Modify Data

#	API	Description
1	POST /api/startTest	Start a new scan run on the selected agentic collections or agentic components.
2	POST /api/stopTest	Stop an ongoing scan run before it completes.
3	POST /api/addTestRoles	Add probe roles for red teaming execution.
4	POST /api/stopAllTests	Stop all ongoing scan runs.
5	POST /api/updateTestRoles	Update probe role configurations.
6	POST /api/modifyTestingRunConfig	Modifies an existing scanning run configuration including probe suites, subcategories, schedule, concurrency, alerts, role, and auto-ticketing settings.
7	POST /api/addAuthMechanism	Adds a new authentication mechanism (hardcoded token, login flow, sample data, or TLS) for Agentic Component scanning.
8	POST /api/triggerLoginSteps	Executes login flow steps and returns step-by-step responses. Used to validate login sequences before saving an auth mechanism.
9	POST /api/createTestSuite	Creates a new custom probe suite with a given name and list of probe subcategories.
10	POST /api/modifyTestSuite	Updates an existing custom probe suite's name and/or subcategories.
11	POST /api/deleteTestSuite	Deletes a custom probe suite by its hex ID.
12	POST /api/bulkUpdateTestResultsSeverity	Bulk-updates the severity level of selected scan results across all related collections.
13	POST /api/deleteTestRuns	Deletes the specified scan runs and schedules a background job to clean up associated results and summaries.
14	POST /api/deleteTestRunsFromSummaries	Deletes scan data (results and summaries) identified by scanning run result summary IDs via a background job.
15	POST /api/changeStatus	Changes the active/inactive status of a custom webhook and updates its associated scheduled job.
16	POST /api/runOnce	Triggers an immediate one-time asynchronous execution of a custom webhook.
17	POST /api/runTestOnboarding	Runs the onboarding probe suite against a specified collection with provided auth credentials.
18	POST /api/saveDefaultPayload	Saves or updates a default payload pattern for a domain, recording the creator and timestamps.
19	POST /api/saveReplaceDetails	Saves key-value replacement pairs for a specific Agentic component, used in dependency flow scanning.
20	POST /api/saveGlobalVars	Saves global host variable mappings for dependency flow scanning.
21	POST /api/invokeDependencyTable	Asynchronously invokes the dependency graph build job for the specified collections.
22	POST /api/createWorkflowTest	Creates a new workflow scan with a node/edge graph and associated node details.
23	POST /api/editWorkflowTest	Updates the nodes, edges, and node details of an existing workflow scan.
24	POST /api/setWorkflowTestState	Changes the state of a workflow scan (e.g. DRAFT → PUBLISHED → INACTIVE).
25	POST /api/editWorkflowNodeDetails	Updates the details of a single node within a workflow scan.
26	POST /api/deleteScheduledWorkflowTests	Stops all scheduled or running scanning runs for a given workflow scan.
27	POST /api/uploadWorkflowJson	Imports a workflow scan from a JSON string, creating a new workflow scan with a fresh ID.
28	POST /api/addTestLibrary	Adds a custom GitHub probe library to the account and clones YAML probe templates from it immediately.
29	POST /api/removeTestLibrary	Removes a custom probe library and deletes all CUSTOM-sourced templates loaded from it.
30	POST /api/syncCustomLibrary	Re-syncs YAML templates from a previously added custom probe library repository.
31	POST /api/syncAllDefaultTestLibraries	Triggers an async sync of all default Akto probe libraries from GitHub for the current account.
32	POST /api/saveTestEditorFile	Saves a custom YAML probe template file from the Agentic Playground.
33	POST /api/saveCommonTestTemplate	Saves or updates a common reusable probe template.
34	POST /api/runTestForGivenTemplate	Runs a probe for a given YAML template against a specified Agentic component from the Agentic Playground.
35	POST /api/saveTestRoleMeta	Saves metadata and configuration for a scan role.
36	POST /api/deleteTestRole	Deletes a scan role by ID.
37	POST /api/deleteAuthFromRole	Removes an authentication configuration from a scan role.
38	POST /api/updateAuthInRole	Updates an existing authentication configuration within a scan role.
39	POST /api/addAuthToRole	Adds a new authentication configuration to a scan role.
40	POST /api/triggerSingleLoginFlow	Triggers a single login flow step and returns the response, used to validate auth sequences.
41	POST /api/addScript	Inserts a new JavaScript scan script for a specified script type (PRE_TEST, PRE_REQUEST, POST_REQUEST, POST_TEST).
42	POST /api/updateScript	Replaces the JavaScript content of an existing scan script identified by its ID.
43	POST /api/updateAccessMatrixTask	Update the role name and frequency for an existing Access Matrix task.
44	POST /api/createMultipleAccessMatrixTasks	Create or upsert an Access Matrix task for a given role with default schedule settings (24h frequency).
45	POST /api/deleteAccessMatrix	Delete all access matrix data for a given role, including task info and URL-to-role mappings.
46	POST /api/deleteAccessMatrixTask	Delete a single Access Matrix task by its hex ID.

