Modify Data
User, Auth & Access Control
1
POST /api/logout
Logs out the current user, clears session and auth cookies, and returns a redirect URL.
2
POST /api/createNewAccount
Creates a new Akto account under the current user and initialises it with default agentic collections and settings.
3
POST /api/goToAccount
Switches the active session context to a different account that the current user has access to.
4
POST /api/updateUsernameAndOrganization
Updates the current user's display name and, if the user is an ADMIN, the organisation name.
5
POST /api/removeInvitation
Removes a pending invitation for the given email address. Only the invitation issuer or an ADMIN can remove invitations.
6
POST /api/resetUserPassword
Generates a password reset token for the specified user. Token is valid and can only be generated once every 2 hours.
7
POST /api/createCustomRole
Creates a new custom role with specified base role, collection access, and feature permissions.
8
POST /api/updateCustomRole
Updates an existing custom role's base role, collection access, and feature permissions.
9
POST /api/deleteCustomRole
Deletes a custom role by name. The role must not be assigned to any users or pending invites.
10
POST /api/makeAdmin
Updates the role of a user within the current account.
11
POST /api/updateUserScopeRoleMapping
Updates the per-product-scope role mapping for a user, enabling fine-grained access control across product areas.
12
POST /api/applyAccessType
Triggers a background job to recalculate Agentic Component access types for all components based on current private CIDR and partner IP rules.
13
POST /api/resetCollectionAccessTypes
Starts a background job to reset access types for all Agentic Components across all collections.
14
POST /api/addApiToken
Creates a new Agentic Request token of the specified utility type for the current user.
15
POST /api/deleteApiToken
Deletes the specified Agentic Request token. Only the owning user can delete their own tokens.
16
POST /api/saveSubscription
Saves a web push notification subscription for the current user.
17
POST /api/provisionSubscription
Creates a billing checkout session via Stigg for the specified plan, and returns the checkout result.
18
POST /api/refreshUsageDataForOrg
Triggers a background job to recalculate and sync usage metrics for all accounts in the current organisation.
application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsOptional redirect URL after logout.
URL to redirect to after logout.
https://app.akto.io/loginLogout successful. Returns Auth0/SSO logout URL.
URL to redirect the user for completing logout (Auth0 or SSO).
https://auth.akto.io/v2/logout?returnTo=https%3A%2F%2Fapp.akto.ioPOST /api/logout HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 43
{
"redirectUrl": "https://app.akto.io/login"
}Logout successful. Returns Auth0/SSO logout URL.
{
"logoutUrl": "https://auth.akto.io/v2/logout?returnTo=https%3A%2F%2Fapp.akto.io"
}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsDisplay name for the new account.
My New WorkspaceAccount created successfully. Session is updated with the new account context.
Empty response body on success; session cookies are updated.
POST /api/createNewAccount HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 37
{
"newAccountName": "My New Workspace"
}Account created successfully. Session is updated with the new account context.
{}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsNumeric ID of the account to switch to.
1000001Session switched to the specified account. Session cookies are updated.
Empty response body on success; session cookies are updated.
POST /api/goToAccount HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 24
{
"newAccountId": 1000001
}Session switched to the specified account. Session cookies are updated.
{}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsNew display name for the user. Max 24 characters. Allowed: alphanumeric, spaces, hyphens.
Alice SmithNew organisation name (required for ADMIN users). Max 24 characters. Allowed: alphanumeric, spaces, dots, ampersand, hyphens.
Acme CorpUsername (and organisation for admins) updated successfully.
Empty response body on success.
POST /api/updateUsernameAndOrganization HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 53
{
"username": "Alice Smith",
"organization": "Acme Corp"
}Username (and organisation for admins) updated successfully.
{}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsEmail address of the pending invitation to remove.
bob@example.comInvitation removed successfully.
Empty response body on success.
POST /api/removeInvitation HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 27
{
"email": "bob@example.com"
}Invitation removed successfully.
{}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsEmail of the user whose password should be reset.
bob@example.comPassword reset token generated.
One-time password reset token to be sent to the user.
eyJhbGciOiJIUzI1NiJ9...POST /api/resetUserPassword HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 31
{
"userEmail": "bob@example.com"
}Password reset token generated.
{
"passwordResetToken": "eyJhbGciOiJIUzI1NiJ9..."
}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsUnique name for the role. Max 50 characters. Alphanumeric, hyphens, and underscores only.
security-analystBase role from which this custom role inherits. One of: ADMIN, MEMBER, GUEST.
MEMBERList of API collection IDs this role has access to.
[1001,1002]Whether this role is the default role assigned to new invites.
falseList of feature keys enabled for users in this role.
