAuth"
    ],
    "active": true,
    "creatorId": 1000000,
    "timestamp": 1766398064
  },
  "customAuthTypes": [
    {
      "_id": "7b5d2e4ffe9a38791da2748a",
      "name": "X-Service-Token",
      "active": true,
      "creatorId": 1000000
    }
  ],
  "usersMap": {
    "1000000": "[e-mail]"
  }
}

POST request for endpoint /api/updateCustomAuthType

post

Body

namestringRequired

Name of the existing custom auth type to update

Example: X-Service-Token

headerKeysstring[]Optional

Replacement list of header key names

Example: ["x-service-token","x-internal-auth","x-platform-key"]

payloadKeysstring[]Optional

Replacement list of payload key names

Example: ["serviceToken"]

activebooleanOptional

Whether this auth type should remain active after the update

Example: true

Responses

200

Custom auth type updated successfully

application/json

customAuthTypesobject[]Optional

All custom auth types after the update

403

Forbidden — caller lacks AUTH_TYPE / READ_WRITE permission

422

Unprocessable — custom auth type with given name not found

application/json

post/api/updateCustomAuthType

POST /api/updateCustomAuthType HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 139

{
  "name": "X-Service-Token",
  "headerKeys": [
    "x-service-token",
    "x-internal-auth",
    "x-platform-key"
  ],
  "payloadKeys": [
    "serviceToken"
  ],
  "active": true
}

{
  "customAuthType": {
    "_id": "7b5d2e4ffe9a38791da2748a",
    "name": "X-Service-Token",
    "headerKeys": [
      "x-service-token",
      "x-internal-auth",
      "x-platform-key"
    ],
    "payloadKeys": [
      "serviceToken"
    ],
    "active": true,
    "timestamp": 1766398064
  },
  "customAuthTypes": [
    {}
  ],
  "usersMap": {
    "1000000": "[e-mail]"
  }
}

POST request for endpoint /api/resetAllCustomAuthTypes

post

Body

objectOptional

Responses

200

All custom auth types reset and reprocessing scheduled

application/json

objectOptional

403

Forbidden — caller lacks AUTH_TYPE / READ_WRITE permission

422

Unprocessable — unexpected error during reset

application/json

post/api/resetAllCustomAuthTypes

POST /api/resetAllCustomAuthTypes HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{}

POST request for endpoint /api/updateCustomAuthTypeStatus

post

Body

namestringRequired

Name of the custom auth type to enable or disable

Example: X-Service-Token

activebooleanRequired

true to enable the auth type, false to disable it

Example: false

Responses

200

Custom auth type status updated successfully

application/json

customAuthTypesobject[]Optional

All custom auth types after the status update

403

Forbidden — caller lacks AUTH_TYPE / READ_WRITE permission

422

Unprocessable — custom auth type not found

application/json

post/api/updateCustomAuthTypeStatus

POST /api/updateCustomAuthTypeStatus HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 41

{
  "name": "X-Service-Token",
  "active": false
}

{
  "customAuthType": {
    "_id": "7b5d2e4ffe9a38791da2748a",
    "name": "X-Service-Token",
    "active": false,
    "timestamp": 1766398064
  },
  "customAuthTypes": [
    {}
  ],
  "usersMap": {
    "1000000": "[e-mail]"
  }
}

POST request for endpoint /api/bulkMarkSensitive

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

sensitivebooleanRequiredExample: true

Responses

200

Bulk update completed

application/json

post/api/bulkMarkSensitive

POST /api/bulkMarkSensitive HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 322

{
  "sensitive": true,
  "items": [
    {
      "url": "https://api.example.com/api/users/profile",
      "method": "GET",
      "responseCode": 200,
      "isHeader": false,
      "param": "ssn",
      "apiCollectionId": 1111111
    },
    {
      "url": "https://api.example.com/api/users/profile",
      "method": "GET",
      "responseCode": 200,
      "isHeader": false,
      "param": "dateOfBirth",
      "apiCollectionId": 1111111
    }
  ]
}

200

Bulk update completed

{
  "ret": {
    "updates": 1,
    "inserts": 1
  }
}

POST request for endpoint /api/fillSensitiveDataTypes

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

Responses

200

PII source refresh triggered successfully

application/json

objectOptional

post/api/fillSensitiveDataTypes

POST /api/fillSensitiveDataTypes HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

PII source refresh triggered successfully

{}