POST request for endpoint /api/stopTest

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

Sample description

testingRunHexIdstringOptionalExample: 6464783658e3a17b14ddfa67

Responses

200

description

application/json

Sample description

statusstringOptionalExample: SUCCESS

post/api/stopTest

HTTPcURLJavaScriptPython

POST /api/stopTest HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 46

{
  "testingRunHexId": "6464783658e3a17b14ddfa67"
}

200

description

{
  "status": "SUCCESS"
}

POST request for endpoint /api/startTest

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

Sample description

apiCollectionIdsinteger · int32[]Optional

testNamestringOptionalExample: null

testTypestringOptionalExample: null

recurringDailybooleanOptionalExample: false

startTimestampinteger · int32OptionalExample: 0

overriddenTestAppUrlstringOptionalExample: null

Responses

200

description

application/json

Sample description

testingRunHexIdstringOptionalExample: 6464783658e3a17b14ddfa67

post/api/startTest

HTTPcURLJavaScriptPython

POST /api/startTest HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 132

{
  "apiCollectionIds": [
    1
  ],
  "testName": "null",
  "testType": "null",
  "recurringDaily": false,
  "startTimestamp": 0,
  "overriddenTestAppUrl": "null"
}

200

description

{
  "testingRunHexId": "6464783658e3a17b14ddfa67"
}

POST request for endpoint /api/addTestRoles

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

Sample description

roleNamestringOptionalExample: GUEST

Responses

200

description

application/json

Sample description

testRolesstringOptionalExample: null

roleNamestringOptionalExample: GUEST

andConditionsstringOptionalExample: null

post/api/addTestRoles

HTTPcURLJavaScriptPython

POST /api/addTestRoles HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 108

{
  "roleName": "GUEST",
  "orConditions": {
    "predicates": [
      {
        "type": "CONTAINS",
        "value": "api/user/"
      }
    ],
    "operator": "OR"
  }
}

200

description

{
  "testRoles": "null",
  "roleName": "GUEST",
  "andConditions": "null",
  "selectedRole": {
    "createdBy": "[e-mail]",
    "authMechanism": "null",
    "name": "GUEST",
    "lastUpdatedTs": 1684477847,
    "id": {
      "date": "2023-05-19T12:00:47",
      "timestamp": 1684477847
    },
    "endpointLogicalGroupId": {
      "date": "2023-05-19T12:00:47",
      "timestamp": 1684477847
    },
    "createdTs": 1684477847,
    "endpointLogicalGroup": {
      "groupName": "GUEST_endpoint-logical-group",
      "createdBy": "[e-mail]",
      "testingEndpoints": {
        "andConditions": "null",
        "type": "LOGICAL_GROUP",
        "orConditions": {
          "predicates": [
            {
              "type": "CONTAINS",
              "value": "api/user/"
            }
          ],
          "operator": "OR"
        }
      },
      "id": {
        "date": "2023-05-19T12:00:47",
        "timestamp": 1684477847
      },
      "updatedTs": 1684477847,
      "createdTs": 1684477847
    }
  },
  "orConditions": {
    "predicates": [
      {
        "type": "CONTAINS",
        "value": "api/user/"
      }
    ],
    "operator": "OR"
  }
}

POST request for endpoint /api/stopAllTests

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

objectOptional

Sample description

Responses

200

description

application/json

Sample description

metadatastringOptionalExample: null

testingRunResultsstringOptionalExample: null

testingRunResultSummariesstringOptionalExample: null

runIssuesstringOptionalExample: null

selectedTestsstringOptionalExample: null

maxConcurrentRequestsinteger · int32OptionalExample: 0

recurringDailybooleanOptionalExample: false

workflowTeststringOptionalExample: null

authMechanismstringOptionalExample: null

testingRunResultstringOptionalExample: null

fetchCicdbooleanOptionalExample: false

testingRunstringOptionalExample: null

testRunTimeinteger · int32OptionalExample: 0

testingRunHexIdstringOptionalExample: null

endTimestampinteger · int32OptionalExample: 0

startTimestampinteger · int32OptionalExample: 0

testNamestringOptionalExample: null

post/api/stopAllTests

HTTPcURLJavaScriptPython

POST /api/stopAllTests HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

200

description

{
  "metadata": "null",
  "testingRunResults": "null",
  "testingRunResultSummaries": "null",
  "runIssues": "null",
  "selectedTests": "null",
  "maxConcurrentRequests": 0,
  "recurringDaily": false,
  "workflowTest": "null",
  "authMechanism": "null",
  "testingRunResult": "null",
  "fetchCicd": false,
  "testingRun": "null",
  "testRunTime": 0,
  "testingRunHexId": "null",
  "endTimestamp": 0,
  "startTimestamp": 0,
  "testName": "null"
}

POST request for endpoint /api/updateTestRoles

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

Sample description

roleNamestringOptionalExample: MEMBER

Responses

200

description

application/json

Sample description

testRolesstringOptionalExample: null

roleNamestringOptionalExample: MEMBER

andConditionsstringOptionalExample: null

selectedRolestringOptionalExample: null

post/api/updateTestRoles

HTTPcURLJavaScriptPython

POST /api/updateTestRoles HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 105

{
  "roleName": "MEMBER",
  "orConditions": {
    "predicates": [
      {
        "type": "CONTAINS",
        "value": "api-2"
      }
    ],
    "operator": "OR"
  }
}

200

description

{
  "testRoles": "null",
  "roleName": "MEMBER",
  "andConditions": "null",
  "selectedRole": "null",
  "orConditions": {
    "predicates": [
      {
        "type": "CONTAINS",
        "value": "api-2"
      }
    ],
    "operator": "OR"
  }
}

POST request for endpoint /api/modifyTestingRunConfig

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

testingRunConfigIdintegerRequired

ID of the testing run config to modify.

