Attack surface (Asset Discovery & Monitoring) inventory. Lists discovered assets and their hostnames, lists threats joined with the owning asset record, and writes back asset and asset-threat statuses so an external system can triage shadow IT and exposed services programmatically.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/cybelangel-adm-inventory-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
openapi: 3.1.0
info:
version: 1.0.0
title: References
description: |-
API for CybelAngel's ADM Inventory.
Authentication uses standard [OAuth2 Bearer Tokens](https://tools.ietf.org/html/rfc6750).
Here is a simple example of how to fetch such a token with curl:
```shell
curl -X POST https://auth.cybelangel.com/oauth/token -H 'content-type: application/json -d '{"client_id": "client_id", "client_secret": "client_secret", "audience": "https://platform.cybelangel.com/", "grant_type": "client_credentials"}
```
The received access token can then be used as a Bearer token to request our API.
contact:
email: support@cybelangel.com
license:
url: 'https://cybelangel.com/'
name: Proprietary
servers:
- url: 'https://api.cybelangel.com'
paths:
/v1/inventory/assets:
get:
tags:
- ADM Inventory
summary: Get inventory assets
description: 'Get all inventory assets. Results are sorted by `created_at` (descending) and alphabetical order of `value`.<br/>You can filter assets by either `values` or `ids` parameters, but not both at the same time.<br/><br/>**Recommendation**: Inventory data is refreshed every 8 hours.<br/>We recommend aligning the frequency of your queries with this update interval for optimal results and performance.<br/>⚠️ **Asset Discovery and Monitoring module is required.**'
operationId: get-inventory-assets
parameters:
- name: cursor
in: query
description: 'Cursor returned by a previous call to this endpoint. If it is not set, you will get the first page.'
required: false
schema:
type: string
title: Cursor
description: 'Cursor returned by a previous call to this endpoint. If it is not set, you will get the first page.'
minLength: 1
- name: values
in: query
description: To get details for specific asset(s). Cannot be used together with 'ids' parameter.
required: false
schema:
type: array
title: Values
description: To get details for specific asset(s). Cannot be used together with 'ids' parameter.
items:
type: string
minLength: 1
- name: ids
in: query
description: List of asset IDs (UUIDs). Cannot be used together with 'values' parameter.
required: false
schema:
type: array
title: Ids
description: List of asset IDs (UUIDs). Cannot be used together with 'values' parameter.
items:
type: string
format: uuid
- name: status
in: query
description: '[Deprecated] Filter on the status on an asset (This query param will be removed on September 4 2026, use `asset_status` instead)'
required: false
deprecated: true
schema:
type: array
title: Status
description: '[Deprecated] Filter on the status on an asset (This query param will be removed on September 4 2026, use `asset_status` instead)'
items:
$ref: '#/components/schemas/PreviousAssetStatus'
x-deprecated: true
- name: asset_status
in: query
description: Filter on the status on an asset
required: false
schema:
type: array
title: Asset Status
description: Filter on the status on an asset
items:
$ref: '#/components/schemas/AssetStatus'
- name: first_seen_at_start_date
in: query
description: Filter assets based on when we detected the asset for the first time in our system (greater than this date)
required: false
schema:
type: string
title: First Seen At Start Date
description: Filter assets based on when we detected the asset for the first time in our system (greater than this date)
format: date-time
examples:
- '2023-10-05T14:48:00.000Z'
examples:
default:
value: '2023-10-05T14:48:00.000Z'
- name: first_seen_at_end_date
in: query
description: Filter assets based on when we detected the asset for the first time in our system (less than this date)
required: false
schema:
type: string
title: First Seen At End Date
description: Filter assets based on when we detected the asset for the first time in our system (less than this date)
format: date-time
examples:
- '2023-10-05T14:48:00.000Z'
examples:
default:
value: '2023-10-05T14:48:00.000Z'
- name: last_seen_at_start_date
in: query
description: Filter assets based on when we detected the asset for the last time in our system (greater than this date)
required: false
schema:
type: string
title: Last Seen At Start Date
description: Filter assets based on when we detected the asset for the last time in our system (greater than this date)
format: date-time
examples:
- '2023-10-05T14:48:00.000Z'
examples:
default:
value: '2023-10-05T14:48:00.000Z'
- name: last_seen_at_end_date
in: query
description: Filter assets based on when we detected the asset for the last time in our system (less than this date)
required: false
schema:
type: string
title: Last Seen At End Date
description: Filter assets based on when we detected the asset for the last time in our system (less than this date)
format: date-time
examples:
- '2023-10-05T14:48:00.000Z'
examples:
default:
value: '2023-10-05T14:48:00.000Z'
- name: type
in: query
description: Filter on the type of an asset
required: false
schema:
$ref: '#/components/schemas/AssetType'
title: Type
description: Filter on the type of an asset
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/GetAssetsResponseDTO'
__errors__:
'#/%24defs/TranslationElementDTO': Keys TranslationElementDTO_2 through TranslationElementDTO_20 already taken.
