Fetch Data

API

Description

POST /api/fetchAuthMechanismData

Retrieve authentication mechanism details configured for scanning.

POST /api/fetchTestRoles

Fetch probe roles and their configurations for scanning.

POST /api/fetchTestingRunResults

Fetch the results of executed scan runs, including issues found and their severity.

POST /api/fetchActiveTestRunsStatus

Retrieve the current status of active or in-progress scan runs.

POST /api/retrieveAllCollectionTests

Retrieve all available probes mapped to each Agentic Collection.

POST /api/fetchFilters

Fetch available filters for organizing and querying scan results.

POST /api/fetchSearchTestResults

Search and retrieve scan results based on specified criteria.

POST /api/fetchTestingSources

Retrieve configured scanning sources and integrations.

POST /api/fetchWorkflowTests

Get workflow-based security scan definitions and configurations.

POST /api/fetchTestingRunResultSummary

Fetches a single scanning run result summary by its hex ID.

POST /api/fetchAuthMechanismDataDoc

Fetches the raw authentication mechanism document for the current account.

POST /api/fetchAllTestSuites

Fetches both custom and default (built-in) probe suites available in the account.

POST /api/fetchTestSuites

Fetches all available probe suite enum types for onboarding flows.

POST /api/fetchVulnerableRequests

Fetches a paginated list of vulnerable HTTP requests from demo data, used for probe template previews.

POST /api/fetchTestingRunResultFromTestingRun

Fetches the first scanning run result associated with a given scanning run hex ID.

POST /api/fetchUsageTestRuns

Checks whether the current account has any user-created scan runs (excluding onboarding demo runs).

POST /api/fetchTestingLogs

Fetches scanning engine logs within a specified time range.

POST /api/getBUACategoryCount

Counts the number of unique Agentic Components affected by issues matching the given filter criteria.

POST /api/getNotTestedAPICount

Counts Agentic Components that have never been scanned, optionally filtered by collection.

POST /api/getOnlyOnceTestedAPICount

Counts Agentic Components that have been scanned exactly one time, optionally filtered by collection.

POST /api/fetchTestedApisRanges

Returns the count of scanned Agentic Components grouped by week (year_weekOfYear) for trend analysis.

POST /api/getMisConfiguredTestsCount

Counts scan results that require additional configuration (REQUIRES_CONFIG flag).

POST /api/fetchTestingRunsRanges

Returns completed scan run counts grouped by week (year_weekOfYear) for trend analysis.

POST /api/getLastCalculatedInfo

Fetches metadata about the last cron/background job execution for the current account.

POST /api/fetchTestingData

Returns consolidated scanning coverage statistics (scanned vs non-scanned Agentic Component counts) within a time range.

POST /api/fetchMiniTestingServiceNames

Returns the names of active mini-scanning service modules with recent heartbeats.

POST /api/fetchDefaultPayload

Fetches the default payload configuration for a specific domain.

POST /api/fetchAllDefaultPayloads

Fetches all default payload configurations saved for the current account.

POST /api/fetchGlobalVars

Fetches saved global host variable mappings and known hosts for the specified collections.

POST /api/fetchTestCollectionConfiguration

Fetches scan configuration properties (headers, cookies, auth requirements, etc.) for a specific Agentic Collection.

POST /api/fetchPropertyIds

Fetches all available scan collection property types with their metadata.

POST /api/buildDependencyTable

Builds a paginated dependency flow table with Agentic Component nodes, parameters, and replacement details.

POST /api/fetchWorkflowResult

Fetches the latest scanning run and result for a workflow scan.

POST /api/fetchWorkflowTestingRun

Fetches all scheduled scanning runs for a workflow scan.

POST /api/downloadWorkflowAsJson

Downloads a workflow scan as a JSON file string for export.

POST /api/exportWorkflowTestAsString

Serializes a workflow scan to a JSON string for export or clipboard copy.

POST /api/fetchCustomTestsCount

Fetches the count of custom YAML probe templates grouped by repository URL.

POST /api/fetchCommonTestTemplate

Fetches a common reusable probe template by its identifier.

POST /api/fetchTestContent

Fetches the YAML content of a probe template for editing in the Agentic Playground.

POST /api/fetchTestingRunPlaygroundStatus

Fetches the execution status of a scan run triggered from the Agentic Playground.

POST /api/fetchCallbackStatusForTestEditor

Fetches the callback/async result status for a scan run initiated from the Agentic Playground.

POST /api/fetchOtpData/{uuid}

Fetches OTP data associated with a specific UUID, used in login flow authentication setup.

POST /api/fetchScript

Returns the most recently stored scan script for a given script type (PRE_TEST, PRE_REQUEST, POST_REQUEST, POST_TEST).

POST /api/fetchAccessMatrixTaskInfos

Fetch all Access Matrix task configurations for scheduled role-based access testing.

POST /api/fetchAccessMatrixUrlToRoles

Fetch all URL-to-role mappings and an inverted role-to-URLs map for the access matrix.

POST /api/analyzeApiSamples

Analyze live traffic samples to extract distinct header values for discovering role/tenant identifiers to configure access matrix roles.