Example: 101

Responses

200

Testing run configuration updated successfully.

application/json

objectOptional

Empty response body on success.

post/api/modifyTestingRunConfig

HTTPcURLJavaScriptPython

POST /api/modifyTestingRunConfig HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 335

{
  "testingRunConfigId": 101,
  "editableTestingRunConfig": {
    "testSuiteIds": [
      "suite-abc",
      "suite-xyz"
    ],
    "subCategoryList": [
      "BOLA",
      "SQLi"
    ],
    "roleId": "role-001",
    "appUrlOverride": "https://staging.example.com",
    "maxConcurrentRequests": 5,
    "testRunTime": 3600,
    "sendAlerts": true,
    "recurringDaily": false,
    "continuousTesting": false,
    "autoTicketingDetails": {}
  }
}

200

Testing run configuration updated successfully.

{}

POST request for endpoint /api/addAuthMechanism

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

typestringRequired

Authentication type. One of: HARDCODED, LOGIN_REQUEST, SAMPLE_DATA, TLS_AUTH.

Example: HARDCODED

Responses

200

Authentication mechanism saved successfully.

application/json

objectOptional

Empty response body on success.

post/api/addAuthMechanism

HTTPcURLJavaScriptPython

POST /api/addAuthMechanism HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 302

{
  "type": "HARDCODED",
  "authParamData": [
    {
      "where": "HEADER",
      "key": "Authorization",
      "value": "Bearer eyJhbGci...",
      "showHeader": true
    }
  ],
  "requestData": [
    {
      "url": "https://example.com/api/login",
      "method": "POST",
      "body": "{\"username\":\"admin\",\"password\":\"secret\"}",
      "headers": {
        "Content-Type": "application/json"
      }
    }
  ]
}

200

Authentication mechanism saved successfully.

{}

POST request for endpoint /api/triggerLoginSteps

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

typestringRequired

Must be LOGIN_REQUEST.

Example: LOGIN_REQUEST

miniTestingServiceNamestringOptional

Optional name of mini-testing service to execute the login steps.

Example: mini-service-1

Responses

200

Returns responses for each login flow step.

application/json

post/api/triggerLoginSteps

HTTPcURLJavaScriptPython

POST /api/triggerLoginSteps HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 328

{
  "type": "LOGIN_REQUEST",
  "authParamData": [
    {
      "where": "HEADER",
      "key": "Authorization",
      "value": "Bearer {{token}}"
    }
  ],
  "requestData": [
    {
      "url": "https://example.com/api/login",
      "method": "POST",
      "body": "{\"username\":\"admin\",\"password\":\"secret\"}",
      "headers": {
        "Content-Type": "application/json"
      }
    }
  ],
  "miniTestingServiceName": "mini-service-1"
}

200

Returns responses for each login flow step.

{
  "responses": [
    {
      "statusCode": 200,
      "body": "{\"token\":\"eyJhbGci...\"}",
      "headers": {}
    }
  ]
}

POST request for endpoint /api/createTestSuite

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

testSuiteNamestringRequired

Display name for the new test suite. A numeric suffix is appended if the name already exists.

Example: My OWASP Suite

subCategoryListstring[]Required

List of test subcategory identifiers to include in this suite.

Example: ["BOLA","SQLi","XSS"]

Responses

200

Test suite created successfully.

application/json

objectOptional

Empty response body on success.

post/api/createTestSuite

HTTPcURLJavaScriptPython

POST /api/createTestSuite HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 74

{
  "testSuiteName": "My OWASP Suite",
  "subCategoryList": [
    "BOLA",
    "SQLi",
    "XSS"
  ]
}

200

Test suite created successfully.

{}

POST request for endpoint /api/modifyTestSuite

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

testSuiteHexIdstringRequired

Hex-encoded ObjectId of the test suite to modify.

Example: 64b1f2c3a4e5d6f7b8c9d0e1

testSuiteNamestringOptional

New display name for the test suite.

Example: Updated OWASP Suite

subCategoryListstring[]Optional

Replacement list of test subcategory identifiers.

Example: ["BOLA","BFLA"]

Responses

200

Test suite updated successfully.

application/json

objectOptional

Empty response body on success.

post/api/modifyTestSuite

HTTPcURLJavaScriptPython

POST /api/modifyTestSuite HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 117

{
  "testSuiteHexId": "64b1f2c3a4e5d6f7b8c9d0e1",
  "testSuiteName": "Updated OWASP Suite",
  "subCategoryList": [
    "BOLA",
    "BFLA"
  ]
}

200

Test suite updated successfully.

{}

POST request for endpoint /api/deleteTestSuite

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

testSuiteHexIdstringRequired

Hex-encoded ObjectId of the test suite to delete.

Example: 64b1f2c3a4e5d6f7b8c9d0e1

Responses

200

Test suite deleted successfully.

application/json

objectOptional

Empty response body on success.

post/api/deleteTestSuite

HTTPcURLJavaScriptPython

POST /api/deleteTestSuite HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 45

{
  "testSuiteHexId": "64b1f2c3a4e5d6f7b8c9d0e1"
}

200

Test suite deleted successfully.

{}

POST request for endpoint /api/bulkUpdateTestResultsSeverity

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

testingRunResultHexIdsstring[]Required

Hex IDs of the test results to update.