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_BadRequestError_'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnauthorizedError_'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnknownError_'
security:
- jwt: []
servers:
- url: 'https://api.cybelangel.com'
/v1/inventory/assets/hostnames:
get:
tags:
- ADM Inventory
summary: Get inventory assets hostnames
description: 'Get hostnames associated with assets of type IP.<br/><br/>You can filter assets by either ''asset_values'' or ''asset_ids'' parameters, but not both at the same time.<br/><br/>**Recommendation**: Inventory data is refreshed every 8 hours.<br/>We recommend aligning the frequency of your queries with this update interval for optimal results and performance.<br/><br/>⚠️ **Asset Discovery and Monitoring module is required.**'
operationId: get-inventory-assets-hostnames
parameters:
- name: cursor
in: query
description: 'Cursor returned by a previous call to this endpoint. If it is not set, you will get the first page.'
required: false
schema:
type: string
title: Cursor
description: 'Cursor returned by a previous call to this endpoint. If it is not set, you will get the first page.'
minLength: 1
- name: asset_values
in: query
description: To get hostnames for specific asset(s). Cannot be used together with 'asset_ids' parameter.
required: false
schema:
type: array
title: Asset Values
description: To get hostnames for specific asset(s). Cannot be used together with 'asset_ids' parameter.
examples:
- - 74.125.20.138
- 17.253.144.10
items:
type: string
minLength: 1
examples:
default:
value:
- 74.125.20.138
- 17.253.144.10
- name: asset_ids
in: query
description: List of asset IDs (UUIDs) to filter the results. Cannot be used together with 'asset_values' parameter.
required: false
schema:
type: array
title: Asset Ids
description: List of asset IDs (UUIDs) to filter the results. Cannot be used together with 'asset_values' parameter.
items:
type: string
format: uuid
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/GetAssetsHostnamesResponseDTO'
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_BadRequestError_'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnauthorizedError_'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnknownError_'
security:
- jwt: []
servers:
- url: 'https://api.cybelangel.com'
/v1/inventory/assets/threats:
get:
tags:
- ADM Inventory
summary: Get inventory threats with asset info
description: 'Get threats associated with assets. Threats are sorted by their `first_seen` field (descending), and returned by page of 50 items. If there are more elements, you can use the provided cursor to retrieve the next page as explained in [the how-to page](https://developers.cybelangel.com/docs/adm-inventory-api/7e88d945427a4-fetch-assets-details-from-adm-inventory#pagination).<br/><br/>**Recommendation**: Inventory data is refreshed every 8 hours.<br/>We recommend aligning the frequency of your queries with this update interval for optimal results and performance.<br/><br/>⚠️ **Asset Discovery and Monitoring module is required.**'
operationId: get-inventory-threats-with-asset-info
parameters:
- name: cursor
in: query
description: 'Cursor returned by a previous call to this endpoint. If it is not set, you will get the first page.'
required: false
schema:
type: string
title: Cursor
description: 'Cursor returned by a previous call to this endpoint. If it is not set, you will get the first page.'
minLength: 1
- name: asset_values
in: query
description: To get threats for specific asset(s). Cannot be used together with 'asset_ids' parameter.
required: false
schema:
type: array
title: Asset Values
description: To get threats for specific asset(s). Cannot be used together with 'asset_ids' parameter.