POST request for endpoint /api/fetchAuthMechanismData

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

collectionIdintegerOptionalExample: 1770879436

Responses

200

Authentication mechanism details retrieved

application/json

Sample description

authMechanismsobject[]Optional

post/api/fetchAuthMechanismData

POST /api/fetchAuthMechanismData HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 27

{
  "collectionId": 1770879436
}

200

Authentication mechanism details retrieved

{
  "authMechanisms": [
    {}
  ]
}

POST request for endpoint /api/fetchTestRoles

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

Sample description

Responses

200

Test roles retrieved

application/json

Sample description

testRolesobject[]Optional

post/api/fetchTestRoles

POST /api/fetchTestRoles HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

Test roles retrieved

{
  "testRoles": [
    {}
  ]
}

POST request for endpoint /api/fetchTestingRunResults

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

testingRunResultSummaryHexIdstringOptionalExample: 6464783058e3a17b14ddf64e

Responses

200

description

application/json

Sample description

metadatastringOptionalExample: null

testingRunResultSummariesstringOptionalExample: null

runIssuesstringOptionalExample: null

selectedTestsstringOptionalExample: null

maxConcurrentRequestsinteger · int32OptionalExample: 0

testingRunsstringOptionalExample: null

recurringDailybooleanOptionalExample: false

workflowTeststringOptionalExample: null

authMechanismstringOptionalExample: null

testingRunResultstringOptionalExample: null

fetchCicdbooleanOptionalExample: false

testingRunstringOptionalExample: null

testRunTimeinteger · int32OptionalExample: 0

testingRunHexIdstringOptionalExample: null

endTimestampinteger · int32OptionalExample: 0

startTimestampinteger · int32OptionalExample: 0

testNamestringOptionalExample: null

post/api/fetchTestingRunResults

POST /api/fetchTestingRunResults HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 59

{
  "testingRunResultSummaryHexId": "6464783058e3a17b14ddf64e"
}

200

description

{
  "metadata": "null",
  "testingRunResults": [
    {
      "testResults": "null",
      "testRunResultSummaryId": {
        "date": "2023-05-17T12:16:08",
        "timestamp": 1684305968
      },
      "testRunId": {
        "date": "2023-05-17T12:14:33",
        "timestamp": 1684305873
      },
      "singleTypeInfos": "null",
      "vulnerable": true,
      "testSubType": "CHANGE_METHOD_TO_GET",
      "testSuperType": "BFLA",
      "apiInfoKey": {
        "method": "POST",
        "apiCollectionId": 1679459648,
        "url": "https://juiceshop.akto.io/rest/basket/6"
      },
      "id": {
        "date": "2023-05-17T12:16:13",
        "timestamp": 1684305973
      },
      "confidencePercentage": 100,
      "endTimestamp": 1684305972,
      "startTimestamp": 1684305972,
      "hexId": "6464783658e3a17b14ddfa47"
    }
  ],
  "testingRunResultSummaries": "null",
  "runIssues": "null",
  "selectedTests": "null",
  "maxConcurrentRequests": 0,
  "testingRuns": "null",
  "recurringDaily": false,
  "workflowTest": "null",
  "authMechanism": "null",
  "testingRunResult": "null",
  "fetchCicd": false,
  "testingRun": "null",
  "testRunTime": 0,
  "testingRunHexId": "null",
  "endTimestamp": 0,
  "startTimestamp": 0,
  "testName": "null"
}

POST request for endpoint /api/fetchActiveTestRunsStatus

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

Sample description

Responses

200

description

application/json

Sample description

post/api/fetchActiveTestRunsStatus

POST /api/fetchActiveTestRunsStatus HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

description

{
  "activeTestRuns": [
    {
      "hexId": "null",
      "state": "RUNNING",
      "name": "null"
    }
  ]
}

POST request for endpoint /api/retrieveAllCollectionTests

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

fetchCicdbooleanOptionalExample: false

Responses

200

description

application/json

Sample description

metadatastringOptionalExample: null

testingRunResultsstringOptionalExample: null

testingRunResultSummariesstringOptionalExample: null

runIssuesstringOptionalExample: null

selectedTestsstringOptionalExample: null

maxConcurrentRequestsinteger · int32OptionalExample: 0

recurringDailybooleanOptionalExample: false

workflowTeststringOptionalExample: null

testingRunResultstringOptionalExample: null

fetchCicdbooleanOptionalExample: false

testingRunstringOptionalExample: null

testRunTimeinteger · int32OptionalExample: 0

testingRunHexIdstringOptionalExample: null

endTimestampinteger · int32OptionalExample: 1684564190

startTimestampinteger · int32OptionalExample: 1684477790

testNamestringOptionalExample: null

post/api/retrieveAllCollectionTests

POST /api/retrieveAllCollectionTests HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 19

{
  "fetchCicd": false
}

200

description

{
  "metadata": "null",
  "testingRunResults": "null",
  "testingRunResultSummaries": "null",
  "runIssues": "null",
  "selectedTests": "null",
  "maxConcurrentRequests": 0,
  "recurringDaily": false,
  "workflowTest": "null",
  "authMechanism": {
    "authParams": [
      {
        "showHeader": true,
        "where": "HEADER",
        "value": "text",
        "key": "access-token"
      }
    ],
    "id": {
      "date": "2023-03-22T12:11:33",
      "timestamp": 1679467293
    },
    "type": "HARDCODED",
    "uuid": "83c47038-0770-4f7c-946c-539b5927a97f"
  },
  "testingRunResult": "null",
  "fetchCicd": false,
  "testingRun": "null",
  "testRunTime": 0,
  "testingRunHexId": "null",
  "endTimestamp": 1684564190,
  "startTimestamp": 1684477790,
  "testName": "null"
}