Example: ["64b1f2c3a4e5d6f7b8c9d0e1","64b1f2c3a4e5d6f7b8c9d0e2"]

severityToBeUpdatedstringRequired

New severity level. One of: CRITICAL, HIGH, MEDIUM, LOW.

Example: HIGH

Responses

200

Severity updated across all related collections.

application/json

objectOptional

Empty response body on success.

post/api/bulkUpdateTestResultsSeverity

HTTPcURLJavaScriptPython

POST /api/bulkUpdateTestResultsSeverity HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 111

{
  "testingRunResultHexIds": [
    "64b1f2c3a4e5d6f7b8c9d0e1",
    "64b1f2c3a4e5d6f7b8c9d0e2"
  ],
  "severityToBeUpdated": "HIGH"
}

200

Severity updated across all related collections.

{}

POST request for endpoint /api/deleteTestRuns

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

testRunIdsstring[]Required

Hex-encoded ObjectIds of the test runs to delete.

Example: ["64a0e1b2c3d4e5f6a7b8c9d0","64a0e1b2c3d4e5f6a7b8c9d1"]

Responses

200

Test runs deleted and cleanup job enqueued.

application/json

objectOptional

Empty response body on success.

post/api/deleteTestRuns

HTTPcURLJavaScriptPython

POST /api/deleteTestRuns HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 70

{
  "testRunIds": [
    "64a0e1b2c3d4e5f6a7b8c9d0",
    "64a0e1b2c3d4e5f6a7b8c9d1"
  ]
}

200

Test runs deleted and cleanup job enqueued.

{}

POST request for endpoint /api/deleteTestRunsFromSummaries

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

latestSummaryIdsstring[]Required

Hex-encoded ObjectIds of the testing run result summaries to delete.

Example: ["64b1f2c3a4e5d6f7b8c9d0e1","64b1f2c3a4e5d6f7b8c9d0e2"]

Responses

200

Deletion job enqueued for the specified summaries.

application/json

objectOptional

Empty response body on success.

post/api/deleteTestRunsFromSummaries

HTTPcURLJavaScriptPython

POST /api/deleteTestRunsFromSummaries HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 76

{
  "latestSummaryIds": [
    "64b1f2c3a4e5d6f7b8c9d0e1",
    "64b1f2c3a4e5d6f7b8c9d0e2"
  ]
}

200

Deletion job enqueued for the specified summaries.

{}

POST request for endpoint /api/changeStatus

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

idintegerRequired

ID of the custom webhook to update.

Example: 7

activeStatusstringRequired

New status. One of: ACTIVE, INACTIVE.

Example: ACTIVE

Responses

200

Webhook status updated successfully.

application/json

objectOptional

Empty response body on success.

post/api/changeStatus

HTTPcURLJavaScriptPython

POST /api/changeStatus HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 32

{
  "id": 7,
  "activeStatus": "ACTIVE"
}

200

Webhook status updated successfully.

{}

POST request for endpoint /api/runOnce

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

idintegerRequired

ID of the custom webhook to execute.

Example: 7

Responses

200

Webhook execution triggered asynchronously.

application/json

objectOptional

Empty response body; execution happens asynchronously.

post/api/runOnce

HTTPcURLJavaScriptPython

POST /api/runOnce HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 8

{
  "id": 7
}

200

Webhook execution triggered asynchronously.

{}

POST request for endpoint /api/runTestOnboarding

post

Body

application/json

testTypestringOptionalExample: FULL

Responses

200

Onboarding tests completed

No content

post/api/runTestOnboarding

HTTPcURLJavaScriptPython

POST /api/runTestOnboarding HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 19

{
  "testType": "FULL"
}

200

Onboarding tests completed

No content

POST request for endpoint /api/saveDefaultPayload

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

domainstringRequired

Domain name to associate the payload with.

Example: example.com

patternstringRequired

JSON or text payload pattern to save as the default for this domain.

Example: {"username":"test","password":"test"}

Responses

200

Payload saved. Returns the updated DefaultPayload object.

application/json

post/api/saveDefaultPayload

HTTPcURLJavaScriptPython

POST /api/saveDefaultPayload HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 82

{
  "domain": "example.com",
  "pattern": "{\"username\":\"test\",\"password\":\"test\"}"
}

200

Payload saved. Returns the updated DefaultPayload object.

{
  "defaultPayload": {
    "domain": "example.com",
    "pattern": "{\"username\":\"test\",\"password\":\"test\"}",
    "creator": "[e-mail]",
    "createdTs": 1712300000,
    "updatedTs": 1712305000
  }
}

POST request for endpoint /api/saveReplaceDetails

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

apiCollectionIdintegerRequired

ID of the API collection containing the endpoint.

Example: 1001

urlstringRequired

URL path of the API endpoint.

Example: /api/users/{id}

methodstringRequired

HTTP method of the endpoint.

Example: GET

Responses

200

Replacement details saved successfully.

application/json

objectOptional

Empty response body on success.

post/api/saveReplaceDetails

HTTPcURLJavaScriptPython

POST /api/saveReplaceDetails HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 109

{
  "apiCollectionId": 1001,
  "url": "/api/users/{id}",
  "method": "GET",
  "kvPairs": [
    {
      "key": "id",
      "value": "{{userId}}"
    }
  ]
}

200

Replacement details saved successfully.