examples:
- - 127.0.0.1
- 192.168.0.1
items:
type: string
minLength: 1
examples:
default:
value:
- 127.0.0.1
- 192.168.0.1
- name: asset_ids
in: query
description: List of asset IDs (UUIDs). Cannot be used together with 'asset_values' parameter.
required: false
schema:
type: array
title: Asset Ids
description: List of asset IDs (UUIDs). Cannot be used together with 'asset_values' parameter.
items:
type: string
format: uuid
- name: severity
in: query
description: To get threats with specific severity
required: false
schema:
type: array
title: Severity
description: To get threats with specific severity
examples:
- - 1
- 2
items:
$ref: '#/components/schemas/ThreatSeverity'
examples:
default:
value:
- 1
- 2
- name: status
in: query
description: To get threats with specific status
required: false
schema:
type: array
title: Status
description: To get threats with specific status
examples:
- - open
items:
$ref: '#/components/schemas/ThreatStatus'
examples:
default:
value:
- open
- name: first_seen_start_date
in: query
description: 'Full datetime format with timezone (e.g., 2025-07-17T11:00:51Z)'
required: false
schema:
type: string
title: First Seen Start Date
description: 'Full datetime format with timezone (e.g., 2025-07-17T11:00:51Z)'
format: date-time
examples:
- '2025-07-17T11:00:51Z'
examples:
default:
value: '2025-07-17T11:00:51Z'
- name: first_seen_end_date
in: query
description: 'Full datetime format with timezone (e.g., 2025-07-18T11:00:51Z)'
required: false
schema:
type: string
title: First Seen End Date
description: 'Full datetime format with timezone (e.g., 2025-07-18T11:00:51Z)'
format: date-time
examples:
- '2025-07-18T11:00:51Z'
examples:
default:
value: '2025-07-18T11:00:51Z'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/GetThreatsWithAssetInfoResponseDTO'
__errors__:
'#/%24defs/TranslationElementDTO': Keys TranslationElementDTO_2 through TranslationElementDTO_20 already taken.
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_BadRequestError_'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnauthorizedError_'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnknownError_'
security:
- jwt: []
servers:
- url: 'https://api.cybelangel.com'
/v1/inventory/assets/status:
put:
tags:
- ADM Inventory
summary: Update inventory assets status
description: 'Update the status of multiple assets.<br/><br/>You must provide either ''asset_values'' or ''asset_ids'', but not both.<br/><br/>⚠️ **Asset Discovery and Monitoring module is required.**'
operationId: put-inventory-assets-status
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateAssetsStatusRequestBodyDTO'
responses:
'204':
description: No Content
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_BadRequestError_'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnauthorizedError_'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
'409':
description: Conflict
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ConflictError_'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnknownError_'
security:
- jwt: []
servers:
- url: 'https://api.cybelangel.com'
/v1/inventory/assets/threats/status:
put:
tags:
- ADM Inventory
summary: Update inventory assets threats status
description: 'Update the status of multiple asset threats.<br/><br/>Each threat must identify its asset by either ''asset_value'' or ''asset_id'', but not both.<br/><br/>⚠️ **Asset Discovery and Monitoring module is required.**'
operationId: put-inventory-assets-threats-status
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateAssetThreatStatusRequestBodyDTO'
responses:
'204':
description: No Content
'400':
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_BadRequestError_'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnauthorizedError_'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_ForbiddenAccessError_'
'404':
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_NotFoundError_'
'500':
description: Internal Server Error
content:
application/json:
schema:
$ref: '#/components/schemas/APIErrorResponse_UnknownError_'
security:
- jwt: []
servers:
- url: 'https://api.cybelangel.com'
tags:
- name: ADM Inventory
description: Manipulate ADM inventory assets and threats.
components:
securitySchemes:
jwt:
type: http
scheme: bearer
bearerFormat: JWT
schemas:
PreviousAssetStatus:
type: string
enum:
- input
- discovered
- confirmed
- discarded
title: PreviousAssetStatus
AssetStatus:
type: string
enum:
- owned
- discovered
- external
- discarded
title: AssetStatus
AssetType:
type: string
enum:
- domain
- ip
- iprange
title: AssetType
GetAssetsResponseDTO:
type: object
title: GetAssetsResponseDTO
additionalProperties: false
properties:
items:
type: array
title: Items
description: List of assets matching the request
items:
$ref: '#/components/schemas/InventoryAssetDTO'
next_cursor:
title: Next Cursor
description: Cursor to the next page. You should use this cursor in the "cursor" query parameter to retrieve the next page.