POST request for endpoint /api/fetchFilters

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

Sample description

Responses

200

description

application/json

Sample description

post/api/fetchFilters

POST /api/fetchFilters HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

description

{
  "runtimeFilters": [
    {
      "useCase": "DETERMINE_API_ACCESS_TYPE",
      "customFilterList": [
        {
          "endValue": 299,
          "startValue": 200
        }
      ],
      "name": "Open Endpoints",
      "id": 1679459648,
      "customFiltersOperator": "AND",
      "customFieldName": "access_type"
    }
  ]
}

POST request for endpoint /api/fetchSearchTestResults

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

searchTextstringOptional

Responses

200

description

application/json

Sample description

severitystringOptionalExample: null

searchTextstringOptional

descriptionstringOptionalExample: null

defaultCreatorbooleanOptionalExample: false

testSourceConfigsstringOptionalExample: null

categorystringOptionalExample: null

subcategorystringOptionalExample: null

urlstringOptionalExample: null

tagsstringOptionalExample: null

post/api/fetchSearchTestResults

POST /api/fetchSearchTestResults HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 17

{
  "searchText": ""
}

200

description

{
  "severity": "null",
  "searchText": "",
  "description": "null",
  "defaultCreator": false,
  "inbuiltTests": [
    {
      "issueTags": [
        "Business logic"
      ],
      "issueImpact": "text",
      "superCategory": {
        "severity": {
          "_name": "HIGH"
        },
        "displayName": "Broken Object Level Authorization (BOLA)",
        "name": "SSRF",
        "shortName": "Broken Function Level Authorization"
      },
      "references": "null",
      "_name": "ADD_PUT_METHOD_OVERRIDE_HEADERS",
      "name": "ADD_PUT_METHOD_OVERRIDE_HEADERS",
      "issueDetails": "\"The endpoint appears to be vulnerable to Server Side Request Forgery attack. The original request was replayed by replacing CSV upload parameter with url that redirects to AWS IMDS endpoint. The application responded with 2XX success code and also gave out sensitive AWS information in response. Server-Side Request Forgery (SSRF) flaws occur whenever an API is fetching a remote resource without validating the user-supplied URL. It allows an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall or a VPN.\\n \"Modern concepts in application development make SSRF more common and more dangerous.\\n\" \"More common - the following concepts encourage developers to access an external resource based on user input: Webhooks, file fetching from URLs, custom SSO, and URL previews.\\n\" \"More dangerous - Modern technologies like cloud providers, Kubernetes, and Docker expose management and control channels over HTTP on predictable, well-known paths. Those channels are an easy target for an SSRF attack.\\n\" \"It is also more challenging to limit outbound traffic from your application, because of the connected nature of modern applications.\\n\" + \"The SSRF risk can not always be completely eliminated. While choosing a protection mechanism, it is important to consider the business risks and needs.\"\n",
      "issueDescription": "Quite often, APIs do not impose any restrictions on the size or number of resources that can be requested by the user.",
      "testName": "BFLA by HTTP DELETE method overriding"
    }
  ],
  "categories": [
    {
      "severity": {
        "_name": "HIGH"
      },
      "_name": "SSRF",
      "displayName": "Improper Assets Management (IAM)",
      "name": "SSRF",
      "shortName": "Broken Function Level Authorization"
    }
  ],
  "testSourceConfigs": "null",
  "category": "null",
  "subcategory": "null",
  "searchResults": [
    {
      "severity": {
        "_name": "HIGH"
      },
      "creator": "default",
      "addedEpoch": 1679402464,
      "description": "",
      "stars": 0,
      "id": "https://github.com/akto-api-security/tests-library/blob/master/Misconfiguration/configs/appspec-yml-disclosure.yaml",
      "category": {
        "severity": {
          "_name": "HIGH"
        },
        "_name": "INJ",
        "displayName": "Broken Object Level Authorization (BOLA)",
        "name": "INJ",
        "shortName": "Injection"
      },
      "subcategory": "redirect",
      "installs": 0,
      "tags": "null"
    }
  ],
  "url": "null",
  "tags": "null"
}

POST request for endpoint /api/fetchTestingSources

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

Sample description

defaultCreatorbooleanOptionalExample: true

subcategorystringOptionalExample: BFLA

Responses

200

description

application/json

Sample description

severitystringOptionalExample: null

searchTextstringOptionalExample: null

defaultCreatorbooleanOptionalExample: true

descriptionstringOptionalExample: null

categoriesstringOptionalExample: null

inbuiltTestsstringOptionalExample: null

categorystringOptionalExample: null

subcategorystringOptionalExample: BFLA

urlstringOptionalExample: null

tagsstringOptionalExample: null

post/api/fetchTestingSources

POST /api/fetchTestingSources HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 44