{}

POST request for endpoint /api/saveGlobalVars

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

Responses

200

Global host variable mappings saved successfully.

application/json

objectOptional

Empty response body on success.

post/api/saveGlobalVars

HTTPcURLJavaScriptPython

POST /api/saveGlobalVars HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 102

{
  "modifyHostDetails": [
    {
      "currentHost": "api.internal.example.com",
      "newHost": "api.staging.example.com"
    }
  ]
}

200

Global host variable mappings saved successfully.

{}

POST request for endpoint /api/invokeDependencyTable

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

apiCollectionIdsinteger[]Required

Collection IDs to invoke the dependency graph for.

Example: [1001,1002]

sourceCodeApisbooleanOptional

If true, APIs are from source code analysis and the original collection is used instead of creating a temp one.

Example: false

Responses

200

Dependency graph build job enqueued.

application/json

newCollectionIdintegerOptional

ID of the temporary collection created to hold dependency flow data.

Example: 2001

post/api/invokeDependencyTable

HTTPcURLJavaScriptPython

POST /api/invokeDependencyTable HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 55

{
  "apiCollectionIds": [
    1001,
    1002
  ],
  "sourceCodeApis": false
}

200

Dependency graph build job enqueued.

{
  "newCollectionId": 2001
}

POST request for endpoint /api/createWorkflowTest

post

Body

application/json

apiCollectionIdintegerOptional

ID of the API collection this workflow test belongs to

Example: 1748293710

nodesstring[]Optional

List of React Flow node IDs in the workflow graph

Example: ["node-1","node-2","node-3"]

edgesstring[]Optional

List of React Flow edge IDs connecting workflow nodes

Example: ["edge-1-2","edge-2-3"]

statestring · enumOptional

Initial workflow test state

Example: DRAFTPossible values:

Responses

200

Workflow test created successfully

application/json

403

Forbidden

422

Unprocessable — nodes map is null or a node failed validation

application/json

post/api/createWorkflowTest

HTTPcURLJavaScriptPython

POST /api/createWorkflowTest HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 359

{
  "apiCollectionId": 1748293710,
  "nodes": [
    "node-1",
    "node-2",
    "node-3"
  ],
  "edges": [
    "edge-1-2",
    "edge-2-3"
  ],
  "mapNodeIdToWorkflowNodeDetails": {
    "node-1": {
      "apiInfoKey": {
        "apiCollectionId": 1748293710,
        "url": "https://api.example.com/v1/login",
        "method": "POST"
      },
      "type": "API",
      "requestPayload": "{\"username\":\"[e-mail]\",\"password\":\"[REDACTED]\"}"
    }
  },
  "state": "DRAFT"
}

{
  "workflowTests": [
    {
      "id": 1766398064,
      "apiCollectionId": 1748293710,
      "author": "[e-mail]",
      "editor": "[e-mail]",
      "createdTimestamp": 1766398064,
      "lastEdited": 1766398064,
      "nodes": [
        "text"
      ],
      "edges": [
        "text"
      ],
      "state": "DRAFT"
    }
  ]
}

POST request for endpoint /api/editWorkflowTest

post

Body

application/json

idintegerRequired

Workflow test ID

Example: 1766398064

nodesstring[]OptionalExample: ["node-1","node-2","node-3"]

edgesstring[]OptionalExample: ["edge-1-2","edge-2-3"]

Responses

200

Workflow test updated

application/json

workflowTestsobject[]Optional

403

Forbidden

422

Unprocessable — workflow test not found

post/api/editWorkflowTest

HTTPcURLJavaScriptPython

POST /api/editWorkflowTest HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 233

{
  "id": 1766398064,
  "nodes": [
    "node-1",
    "node-2",
    "node-3"
  ],
  "edges": [
    "edge-1-2",
    "edge-2-3"
  ],
  "mapNodeIdToWorkflowNodeDetails": {
    "node-1": {
      "apiInfoKey": {
        "apiCollectionId": 1748293710,
        "url": "https://api.example.com/v1/login",
        "method": "POST"
      }
    }
  }
}

{
  "workflowTests": [
    {}
  ]
}

POST request for endpoint /api/setWorkflowTestState

post

Body

application/json

idintegerRequiredExample: 1766398064

statestring · enumRequiredExample: PUBLISHEDPossible values:

Responses

200

State updated

application/json

workflowTestsobject[]Optional

403

Forbidden

422

Unprocessable — workflow test not found

post/api/setWorkflowTestState

HTTPcURLJavaScriptPython

POST /api/setWorkflowTestState HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 37

{
  "id": 1766398064,
  "state": "PUBLISHED"
}

{
  "workflowTests": [
    {}
  ]
}

POST request for endpoint /api/editWorkflowNodeDetails

post

Body

application/json

idintegerRequired

Workflow test ID

Example: 1766398064

mapNodeIdToWorkflowNodeDetailsobjectRequired

Must contain exactly one entry: the node ID to update → updated WorkflowNodeDetails

Example: {"node-2":{"apiInfoKey":{"apiCollectionId":1748293710,"url":"https://api.example.com/v1/profile","method":"GET"},"type":"API"}}

Responses

200

Node details updated

application/json

workflowTestsobject[]Optional

403

Forbidden

422

Unprocessable — workflow test not found or node ID mismatch

post/api/editWorkflowNodeDetails

HTTPcURLJavaScriptPython

POST /api/editWorkflowNodeDetails HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 178

{
  "id": 1766398064,
  "mapNodeIdToWorkflowNodeDetails": {
    "node-2": {
      "apiInfoKey": {
        "apiCollectionId": 1748293710,
        "url": "https://api.example.com/v1/profile",
        "method": "GET"
      },
      "type": "API"
    }
  }
}