anyOf:
- type: string
total:
type: integer
title: Total
description: Total number of assets through all pages (or in all your inventory)
minimum: 0
required:
- items
- total
InventoryAssetDTO:
type: object
title: InventoryAssetDTO
properties:
id:
type: string
title: Id
description: The id of the asset.
format: uuid
value:
type: string
title: Value
description: 'The value describing the asset. The format depends on the asset type. It will be the IP for an asset of type IP, the domain or subdomain name for an asset of type DOMAIN for instance.'
examples:
- shop.acme.com
type:
$ref: '#/components/schemas/AssetType'
description: Type of the assets
status:
description: '[Deprecated] Status of the asset (This field will be removed on September 4 2026, use `asset_status` instead)'
anyOf:
- $ref: '#/components/schemas/PreviousAssetStatus'
x-deprecated: true
asset_status:
$ref: '#/components/schemas/AssetStatus'
description: Status of the asset
first_seen_at:
type: string
title: First Seen At
description: When we detected the asset for the first time in our system
format: date-time
examples:
- '2023-10-05T14:48:00.000Z'
last_seen_at:
type: string
title: Last Seen At
description: When we detected the asset for the last time in our system
format: date-time
examples:
- '2023-10-05T14:48:00.000Z'
created_at:
type: string
title: Created At
description: When the asset ends in your inventory for the first time. It could be different from the first time we saw it
format: date-time
examples:
- '2023-10-05T14:48:00.000Z'
platform_link:
type: string
title: Platform Link
description: Direct link to the asset in the platform
format: url
examples:
- 'https://platform.cybelangel.com/asset-discovery-watchlist/6cfe8b81-f66c-47c9-9434-56e20738e179'
registrar:
title: Registrar
description: The registrar responsible for the asset registration.
examples:
- GoDaddy
anyOf:
- type: string
organization:
title: Organization
description: The organization or entity that manages the respective asset.
examples:
- Acme Corp
anyOf:
- type: string
localization:
title: Localization
examples:
- United States
anyOf:
- type: string
tags:
type: array
title: Tags
description: List of tags for this asset
examples:
- - Pod US
- Third Party
items:
type: string
fingerprints:
$ref: '#/components/schemas/FingerprintsDTO'
description: Metadata tied to your asset
threats:
$ref: '#/components/schemas/ThreatsInformationDTO'
graph:
anyOf:
- $ref: '#/components/schemas/InventoryAssetGraphDTO'
workspaces:
type: array
title: Workspaces
description: List of workspaces this asset belongs to
items:
$ref: '#/components/schemas/InventoryAssetWorkspaceDTO'
required:
- id
- value
- type
- asset_status
- first_seen_at
- last_seen_at
- created_at
- platform_link
- tags
- fingerprints
- threats
FingerprintsDTO:
type: object
title: FingerprintsDTO
properties:
open_ports:
type: array
title: Open Ports
description: List of ports with related fingerprints
items:
$ref: '#/components/schemas/OpenPortDTO'
required:
- open_ports
OpenPortDTO:
type: object
title: OpenPortDTO
properties:
port:
type: integer
title: Port
examples:
- 3306
transport:
$ref: '#/components/schemas/OpenPortTransport'
example: tcp
service:
$ref: '#/components/schemas/ServiceDTO'
required:
- port
- transport
- service
OpenPortTransport:
type: string
enum:
- tcp
- udp
title: OpenPortTransport
ServiceDTO:
type: object
title: ServiceDTO
properties:
protocol:
type: string
title: Protocol
minLength: 1
examples:
- mysql
cpes:
type: array
title: Cpes
description: List of CPEs associated with the service
items:
$ref: '#/components/schemas/OpenServiceCpeDTO'
required:
- protocol
- cpes
OpenServiceCpeDTO:
type: object
title: OpenServiceCpeDTO
properties:
name:
type: string
title: Name
description: The CPE 2.3 standard identifier
minLength: 1
examples:
- 'cpe:2.3:a:apache:http_server:2.4.46'
first_seen_at:
type: string
title: First Seen At
format: date-time
examples:
- '2023-10-05T14:48:00.000Z'
last_seen_at:
type: string
title: Last Seen At
format: date-time
examples:
- '2023-10-05T14:48:00.000Z'
required:
- name
- first_seen_at
- last_seen_at
ThreatsInformationDTO:
type: object
title: ThreatsInformationDTO
properties:
count:
type: integer
title: Count
examples:
- 1
level:
title: Level
examples:
- 3
anyOf:
- type: integer
minimum: 0
items:
type: array
title: Items
description: Threats tied to the asset
items:
$ref: '#/components/schemas/InventoryThreatWithReportIds'
required:
- count
- items
InventoryThreatWithReportIds:
type: object
title: InventoryThreatWithReportIds
description: Threat enriched with the list of reports ids created from it.