{
  "defaultCreator": true,
  "subcategory": "BFLA"
}

200

description

{
  "severity": "null",
  "searchText": "null",
  "defaultCreator": true,
  "description": "null",
  "categories": "null",
  "inbuiltTests": "null",
  "category": "null",
  "subcategory": "BFLA",
  "url": "null",
  "tags": "null"
}

POST request for endpoint /api/fetchWorkflowTests

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

Sample description

Responses

200

description

application/json

Sample description

strstringOptionalExample: null

nodesstringOptionalExample: null

workflowTestJsonstringOptionalExample: null

logFetchEndTimeinteger · int32OptionalExample: 0

edgesstringOptionalExample: null

mapNodeIdToWorkflowNodeDetailsstringOptionalExample: null

apiCollectionIdinteger · int32OptionalExample: 0

idinteger · int32OptionalExample: 0

statestringOptionalExample: null

testingLogsstringOptionalExample: null

logFetchStartTimeinteger · int32OptionalExample: 0

post/api/fetchWorkflowTests

POST /api/fetchWorkflowTests HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

description

{
  "str": "null",
  "nodes": "null",
  "workflowTestJson": "null",
  "logFetchEndTime": 0,
  "edges": "null",
  "mapNodeIdToWorkflowNodeDetails": "null",
  "apiCollectionId": 0,
  "id": 0,
  "state": "null",
  "testingLogs": "null",
  "logFetchStartTime": 0
}

POST request for endpoint /api/fetchTestingRunResultSummary

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

testingRunResultSummaryHexIdstringRequired

Hex-encoded ObjectId of the testing run result summary.

Example: 64b1f2c3a4e5d6f7b8c9d0e1

Responses

200

Returns the matching testing run result summary.

application/json

post/api/fetchTestingRunResultSummary

POST /api/fetchTestingRunResultSummary HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 59

{
  "testingRunResultSummaryHexId": "64b1f2c3a4e5d6f7b8c9d0e1"
}

200

Returns the matching testing run result summary.

{
  "testingRunResultSummaries": [
    {
      "id": "64b1f2c3a4e5d6f7b8c9d0e1",
      "testingRunId": "64a0e1b2c3d4e5f6a7b8c9d0",
      "state": "COMPLETED",
      "countIssuesByType": {
        "HIGH": 3,
        "MEDIUM": 5
      },
      "startTimestamp": 1712300000,
      "endTimestamp": 1712303600
    }
  ]
}

POST request for endpoint /api/fetchAuthMechanismDataDoc

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

No request body required.

Responses

200

Returns the current auth mechanism document.

application/json

post/api/fetchAuthMechanismDataDoc

POST /api/fetchAuthMechanismDataDoc HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

Returns the current auth mechanism document.

{
  "authMechanismDoc": {
    "_id": "64b1f2c3a4e5d6f7b8c9d0e1",
    "type": "HARDCODED",
    "authParamData": [
      {}
    ],
    "requestData": [
      {}
    ]
  }
}

POST request for endpoint /api/fetchAllTestSuites

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

No request body required.

Responses

200

Returns custom and default test suites.

application/json

post/api/fetchAllTestSuites

POST /api/fetchAllTestSuites HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

Returns custom and default test suites.

{
  "testSuiteList": [
    {
      "id": "64b1f2c3a4e5d6f7b8c9d0e1",
      "name": "My OWASP Suite",
      "subCategoryList": [
        "BOLA",
        "SQLi"
      ]
    }
  ],
  "defaultTestSuites": [
    {
      "name": "OWASP Top 10",
      "subCategoryList": [
        "text"
      ]
    }
  ]
}

POST request for endpoint /api/fetchTestSuites

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

No request body required.

Responses

200

Returns the available test suite types.

application/json

testSuitesstring[]Optional

Array of TestSuite enum values.

Example: ["OWASP_TOP_10","SANS_TOP_25","CUSTOM"]

post/api/fetchTestSuites

POST /api/fetchTestSuites HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

Returns the available test suite types.

{
  "testSuites": [
    "OWASP_TOP_10",
    "SANS_TOP_25",
    "CUSTOM"
  ]
}

POST request for endpoint /api/fetchVulnerableRequests

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

skipintegerOptional

Number of records to skip for pagination.

Example: 0

limitintegerOptional

Maximum number of records to return.

Example: 20

Responses

200

Returns paginated vulnerable requests.

application/json

post/api/fetchVulnerableRequests

POST /api/fetchVulnerableRequests HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 21

{
  "skip": 0,
  "limit": 20
}

200

Returns paginated vulnerable requests.

{
  "vulnerableRequests": [
    {
      "id": "64b1f2c3a4e5d6f7b8c9d0e1",
      "url": "/api/users/1",
      "method": "GET",
      "category": "BOLA"
    }
  ]
}

POST request for endpoint /api/fetchTestingRunResultFromTestingRun

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

testingRunHexIdstringRequired

Hex-encoded ObjectId of the testing run.

Example: 64a0e1b2c3d4e5f6a7b8c9d0

Responses

200

Returns the first test result for the specified run.

application/json

post/api/fetchTestingRunResultFromTestingRun

POST /api/fetchTestingRunResultFromTestingRun HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 46

{
  "testingRunHexId": "64a0e1b2c3d4e5f6a7b8c9d0"
}

200

Returns the first test result for the specified run.