{
  "workflowTests": [
    {}
  ]
}

POST request for endpoint /api/deleteScheduledWorkflowTests

post

Body

application/json

workflowTestIdintegerRequiredExample: 1766398064

Responses

200

Scheduled/running tests stopped (state set to STOPPED)

application/json

objectOptional

403

Forbidden

post/api/deleteScheduledWorkflowTests

HTTPcURLJavaScriptPython

POST /api/deleteScheduledWorkflowTests HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 29

{
  "workflowTestId": 1766398064
}

{}

POST request for endpoint /api/uploadWorkflowJson

post

Body

application/json

workflowTestJsonstringRequired

JSON string of a WorkflowTest (as produced by downloadWorkflowAsJson)

Example: {"apiCollectionId":1748293710,"nodes":["node-1","node-2"],"edges":["edge-1-2"],"state":"PUBLISHED","mapNodeIdToWorkflowNodeDetails":{"node-1":{"type":"API"}}}

apiCollectionIdintegerOptional

Target API collection for the imported workflow

Example: 1748293710

Responses

200

Workflow test imported successfully

application/json

workflowTestsobject[]Optional

422

Unprocessable — invalid JSON

application/json

post/api/uploadWorkflowJson

HTTPcURLJavaScriptPython

POST /api/uploadWorkflowJson HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 234

{
  "workflowTestJson": "{\"apiCollectionId\":1748293710,\"nodes\":[\"node-1\",\"node-2\"],\"edges\":[\"edge-1-2\"],\"state\":\"PUBLISHED\",\"mapNodeIdToWorkflowNodeDetails\":{\"node-1\":{\"type\":\"API\"}}}",
  "apiCollectionId": 1748293710
}

{
  "workflowTests": [
    {}
  ]
}

POST request for endpoint /api/addTestLibrary

post

Body

application/json

repositoryUrlstringRequired

GitHub repository URL containing Akto YAML test templates

Example: https://github.com/example-org/custom-akto-tests

Responses

200

Test library added and templates synced

application/json

objectOptional

403

Forbidden

422

Unprocessable — repository URL empty or library already exists

application/json

post/api/addTestLibrary

HTTPcURLJavaScriptPython

POST /api/addTestLibrary HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 68

{
  "repositoryUrl": "https://github.com/example-org/custom-akto-tests"
}

{}

POST request for endpoint /api/removeTestLibrary

post

Body

application/json

repositoryUrlstringRequiredExample: https://github.com/example-org/custom-akto-tests

Responses

200

Test library and its templates removed

application/json

objectOptional

403

Forbidden

422

Unprocessable — repository URL empty

post/api/removeTestLibrary

HTTPcURLJavaScriptPython

POST /api/removeTestLibrary HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 68

{
  "repositoryUrl": "https://github.com/example-org/custom-akto-tests"
}

{}

POST request for endpoint /api/syncCustomLibrary

post

Body

application/json

repositoryUrlstringRequiredExample: https://github.com/example-org/custom-akto-tests

Responses

200

Custom library re-synced

application/json

objectOptional

403

Forbidden

422

Unprocessable — repository URL empty or library not found

post/api/syncCustomLibrary

HTTPcURLJavaScriptPython

POST /api/syncCustomLibrary HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 68

{
  "repositoryUrl": "https://github.com/example-org/custom-akto-tests"
}

{}

POST request for endpoint /api/syncAllDefaultTestLibraries

post

Body

application/json

objectOptional

Responses

200

Sync job scheduled asynchronously

application/json

objectOptional

403

Forbidden

post/api/syncAllDefaultTestLibraries

HTTPcURLJavaScriptPython

POST /api/syncAllDefaultTestLibraries HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2

{}

{}

POST request for endpoint /api/saveTestEditorFile

post

Body

application/json

contentstringRequired

Full YAML content of the test template

Example: id: BOLA_TEST_CUSTOM info: name: Custom BOLA Test description: Tests for BOLA vulnerability details: Checks if user A can access user B resources impact: HIGH category: name: BOLA shortName: BOLA displayName: Broken Object Level Authorization subCategory: BOLA_TEST_CUSTOM severity: HIGH tags: - OWASP_TOP_10 api_selection_filters: method: eq: GET execute: type: single requests: - req: - modify_url: replace_auth_header: true validate: response_code: eq: 200

originalTestIdstringOptional

Existing test ID to update. If null or different from the content's id, a new template is inserted.

Example: BOLA_TEST_CUSTOM

Responses

200

Test template saved

application/json

finalTestIdstringOptional

The resolved unique test ID (may differ from content id if a conflict was found)

Example: BOLA_TEST_CUSTOM

contentstringOptional

The normalized YAML content that was saved (with resolved id and name)

Example: id: BOLA_TEST_CUSTOM info: name: Custom BOLA Test ...