properties:
hash:
type: string
title: Hash
description: Hash of some attributes of a threat
examples:
- f34e5a49b1a1b1033e1c48e3f78863b3cc5be5dc1e0263cf2a13386241d0d16e
severity:
type: integer
title: Severity
description: The severity of this specific threat
minimum: 0
maximum: 4
examples:
- 3
port:
title: Port
description: The port where the threat is located
examples:
- 443
anyOf:
- type: integer
minimum: 0
first_seen:
type: string
title: First Seen
description: When we detected the threat for the first time
format: date-time
examples:
- '2023-10-05T14:48:00.000Z'
last_seen:
type: string
title: Last Seen
description: When we detected the threat for the last time (always less than 48 hours ago)
format: date-time
examples:
- '2023-10-05T14:48:00.000Z'
type:
$ref: '#/components/schemas/ThreatType'
description: |-
What type of threat we detected. Every type is mapped to a data object:
- DomainThreatDataDTO --> accessible_sensitive_website, inaccessible_sensitive_website, accessible_website, forbidden_website, broken_website.
- ExposedSensitiveFileThreatDataDTO --> exposed_sensitive_file.
- SubDomainTakeoverThreatDataDTO --> subdomain_takeover.
- TLSCertificateThreatDataDTO --> tls_certificate_expired, tls_certificate_soon_expired, accessible_website_with_tls_certificate_expired.
- SpfThreatDataDTO --> permissive_spf_misconfiguration, too_many_spf_records.
- VulnerableTechnologyThreatDataDTO --> vulnerable_technology, vulnerable_technology_to_kev.
- OtherThreatDataDTO --> exposed_service, exposed_data_storage.
status:
$ref: '#/components/schemas/ThreatStatus'
description: The current status of the threat.
data:
title: Data
description: Additional metadata about a specific threat.
anyOf:
- $ref: '#/components/schemas/DomainThreatDataDTO'
- $ref: '#/components/schemas/SubDomainTakeoverThreatDataDTO'
- $ref: '#/components/schemas/ExposedSensitiveFileThreatDataDTO'
- $ref: '#/components/schemas/TLSCertificateThreatDataDTO'
- $ref: '#/components/schemas/SpfThreatDataDTO'
- $ref: '#/components/schemas/VulnerableTechnologyThreatDataDTO'
- $ref: '#/components/schemas/OtherThreatDataDTO'
report_ids:
type: array
title: Report Ids
description: List of report IDs associated created from the threat
items:
type: string
required:
- hash
- severity
- first_seen
- last_seen
- type
- status
- data
- report_ids
ThreatType:
type: string
enum:
- exposed_service
- exposed_data_storage
- accessible_website
- forbidden_website
- broken_website
- accessible_sensitive_website
- inaccessible_sensitive_website
- subdomain_takeover
- belonging_dangling_subdomain
- dangling_subdomain
- tls_certificate_expired
- tls_certificate_soon_expired
- accessible_website_with_tls_certificate_expired
- permissive_spf_misconfiguration
- too_many_spf_records
- vulnerable_technology
- vulnerable_technology_to_kev
- exposed_sensitive_file
- None
title: ThreatType
description: The type of the threat
ThreatStatus:
type: string
enum:
- open
- under_review
- remediated
- risk_accepted
- not_applicable
# --- truncated at 32 KB (52 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cybelangel/refs/heads/main/openapi/cybelangel-adm-inventory-openapi.yml