{
  "testingRunResult": {
    "id": "64b1f2c3a4e5d6f7b8c9d0e1",
    "testingRunId": "64a0e1b2c3d4e5f6a7b8c9d0",
    "vulnerable": true,
    "testSubType": "BOLA",
    "apiInfoKey": {},
    "attempts": [
      {}
    ]
  }
}

POST request for endpoint /api/fetchUsageTestRuns

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

No request body required.

Responses

200

Returns whether user-created test runs exist.

application/json

testRunsByUserbooleanOptional

True if the account has at least one user-created test run.

Example: true

post/api/fetchUsageTestRuns

POST /api/fetchUsageTestRuns HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

Returns whether user-created test runs exist.

{
  "testRunsByUser": true
}

POST request for endpoint /api/fetchTestingLogs

post

Body

testIdstringOptionalExample: test-abc123

Responses

200

Testing logs retrieved

No content

post/api/fetchTestingLogs

POST /api/fetchTestingLogs HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 24

{
  "testId": "test-abc123"
}

200

Testing logs retrieved

No content

POST request for endpoint /api/getBUACategoryCount

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

showApiInfobooleanOptional

If true, returns full ApiInfo objects alongside the count.

Example: false

filterCollectionsIdinteger[]OptionalExample: [1001,1002]

severitystring[]OptionalExample: ["HIGH","CRITICAL"]

issueStatusstring[]OptionalExample: ["OPEN"]

subcategorystring[]OptionalExample: ["BOLA"]

startTimestampintegerOptionalExample: 1712000000

endTimestampintegerOptionalExample: 1712999999

Responses

200

Returns count of affected APIs.

application/json

buaCategoryCountintegerOptional

Number of unique APIs with matching issues.

Example: 14

buaCategoryApiInfoobject[]Optional

ApiInfo details (only present when showApiInfo=true).

post/api/getBUACategoryCount

POST /api/getBUACategoryCount HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 186

{
  "showApiInfo": false,
  "filterCollectionsId": [
    1001,
    1002
  ],
  "severity": [
    "HIGH",
    "CRITICAL"
  ],
  "issueStatus": [
    "OPEN"
  ],
  "subcategory": [
    "BOLA"
  ],
  "startTimestamp": 1712000000,
  "endTimestamp": 1712999999
}

200

Returns count of affected APIs.

{
  "buaCategoryCount": 14,
  "buaCategoryApiInfo": [
    {}
  ]
}

POST request for endpoint /api/getNotTestedAPICount

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

showApiInfobooleanOptionalExample: false

apiCollectionIdsinteger[]OptionalExample: [1001]

Responses

200

Returns count of untested APIs.

application/json

notTestedEndpointsCountintegerOptional

Number of APIs with no testing history.

Example: 42

notTestedEndpointsApiInfoobject[]Optional

ApiInfo details (only present when showApiInfo=true).

post/api/getNotTestedAPICount

POST /api/getNotTestedAPICount HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 47

{
  "showApiInfo": false,
  "apiCollectionIds": [
    1001
  ]
}

200

Returns count of untested APIs.

{
  "notTestedEndpointsCount": 42,
  "notTestedEndpointsApiInfo": [
    {}
  ]
}

POST request for endpoint /api/getOnlyOnceTestedAPICount

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

showApiInfobooleanOptionalExample: false

apiCollectionIdsinteger[]OptionalExample: [1001]

Responses

200

Returns count of once-tested APIs.

application/json

onlyOnceTestedEndpointsCountintegerOptional

Number of APIs tested exactly once.

Example: 18

onlyOnceTestedEndpointsApiInfoobject[]Optional

ApiInfo details (only present when showApiInfo=true).

post/api/getOnlyOnceTestedAPICount

POST /api/getOnlyOnceTestedAPICount HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 47

{
  "showApiInfo": false,
  "apiCollectionIds": [
    1001
  ]
}

200

Returns count of once-tested APIs.

{
  "onlyOnceTestedEndpointsCount": 18,
  "onlyOnceTestedEndpointsApiInfo": [
    {}
  ]
}

POST request for endpoint /api/fetchTestedApisRanges

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

apiCollectionIdsinteger[]OptionalExample: [1001,1002]

Responses

200

Returns per-week tested API counts.

application/json

post/api/fetchTestedApisRanges

POST /api/fetchTestedApisRanges HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 32

{
  "apiCollectionIds": [
    1001,
    1002
  ]
}

200

Returns per-week tested API counts.

{
  "response": {
    "2024_15": 12,
    "2024_16": 20
  }
}

POST request for endpoint /api/getMisConfiguredTestsCount

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

showApiInfobooleanOptionalExample: false

Responses

200

Returns count of misconfigured tests.

application/json

misConfiguredTestsCountintegerOptional

Number of test results requiring configuration.

Example: 5

misConfiguredTestsApiInfoobject[]Optional

ApiInfo details (only present when showApiInfo=true).

post/api/getMisConfiguredTestsCount

POST /api/getMisConfiguredTestsCount HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 21

{
  "showApiInfo": false
}

200

Returns count of misconfigured tests.