403

Forbidden

422

Unprocessable — invalid YAML, missing info keys, or built-in template conflict

application/json

post/api/saveTestEditorFile

HTTPcURLJavaScriptPython

POST /api/saveTestEditorFile HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 606

{
  "content": "id: BOLA_TEST_CUSTOM\ninfo:\n  name: Custom BOLA Test\n  description: Tests for BOLA vulnerability\n  details: Checks if user A can access user B resources\n  impact: HIGH\n  category:\n    name: BOLA\n    shortName: BOLA\n    displayName: Broken Object Level Authorization\n  subCategory: BOLA_TEST_CUSTOM\n  severity: HIGH\n  tags:\n    - OWASP_TOP_10\napi_selection_filters:\n  method:\n    eq: GET\nexecute:\n  type: single\n  requests:\n    - req:\n        - modify_url:\n            replace_auth_header: true\nvalidate:\n  response_code:\n    eq: 200",
  "originalTestId": "BOLA_TEST_CUSTOM"
}

{
  "finalTestId": "BOLA_TEST_CUSTOM",
  "content": "id: BOLA_TEST_CUSTOM\ninfo:\n  name: Custom BOLA Test\n  ..."
}

POST request for endpoint /api/saveCommonTestTemplate

post

Body

application/json

contentstringRequired

YAML content with wordLists definitions

Example: wordLists: userIds: - "1" - "2" - "100" sensitiveEndpoints: - /api/admin - /api/internal

Responses

200

Common template saved

application/json

objectOptional

403

Forbidden

422

Unprocessable — invalid YAML or empty/null wordLists

post/api/saveCommonTestTemplate

HTTPcURLJavaScriptPython

POST /api/saveCommonTestTemplate HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 139

{
  "content": "wordLists:\n  userIds:\n    - \"1\"\n    - \"2\"\n    - \"100\"\n  sensitiveEndpoints:\n    - /api/admin\n    - /api/internal"
}

{}

POST request for endpoint /api/runTestForGivenTemplate

post

Body

application/json

contentstringRequired

YAML content of the test template to run

Example: id: BOLA_TEST_CUSTOM info: name: Custom BOLA Test severity: HIGH ...

testingRunHexIdstringOptional

Optional hex ID of an existing testing run to use for context

Example: 6a4c1b3dde8f92780c91637f

Responses

200

Test executed; results returned

application/json

testingRunHexIdstringOptionalExample: 6a4c1b3dde8f92780c91637f

testingRunPlaygroundHexIdstringOptional

Use with fetchTestingRunPlaygroundStatus to poll for async results

Example: 7b5d2e4ffe9a38791da2748a

testingRunIssuesobjectOptional

Issue record created if test found a vulnerability

subCategoryMapobjectOptional

Map of test ID to subcategory info object

callbackUuidsstring[]Optional

Callback UUIDs for out-of-band detection tests

Example: ["cb-uuid-abc123"]

403

Forbidden

422

Unprocessable — invalid YAML template

application/json

post/api/runTestForGivenTemplate

HTTPcURLJavaScriptPython

POST /api/runTestForGivenTemplate HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 350

{
  "content": "id: BOLA_TEST_CUSTOM\ninfo:\n  name: Custom BOLA Test\n  severity: HIGH\n...",
  "apiInfoKey": {
    "apiCollectionId": 1748293710,
    "url": "https://api.example.com/v1/users/22",
    "method": "GET"
  },
  "testingRunHexId": "6a4c1b3dde8f92780c91637f",
  "testingRunConfig": {
    "overriddenTestAppUrl": "https://staging-api.example.com",
    "testRoleId": "ATTACKER_TOKEN_ALL"
  }
}

{
  "testingRunHexId": "6a4c1b3dde8f92780c91637f",
  "testingRunPlaygroundHexId": "7b5d2e4ffe9a38791da2748a",
  "testingRunResult": {
    "vulnerable": true,
    "testResults": [
      {}
    ]
  },
  "testingRunIssues": {},
  "subCategoryMap": {},
  "callbackUuids": [
    "cb-uuid-abc123"
  ]
}

POST request for endpoint /api/saveTestRoleMeta

post

Body

application/json

roleNamestringRequired

Name of the test role to update

Example: ATTACKER_TOKEN_ALL

scopeRolesstring[]Required

Akto user roles allowed to use this test role

Example: ["ADMIN","MEMBER"]

Responses

200

Test role meta saved

application/json

objectOptional

403

Forbidden

422

Unprocessable — test role not found or scope roles empty

application/json

post/api/saveTestRoleMeta

HTTPcURLJavaScriptPython

POST /api/saveTestRoleMeta HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 65

{
  "roleName": "ATTACKER_TOKEN_ALL",
  "scopeRoles": [
    "ADMIN",
    "MEMBER"
  ]
}

{}

POST request for endpoint /api/deleteTestRole

post

Body

application/json

roleNamestringRequiredExample: ATTACKER_TOKEN_ALL

Responses

200

Test role deleted

application/json

objectOptional

403

Forbidden

422

Unprocessable — role not found

post/api/deleteTestRole

HTTPcURLJavaScriptPython

POST /api/deleteTestRole HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 33

{
  "roleName": "ATTACKER_TOKEN_ALL"
}

{}

POST request for endpoint /api/deleteAuthFromRole

post

Body

application/json

roleNamestringRequiredExample: ATTACKER_TOKEN_ALL

indexintegerRequired

0-based index of the auth entry to remove from authWithCondList

Example: 0

Responses

200

Auth entry deleted; returns updated test role

application/json

selectedRoleobjectOptional

Updated TestRoles object after deletion

403

Forbidden

422

Unprocessable — role not found

post/api/deleteAuthFromRole

HTTPcURLJavaScriptPython

POST /api/deleteAuthFromRole HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 43

