Attack Surface Management Trigger and manage ASM discovery scans on your attack surface. See [our documentation](https://docs.escape.tech/documentation/asm/) for more details.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/escape:escape-asm-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Escape Asm API
version: 3.0.0
description: 'Operations tagged Asm across 2 of this provider''s published API definitions: escape-openapi.json, escape-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://public.escape.tech/v3
security:
- apiKey: []
tags:
- name: Asm
description: 'Attack Surface Management
Trigger and manage ASM discovery scans on your attack surface.
See our documentation for more details.'
paths:
/asm/scans:
get:
tags:
- Asm
summary: List ASM scans
operationId: listAsmScans
description: 'List Attack Surface Management scans of the organization, most recent first. Each entry exposes the scan status. Note that POST /asm/scans only acknowledges the request: the resulting scans are scheduled in the background and may not appear immediately.'
parameters:
- schema:
type: string
description: The cursor to start the pagination from. Returned by the previous page response. If not provided, the first page will be returned.
example: R1BDOlM6NTEwMzk4NTYtNGIyOS00NTlkLTg0ZDYtMWJhYjM0NWMzZjU5
required: false
description: The cursor to start the pagination from. Returned by the previous page response. If not provided, the first page will be returned.
name: cursor
in: query
- schema:
type: integer
minimum: 1
maximum: 100
default: 50
description: The number of items to return per page
example: 50
required: false
description: The number of items to return per page
name: size
in: query
- schema:
type: string
enum:
- SEVERITY
- createdAt
description: The type to sort by
required: false
description: The type to sort by
name: sortType
in: query
- schema:
type: string
enum:
- asc
- desc
default: desc
description: The direction to sort by
required: false
description: The direction to sort by
name: sortDirection
in: query
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
nextCursor:
type:
- string
- 'null'
totalCount:
type: integer
default: 100
example: 20
data:
type: array
items:
type: object
properties:
id:
type: string
format: uuid
description: The id of the scan
profileId:
type:
- string
- 'null'
format: uuid
description: The id of the profile that ran the scan
assetId:
type:
- string
- 'null'
format: uuid
description: The id of the asset that was scanned, if any
status:
type: string
description: The status of the scan
createdAt:
type: string
description: The date and time the scan was created
finishedAt:
type:
- string
- 'null'
description: The date and time the scan was finished
score:
type:
- number
- 'null'
description: The score of the scan
coverage:
type:
- number
- 'null'
description: Aggregate API coverage ratio for this scan (0–1), when the scan has finished with coverage data
duration:
type: number
description: The duration of the scan
progressRatio:
type: number
description: The progress ratio of the scan
initiator:
type: string
description: The initiator of the scan
kind:
type: string
description: The kind of the scan
commitHash:
type:
- string
- 'null'
description: The commit hash of the scan
commitBranch:
type:
- string
- 'null'
description: The commit branch of the scan
links:
type: object
properties:
scanIssues:
type: string
description: The url to view the scan issues in the platform
required:
- scanIssues
description: The links of the scan
required:
- id
- profileId
- assetId
- status
- createdAt
- finishedAt
- score
- coverage
- duration
- progressRatio
- initiator
- kind
- commitHash
- commitBranch
- links
title: ScanSummarized
description: Summarized information about a scan
required:
- nextCursor
- data
'400':
description: Pagination error
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Invalid cursor
- Branch filters page limit reached
details:
type: string
required:
- message
- details
title: PaginationError
description: Returned when an invalid pagination cursor is supplied or when the branch filters page limit is reached
post:
tags:
- Asm
summary: Trigger ASM scans
operationId: triggerAsmScans
description: Trigger Attack Surface Management scans on assets matching the given filter. If no filter is provided, scans all monitored assets.
requestBody:
content:
application/json:
schema:
type: object
properties:
where:
type: object
properties:
assetIds:
type: array
items:
type: string
description: Filter by specific asset IDs
types:
type: array
items:
type: string
enum:
- APK
- AWS_LAMBDA
- BITBUCKET_REPOSITORY
- BURPSUITE_EXPORT
- CODE_PROJECT
- DNS
- GITHUB_REPOSITORY
- GITLAB_REPOSITORY
- GRAPHQL
- GRAPHQL_SCHEMA
- GRPC
- HAR_EXPORT
- INSOMNIA
- IPV4
- IPV4_RANGE
- IPV6
- MCP
- OPENAPI
- PACKAGE
- POSTMAN_COLLECTION
- POSTMAN_ENVIRONMENT
- REST
- SOAP
- SOFTWARE
- WEBAPP
- WEBSOCKET
- WP_JSON
description: Filter by asset types
statuses:
type: array
items:
type: string
enum:
- DEPRECATED
- FALSE_POSITIVE
- MONITORED
- OUT_OF_SCOPE
- THIRD_PARTY
description: Filter by asset statuses
description: Asset filter predicate; omit to scan all monitored assets
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
triggered:
type: boolean
description: Whether ASM scans were successfully triggered
required:
- triggered
'400':
description: Bad Request
content:
application/json:
schema:
type: object
properties:
message:
type: string
enum:
- Bad Request
details:
type: string
required:
- message
- details
title: BadRequest
description: Returned when the request payload fails validation
servers:
- url: https://public.escape.tech/v3
components:
securitySchemes:
apiKey:
type: apiKey
in: header
name: X-ESCAPE-API-KEY
x-refined-from:
- escape-openapi.json
- escape-openapi.yml