{
  "misConfiguredTestsCount": 5,
  "misConfiguredTestsApiInfo": [
    {}
  ]
}

POST request for endpoint /api/fetchTestingRunsRanges

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

apiCollectionIdsinteger[]OptionalExample: [1001,1002]

Responses

200

Returns per-week test run counts.

application/json

post/api/fetchTestingRunsRanges

POST /api/fetchTestingRunsRanges HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 32

{
  "apiCollectionIds": [
    1001,
    1002
  ]
}

200

Returns per-week test run counts.

{
  "allTestsCountsRanges": {
    "2024_15": 3,
    "2024_16": 7
  }
}

POST request for endpoint /api/getLastCalculatedInfo

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

No request body required.

Responses

200

Returns last cron run information.

application/json

post/api/getLastCalculatedInfo

POST /api/getLastCalculatedInfo HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

Returns last cron run information.

{
  "timerInfo": {
    "lastCalculatedTs": 1712300000,
    "status": "COMPLETED"
  }
}

POST request for endpoint /api/fetchTestingData

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

startTimestampinteger · int64Required

Start of the time range as Unix epoch seconds.

Example: 1712000000

endTimestampinteger · int64Optional

End of the time range as Unix epoch seconds. Defaults to now if omitted.

Example: 1712999999

Responses

200

Returns testing coverage statistics.

application/json

post/api/fetchTestingData

POST /api/fetchTestingData HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 55

{
  "startTimestamp": 1712000000,
  "endTimestamp": 1712999999
}

200

Returns testing coverage statistics.

{
  "response": {
    "testedVsNonTested": {
      "tested": 85,
      "nonTested": 42
    }
  }
}

POST request for endpoint /api/fetchDefaultPayload

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

domainstringRequired

Domain name to fetch the default payload for.

Example: example.com

Responses

200

Returns the default payload configuration for the domain.

application/json

post/api/fetchDefaultPayload

POST /api/fetchDefaultPayload HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 24

{
  "domain": "example.com"
}

200

Returns the default payload configuration for the domain.

{
  "defaultPayload": {
    "domain": "example.com",
    "pattern": "{\"key\":\"value\"}",
    "creator": "alice@example.com",
    "createdTs": 1712300000,
    "updatedTs": 1712300000
  }
}

POST request for endpoint /api/fetchAllDefaultPayloads

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

No request body required.

Responses

200

Returns all default payloads for the account.

application/json

post/api/fetchAllDefaultPayloads

POST /api/fetchAllDefaultPayloads HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

Returns all default payloads for the account.

{
  "domains": [
    {
      "domain": "example.com",
      "pattern": "{\"key\":\"value\"}",
      "creator": "alice@example.com"
    }
  ]
}

POST request for endpoint /api/fetchGlobalVars

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

apiCollectionIdsinteger[]Required

Collection IDs whose hosts should be included in the response.

Example: [1001,1002]

Responses

200

Returns current host mappings and collection hosts.

application/json

post/api/fetchGlobalVars

POST /api/fetchGlobalVars HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 32

{
  "apiCollectionIds": [
    1001,
    1002
  ]
}

200

Returns current host mappings and collection hosts.

{
  "modifyHostDetails": [
    {
      "currentHost": "api.internal.example.com",
      "newHost": "api.staging.example.com"
    }
  ]
}

POST request for endpoint /api/fetchTestCollectionConfiguration

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

apiCollectionIdintegerRequired

ID of the API collection to fetch configuration for.

Example: 1001

Responses

200

Returns the test collection configuration properties.

application/json

post/api/fetchTestCollectionConfiguration

POST /api/fetchTestCollectionConfiguration HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 24

{
  "apiCollectionId": 1001
}

200

Returns the test collection configuration properties.

{
  "testCollectionProperties": [
    {
      "propertyId": "REQUIRES_AUTH",
      "value": "true"
    }
  ]
}

POST request for endpoint /api/fetchPropertyIds

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

No request body required.

Responses

200

Returns all property type definitions.

application/json

post/api/fetchPropertyIds

POST /api/fetchPropertyIds HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

Returns all property type definitions.

{
  "propertyIds": {
    "ANY_ADDITIONAL_PROPERTY": {
      "id": "REQUIRES_AUTH",
      "title": "Requires Authentication",
      "type": "BOOLEAN",
      "impactingCategories": [
        "BOLA",
        "AUTH_BYPASS"
      ]
    }
  }
}

POST request for endpoint /api/buildDependencyTable

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

apiCollectionIdsinteger[]Required

Collection IDs to build the dependency table for.

Example: [1001,1002]

skipintegerOptional

Number of records to skip for pagination.

Example: 0

Responses

200

Returns the dependency table with nodes, parameters, and replacement details.

application/json

dependencyTableListobject[]Optional

Paginated list of dependency nodes with parameter data.

replaceDetailsobject[]Optional

Replacement detail configurations for the collections.

totalintegerOptional

Total number of dependency nodes.

Example: 150

post/api/buildDependencyTable

POST /api/buildDependencyTable HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 41

{
  "apiCollectionIds": [
    1001,
    1002
  ],
  "skip": 0
}

200

Returns the dependency table with nodes, parameters, and replacement details.