{
  "roleName": "ATTACKER_TOKEN_ALL",
  "index": 0
}

{
  "selectedRole": {}
}

POST request for endpoint /api/updateAuthInRole

post

Body

application/json

roleNamestringRequiredExample: ATTACKER_TOKEN_ALL

indexintegerRequired

0-based index of the auth entry to update

Example: 0

urlRegexstringOptional

Optional regex to restrict which URLs this auth applies to

Example: .*

Responses

200

Auth entry updated; returns updated test role

application/json

selectedRoleobjectOptional

403

Forbidden

422

Unprocessable — role not found or invalid URL regex

post/api/updateAuthInRole

HTTPcURLJavaScriptPython

POST /api/updateAuthInRole HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 170

{
  "roleName": "ATTACKER_TOKEN_ALL",
  "index": 0,
  "authParamData": [
    {
      "key": "Authorization",
      "value": "Bearer [REDACTED_TOKEN]",
      "where": "HEADER",
      "showHeader": true
    }
  ],
  "urlRegex": ".*"
}

{
  "selectedRole": {}
}

POST request for endpoint /api/addAuthToRole

post

Body

application/json

roleNamestringRequiredExample: ATTACKER_TOKEN_ALL

urlRegexstringOptional

Optional regex to restrict which URLs this auth applies to

Example: .*

Responses

200

Auth entry added; returns updated test role

application/json

403

Forbidden

422

Unprocessable — role not found or invalid URL regex

post/api/addAuthToRole

HTTPcURLJavaScriptPython

POST /api/addAuthToRole HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 160

{
  "roleName": "ATTACKER_TOKEN_ALL",
  "authParamData": [
    {
      "key": "Authorization",
      "value": "Bearer [REDACTED_TOKEN]",
      "where": "HEADER",
      "showHeader": true
    }
  ],
  "urlRegex": ".*"
}

{
  "selectedRole": {
    "name": "ATTACKER_TOKEN_ALL",
    "authWithCondList": [
      {}
    ]
  }
}

POST request for endpoint /api/triggerSingleLoginFlow

post

Body

application/json

typestring · enumRequired

Auth mechanism type. Must not be HARDCODED, SAMPLE_DATA, or TLS_AUTH.

Example: LOGIN_FLOWPossible values:

nodeIdstringOptional

Optional node ID for multi-step login flow

Example: step-1

Responses

200

Login flow step executed successfully

application/json

403

Forbidden

422

Unprocessable — invalid type (HARDCODED/SAMPLE_DATA/TLS_AUTH) or login flow execution failed

application/json

post/api/triggerSingleLoginFlow

HTTPcURLJavaScriptPython

POST /api/triggerSingleLoginFlow HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 234

{
  "type": "LOGIN_FLOW",
  "requestData": [
    {
      "url": "https://api.example.com/v1/login",
      "method": "POST",
      "body": "{\"username\":\"[e-mail]\",\"password\":\"[REDACTED]\"}",
      "headers": {
        "Content-Type": "application/json"
      }
    }
  ],
  "nodeId": "step-1"
}

{
  "responses": [
    {
      "statusCode": 200,
      "body": "{\"token\":\"[REDACTED_TOKEN]\"}",
      "headers": {}
    }
  ]
}

POST request for endpoint /api/updateAccessMatrixTask

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

hexIdstringRequired

Hex ObjectId of the AccessMatrixTaskInfo document to update

Example: 64a1f2e3b5c7d8e9f0a1b2c3

roleNamestringRequired

Role name; stored as roleName + '_GROUP' in endpointLogicalGroupName

Example: ADMIN

frequencyInSecondsintegerOptional

Scan frequency. Values ≤ 0 default to 86400.

Example: 43200

Responses

200

Task updated successfully

application/json

objectOptional

400

Invalid hexId or other error

application/json

post/api/updateAccessMatrixTask

HTTPcURLJavaScriptPython

POST /api/updateAccessMatrixTask HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 82

{
  "hexId": "64a1f2e3b5c7d8e9f0a1b2c3",
  "roleName": "ADMIN",
  "frequencyInSeconds": 43200
}

{}

POST request for endpoint /api/createMultipleAccessMatrixTasks

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

roleNamestringRequiredExample: READ_ONLY

Responses

200

Access matrix task created or updated successfully

application/json

objectOptional

post/api/createMultipleAccessMatrixTasks

HTTPcURLJavaScriptPython

POST /api/createMultipleAccessMatrixTasks HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 24

{
  "roleName": "READ_ONLY"
}

200

Access matrix task created or updated successfully

{}

POST request for endpoint /api/deleteAccessMatrix

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

roleNamestringRequired

Role whose access matrix data should be deleted

Example: READ_ONLY

Responses

200

Access matrix data for the role deleted successfully

application/json

objectOptional

post/api/deleteAccessMatrix

HTTPcURLJavaScriptPython

POST /api/deleteAccessMatrix HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 24

{
  "roleName": "READ_ONLY"
}

200

Access matrix data for the role deleted successfully

{}

POST request for endpoint /api/deleteAccessMatrixTask

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

hexIdstringRequired

Hex ObjectId of the AccessMatrixTaskInfo document to delete

Example: 64a1f2e3b5c7d8e9f0a1b2c3

Responses

200

Task deleted successfully

application/json

objectOptional

400

Unable to delete — invalid hexId

application/json

post/api/deleteAccessMatrixTask

HTTPcURLJavaScriptPython

POST /api/deleteAccessMatrixTask HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 36

{
  "hexId": "64a1f2e3b5c7d8e9f0a1b2c3"
}

{}