["TESTING","INVENTORY"]Custom role created successfully.
Empty response body on success.
POST /api/createCustomRole HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 157
{
"roleName": "security-analyst",
"baseRole": "MEMBER",
"apiCollectionIds": [
1001,
1002
],
"defaultInviteRole": false,
"allowedFeaturesForUser": [
"TESTING",
"INVENTORY"
]
}Custom role created successfully.
{}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsName of the existing custom role to update.
security-analystUpdated base role. One of: ADMIN, MEMBER, GUEST.
MEMBERUpdated list of API collection IDs this role has access to.
[1001,1003]Whether this role should become the default role for new invites.
trueUpdated list of feature keys enabled for users in this role.
["TESTING"]Custom role updated successfully.
Empty response body on success.
POST /api/updateCustomRole HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 144
{
"roleName": "security-analyst",
"baseRole": "MEMBER",
"apiCollectionIds": [
1001,
1003
],
"defaultInviteRole": true,
"allowedFeaturesForUser": [
"TESTING"
]
}Custom role updated successfully.
{}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsName of the custom role to delete.
security-analystCustom role deleted successfully.
Empty response body on success.
POST /api/deleteCustomRole HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 31
{
"roleName": "security-analyst"
}Custom role deleted successfully.
{}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsEmail address of the user whose role is to be updated.
bob@example.comNew role to assign to the user. Value is uppercased before processing.
ADMINUser role updated and cache cleared.
Empty response body on success.
POST /api/makeAdmin HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 46
{
"email": "bob@example.com",
"userRole": "ADMIN"
}User role updated and cache cleared.
{}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsEmail address of the user to update.
bob@example.comScope-role mapping updated and user cache cleared.
Empty response body on success.
POST /api/updateUserScopeRoleMapping HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 82
{
"email": "bob@example.com",
"scopeRoleMapping": {
"API": "ADMIN",
"ENDPOINT": "MEMBER"
}
}Scope-role mapping updated and user cache cleared.
{}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsNo request body required. Configuration is read from AccountSettings (privateCidrList, partnerIpList).
Background access-type calculation job started.
Empty response body; processing happens asynchronously.
POST /api/applyAccessType HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2
{}Background access-type calculation job started.
{}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsNo request body required.
Background reset job started.
POST /api/resetCollectionAccessTypes HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2
{}Background reset job started.
{
"response": {
"started": true,
"message": "Reset started for all collections."
}
}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsType of API token to create. One of: BURP, CICD, EXTERNAL_API.
EXTERNAL_APIAPI token created. Returns the newly created token in a list.
POST /api/addApiToken HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 31
{
"tokenUtility": "EXTERNAL_API"
}API token created. Returns the newly created token in a list.
{
"apiTokenList": [
{
"id": 42,
"key": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
"utility": "EXTERNAL_API",
"userId": 1001
}
]
}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsID of the API token to delete.
42Returns whether the token was successfully deleted.
True if the token was found and deleted, false otherwise.
truePOST /api/deleteApiToken HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 17
{
"apiTokenId": 42
}Returns whether the token was successfully deleted.
{
"apiTokenDeleted": true
}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsSubscription saved successfully.
POST /api/saveSubscription HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 123
{
"subscription": {
"endpoint": "https://fcm.googleapis.com/fcm/send/abc123",
"keys": {
"p256dh": "BNcRd...",
"auth": "tBHItJI..."
}
}
}Subscription saved successfully.
{
"subscription": {
"complete": true
}
}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsStigg customer ID for the organisation.
cust_01hx...Identifier of the billing plan to subscribe to.
plan_enterprise_monthlyBilling period for the subscription. One of: monthly, annual.
monthlyURL to redirect to after successful checkout.
https://app.akto.io/dashboard?checkout=successURL to redirect to if the user cancels checkout.
https://app.akto.io/dashboard?checkout=cancelledCheckout session created. Returns the result from the billing service.
POST /api/provisionSubscription HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 215
{
"customerId": "cust_01hx...",
"planId": "plan_enterprise_monthly",
"billingPeriod": "monthly",
"successUrl": "https://app.akto.io/dashboard?checkout=success",
"cancelUrl": "https://app.akto.io/dashboard?checkout=cancelled"
}Checkout session created. Returns the result from the billing service.
{
"checkoutResult": {
"checkoutUrl": "https://checkout.stigg.io/session/abc123",
"status": "PENDING"
}
}application/jsonYOUR_API_KEY from Settings > Integrations > Akto APIsNo request body required.
Background usage refresh job enqueued.
Empty response body; processing happens asynchronously.
POST /api/refreshUsageDataForOrg HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 2
{}Background usage refresh job enqueued.
{}Last updated