{
  "dependencyTableList": [
    {}
  ],
  "replaceDetails": [
    {}
  ],
  "total": 150
}

POST request for endpoint /api/fetchWorkflowResult

post

Body

workflowTestIdintegerRequiredExample: 1766398064

Responses

200

Workflow result retrieved (workflowTestingRun and workflowTestResult may be null if no run exists yet)

application/json

403

Forbidden

422

Unprocessable

post/api/fetchWorkflowResult

POST /api/fetchWorkflowResult HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 29

{
  "workflowTestId": 1766398064
}

{
  "workflowTestingRun": {
    "id": "6a4c1b3dde8f92780c91637f",
    "state": "COMPLETED",
    "scheduleTimestamp": 1766398064
  },
  "workflowTestResult": {
    "testRunId": "6a4c1b3dde8f92780c91637f",
    "nodeResultMap": {}
  }
}

POST request for endpoint /api/fetchWorkflowTestingRun

post

Body

workflowTestIdintegerRequiredExample: 1766398064

Responses

200

Scheduled testing runs retrieved

application/json

403

Forbidden

422

Unprocessable

post/api/fetchWorkflowTestingRun

POST /api/fetchWorkflowTestingRun HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 29

{
  "workflowTestId": 1766398064
}

{
  "testingRuns": [
    {
      "id": "6a4c1b3dde8f92780c91637f",
      "state": "SCHEDULED",
      "scheduleTimestamp": 1766484064
    }
  ]
}

POST request for endpoint /api/downloadWorkflowAsJson

post

Body

idintegerRequiredExample: 1766398064

Responses

200

Workflow JSON ready for download

application/json

workflowTestJsonstringOptional

Gson-serialized JSON string of the full WorkflowTest object

Example: {"id":1766398064,"apiCollectionId":1748293710,"nodes":["node-1","node-2"],"edges":["edge-1-2"],"state":"PUBLISHED"}

403

Forbidden

422

Unprocessable — workflow test not found

application/json

post/api/downloadWorkflowAsJson

POST /api/downloadWorkflowAsJson HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 17

{
  "id": 1766398064
}

{
  "workflowTestJson": "{\"id\":1766398064,\"apiCollectionId\":1748293710,\"nodes\":[\"node-1\",\"node-2\"],\"edges\":[\"edge-1-2\"],\"state\":\"PUBLISHED\"}"
}

POST request for endpoint /api/exportWorkflowTestAsString

post

Body

idintegerRequiredExample: 1766398064

Responses

200

Workflow test serialized

application/json

strstringOptional

Full JSON serialization of the WorkflowTest object

Example:

{"id":1766398064,"apiCollectionId":1748293710,"author":"admin@example.com","nodes":["node-1"],"edges":[],"state":"PUBLISHED"}

403

Forbidden

422

Unprocessable — workflow test not found or serialization error

post/api/exportWorkflowTestAsString

POST /api/exportWorkflowTestAsString HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 17

{
  "id": 1766398064
}

{
  "str": "{\"id\":1766398064,\"apiCollectionId\":1748293710,\"author\":\"admin@example.com\",\"nodes\":[\"node-1\"],\"edges\":[],\"state\":\"PUBLISHED\"}"
}

POST request for endpoint /api/fetchCustomTestsCount

post

Body

objectOptional

Responses

200

Template counts retrieved

application/json

403

Forbidden

post/api/fetchCustomTestsCount

POST /api/fetchCustomTestsCount HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{
  "testCountMap": {
    "https://github.com/example-org/custom-akto-tests": 12,
    "https://github.com/example-org/pentest-templates": 5
  }
}

POST request for endpoint /api/fetchCommonTestTemplate

post

Body

objectOptional

Responses

200

Common test template retrieved (content is empty string if not set)

application/json

contentstringOptional

YAML content of the common template

Example: wordLists: userIds: - "1" - "2" - "3" adminEndpoints: - /admin - /internal

403

Forbidden

post/api/fetchCommonTestTemplate

POST /api/fetchCommonTestTemplate HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{
  "content": "wordLists:\n  userIds:\n    - \"1\"\n    - \"2\"\n    - \"3\"\n  adminEndpoints:\n    - /admin\n    - /internal"
}

POST request for endpoint /api/fetchTestContent

post

Body

originalTestIdstringRequired

Test template ID to fetch

Example: BOLA_TEST_CUSTOM

Responses

200

Test content retrieved

application/json

contentstringOptional

YAML content of the test template

Example: id: BOLA_TEST_CUSTOM info: name: Custom BOLA Test severity: HIGH ...

