Developers

Cybermatic API v1

A read-only REST API for pulling your security data into SIEMs, ticketing, dashboards, and MSP tooling. JSON in, JSON out. Included on Posture Growth and above, SIEM Pro and above, and Endpoint Protection Pro and above.

Authentication

Create a key in any portal under Settings → API access. Keys are workspace-wide, read-only, shown once, and stored hashed. Send it as a Bearer token:

curl -H "Authorization: Bearer cmk_your_key_here" \
  "https://lhb2pt54p0.execute-api.us-east-1.amazonaws.com/api/v1/findings?severity=critical&limit=50"

Endpoints

Endpoint	Returns	Query parameters
GET /api/v1/me	Workspace and the products it runs with plan and status.	—
GET /api/v1/score	Security score, finding counts by severity, asset count, framework readiness.	—
GET /api/v1/findings	Posture findings, most severe first.	severity, status, since, limit, cursor
GET /api/v1/assets	Discovered and manual assets across connections and agents.	source, limit, cursor
GET /api/v1/devices	Endpoint Protection devices: protection, mode, engine, RTP, isolation, agent version, last seen.	limit, cursor
GET /api/v1/detections	Endpoint detections with AI verdicts and actions taken.	severity, status, since, limit, cursor
GET /api/v1/alerts	SIEM alerts.	severity, since, limit, cursor
GET /api/v1/offenses	SIEM offenses (correlated alerts) with magnitude and status.	status, since, limit, cursor
GET /api/v1/compliance	Framework readiness (SOC 2, ISO 27001, HIPAA, NIST) with control status.	—
GET /api/v1/reports	Generated documents; GET /api/v1/reports/{id} returns the markdown body.	limit, cursor

Responses & pagination

Every response is { "data": … }. List endpoints add total and, when more rows exist, next — pass it back as cursor. limit defaults to 100 (max 200; 500 for assets, devices, detections, alerts, offenses). since accepts an ISO-8601 timestamp and returns rows at or after it — poll with the time of your last successful call.

{
  "data": [
    { "id": "f-9a1…", "title": "S3 bucket allows public read", "severity": "critical", "category": "Storage",
      "status": "open", "assetId": "aws:s3:client-exports", "assetName": "client-exports", "createdAt": "2026-09-14T03:12:00Z" }
  ],
  "next": "Zi05YTEuLi4=",
  "total": 137
}

Limits & errors

600 requests per hour per key → 429 beyond that.
401 missing/invalid/revoked key · 402 plan doesn't include API access · 405 the v1 API is read-only.
Errors are { "error": "…" }. Data is served from your live workspace — no caching beyond a few seconds.

Common recipes

Ticketing: poll /findings?severity=critical&since=… every 15 minutes; open a ticket per new id.
SIEM forwarding: pull /detections and /offenses with since into your existing SIEM for a single pane.
MSP dashboards: one key per client workspace; /score and /devices give a per-client health row.
Board reporting: /reports lists generated documents; fetch the markdown by id.

Write endpoints (acknowledge findings, respond to detections) are planned; tell us what you need at info@cybermatic.ai. Get a key: sign in → Settings → API access.