403

Forbidden

422

Unprocessable — test ID empty or template not found

application/json

post/api/fetchTestContent

POST /api/fetchTestContent HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 37

{
  "originalTestId": "BOLA_TEST_CUSTOM"
}

{
  "content": "id: BOLA_TEST_CUSTOM\ninfo:\n  name: Custom BOLA Test\n  severity: HIGH\n..."
}

POST request for endpoint /api/fetchTestingRunPlaygroundStatus

post

Body

testingRunPlaygroundHexIdstringRequired

Hex ID returned by runTestForGivenTemplate

Example: 7b5d2e4ffe9a38791da2748a

Responses

200

Playground status retrieved

application/json

testingRunPlaygroundStatusstring · enumOptional

Current state of the playground run

Example: COMPLETEDPossible values:

callbackUuidsstring[]Optional

testingRunIssuesobjectOptional

subCategoryMapobjectOptional

422

Unprocessable — hex ID empty, invalid, or playground not found

application/json

post/api/fetchTestingRunPlaygroundStatus

POST /api/fetchTestingRunPlaygroundStatus HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 56

{
  "testingRunPlaygroundHexId": "7b5d2e4ffe9a38791da2748a"
}

{
  "testingRunPlaygroundStatus": "COMPLETED",
  "testingRunResult": {
    "vulnerable": false,
    "testResults": [
      {}
    ]
  },
  "callbackUuids": [
    "text"
  ],
  "testingRunIssues": {},
  "subCategoryMap": {}
}

POST request for endpoint /api/fetchCallbackStatusForTestEditor

post

Body

callbackUuidsstring[]Required

List of callback UUIDs from the test result to check

Example: ["cb-uuid-abc123","cb-uuid-def456"]

Responses

200

Callback status checked

application/json

callbackHitbooleanOptional

true if at least one callback URL was hit by the target server

Example: false

403

Forbidden

422

Unprocessable — callbackUuids empty

application/json

post/api/fetchCallbackStatusForTestEditor

POST /api/fetchCallbackStatusForTestEditor HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 53

{
  "callbackUuids": [
    "cb-uuid-abc123",
    "cb-uuid-def456"
  ]
}

{
  "callbackHit": false
}

POST request for endpoint /api/fetchOtpData/{uuid}

post

Path parameters

uuidstringRequired

UUID identifying the OTP test data slot

Example: a1b2c3d4-e5f6-7890-abcd-ef1234567890

Body

objectOptional

Responses

200

OTP text retrieved

application/json

otpTextstringOptional

The OTP text received within the last 5 minutes for this UUID

Example: 482917

403

Forbidden

422

Unprocessable — UUID null or OTP not received within 5 minutes

application/json

post/api/fetchOtpData/{uuid}

POST /api/fetchOtpData/{uuid} HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{
  "otpText": "482917"
}

POST request for endpoint /api/fetchAccessMatrixTaskInfos

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

Responses

200

Access matrix task list returned

application/json

post/api/fetchAccessMatrixTaskInfos

POST /api/fetchAccessMatrixTaskInfos HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

Access matrix task list returned

{
  "accessMatrixTaskInfos": [
    {
      "hexId": "64a1f2e3b5c7d8e9f0a1b2c3",
      "endpointLogicalGroupName": "ADMIN_GROUP",
      "frequencyInSeconds": 86400,
      "lastCompletedTimestamp": 1675123200,
      "nextScheduledTimestamp": 1675209600
    },
    {
      "hexId": "64a1f2e3b5c7d8e9f0a1b2d7",
      "endpointLogicalGroupName": "READ_ONLY_GROUP",
      "frequencyInSeconds": 86400,
      "lastCompletedTimestamp": 1675036800,
      "nextScheduledTimestamp": 1675209600
    }
  ]
}

POST request for endpoint /api/fetchAccessMatrixUrlToRoles

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

objectOptional

Responses

200

URL-to-role and role-to-URLs mappings returned

application/json

post/api/fetchAccessMatrixUrlToRoles

POST /api/fetchAccessMatrixUrlToRoles HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

URL-to-role and role-to-URLs mappings returned

{
  "accessMatrixUrlToRoles": [
    {
      "id": {
        "url": "https://api.example.com/api/admin/users",
        "method": "DELETE",
        "apiCollectionId": 1111111
      },
      "roles": [
        "ADMIN",
        "SUPER_ADMIN"
      ]
    }
  ],
  "accessMatrixRoleToUrls": {
    "ADMIN": [
      {
        "url": "https://api.example.com/api/admin/users",
        "method": "DELETE",
        "apiCollectionId": 1111111
      }
    ],
    "READ_ONLY": [
      {
        "url": "https://api.example.com/api/users/profile",
        "method": "GET",
        "apiCollectionId": 1111111
      }
    ]
  }
}

POST request for endpoint /api/analyzeApiSamples

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

apiCollectionIdsinteger[]Required

Collection IDs whose traffic samples to analyze. Must not be empty.

Example: [1111111,2222222]

headerNamesstring[]Required

Request header names to extract and count. Must not be empty.

Example: ["x-role","x-tenant-id"]

Responses

200

Header value frequency map returned

application/json

400

Validation error — empty apiCollectionIds or headerNames

application/json

post/api/analyzeApiSamples

POST /api/analyzeApiSamples HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 77

{
  "apiCollectionIds": [
    1111111,
    2222222
  ],
  "headerNames": [
    "x-role",
    "x-tenant-id"
  ]
}

{
  "headerValues": {
    "x-role": {
      "ADMIN": 412,
      "READ_ONLY": 1893,
      "BILLING": 204
    },
    "x-tenant-id": {
      "tenant-a": 954,
      "tenant-b": 1555
    }
  }
}

PreviousAI Red Teaming NextModify Data

Last updated 2 months ago