Astra Pentest API
Astra Pentest API as documented publicly: 12 operations. Contract generated from the documentation by API Evangelist (2026-10-18); not the provider's own document.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/getastra:getastra-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.1.0
info:
title: Astra Pentest API
version: '2026-10-18'
description: 'GENERATED FROM DOCUMENTATION by API Evangelist on 2026-10-18: 12 operation(s) read from 7 public documentation page(s) (each operation
names its page in x-source). This is not the provider''s published contract; Astra Pentest has published no machine-readable contract that
the pipeline could find. Engine: local.'
x-evidence-tiers:
code-example: 7
documentation: 5
pages-with-code: 6
pages-read: 7
x-generated-from: documentation
x-provenance: generated
x-authored-by: API Evangelist
x-generated: '2026-10-18'
x-generator: generate-contract-from-docs.py
x-engine: local
x-sources:
- https://help.getastra.com/articles/3497171462-how-to-mitigate-the-risks-for-api-endpoints
- https://help.getastra.com/articles/2219221748-troubleshooting-api-endpoints-not-visible-in-astra-dashboard-after-sending-requests-via-proxy
- https://help.getastra.com/articles/1931275022-api-target-setup
- https://help.getastra.com/articles/1003530399-how-to-setup-astra-proxy-service-integration
- https://help.getastra.com/articles/2789053606-how-to-scan-applications-with-restricted-access
- https://help.getastra.com/articles/5046189569-how-to-setup-http-requests-tracing-using-opentelemetry-sdk
- https://help.getastra.com/articles/1003530399
paths:
/:
get:
operationId: get
tags:
- Api
summary: GET /
x-source: https://help.getastra.com/articles/1003530399-how-to-setup-astra-proxy-service-integration
responses:
'200':
description: Success (status as documented)
x-evidence:
kind: code-example
language: curl
snippet: 'curl. Using astra-cli , you can deploy both the Astra Proxy Service, a Dockerized MITM forward proxy, and the Astra Traffic
Collector, an OpenTelemetry (OTel)-based collector. Together, these components capture, process, and forward API traffic for observability
and inventory creation. The traffic flow works as follows: Client applications are configured to use Astra Proxy Service as a forward
pro'
/data:
post:
operationId: post_data
tags:
- Data
summary: POST /data
x-source: https://help.getastra.com/articles/1931275022-api-target-setup
responses:
'201':
description: Success (status as documented)
x-evidence:
kind: code-example
language: curl
snippet: 'curl -v -H "Authorization: Bearer <JWT_TOKEN>" \ -X POST https://api.example.com/data API Key Inputs: Header Name (e.g. x-api-key
), Header Value (e.g. abc123 ) bash'
/data-sync-service:
post:
operationId: post_data_sync_service
tags:
- Data Sync Service
summary: Example POST https://internal.example.com/data-sync-service
x-source: https://help.getastra.com/articles/3497171462-how-to-mitigate-the-risks-for-api-endpoints
responses:
'201':
description: Success (status as documented)
x-evidence:
kind: documentation
/resource:
post:
operationId: post_resource
tags:
- Resource
summary: POST /resource
x-source: https://help.getastra.com/articles/1931275022-api-target-setup
responses:
'201':
description: Success (status as documented)
x-evidence:
kind: code-example
language: curl
snippet: 'curl -v -H "Authorization: Bearer YOUR_TOKEN_HERE" \ -X POST https://api.example.com/resource JWT Bearer Inputs: Algorithm (HS256
or RS256), Secret (base64 encoded), JWT Payload & Header , Header Prefix , Header Name bash'
/secure:
post:
operationId: post_secure
tags:
- Secure
summary: POST /secure
x-source: https://help.getastra.com/articles/1931275022-api-target-setup
responses:
'201':
description: Success (status as documented)
x-evidence:
kind: code-example
language: curl
snippet: 'curl -v -H "x-api-key: abc123" \ -X POST https://api.example.com/secure Step 7: Improve Coverage Providing context about your
application helps Astra improve scan accuracy and assists security engineers during manual testing. Additional Hosts Add up to 5 hosts
to include in the scan scope. Custom HTTP headers Add custom headers that will be attached to every scanner request. Useful for: Cloud
API '
/token:
post:
operationId: post_token
tags:
- Token
summary: POST /token
x-source: https://help.getastra.com/articles/1931275022-api-target-setup
responses:
'201':
description: Success (status as documented)
x-evidence:
kind: code-example
language: curl
snippet: 'curl -v -X POST https://auth.example.com/token -d "grant_type=client_credentials" -d "client_id=abc123" -d "client_secret=xyz789"
OAuth 2.0 Password Credentials Grant Inputs: Access Token URL , Client ID , Client Secret , Username , Password curl -v -X POST https://auth.example.com/token -d
"grant_type=password" -d "client_id=abc123" -d "client_secret=xyz789" -d "username=john" -d "passwor'
/users:
post:
operationId: post_users
tags:
- Users
summary: POST /users
x-source: https://help.getastra.com/articles/5046189569-how-to-setup-http-requests-tracing-using-opentelemetry-sdk
parameters:
- name: source
in: query
required: false
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/PostUsersRequest'
responses:
'201':
description: Success (shape read from the example response on the page)
content:
application/json:
schema:
$ref: '#/components/schemas/PostUsersResponse'
x-evidence:
kind: code-example
language: curl
snippet: "curl request and how that request is mapped to otel span attributes for easy understanding HTTP Request cURL: curl -X POST 'https://api.example.com/users?source=mobile'\
\ -H 'Content-Type: application/json' -H 'Accept: application/json' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'\
\ -H 'User-Agent: MyApp/1.0' --data-raw '{\n \"name\": \"John Doe\",\n \"email\": \"john.doe@example.com"
/v1:
get:
operationId: get_v1
tags:
- Api
summary: GET /v1
x-source: https://help.getastra.com/articles/2219221748-troubleshooting-api-endpoints-not-visible-in-astra-dashboard-after-sending-requests-via-proxy
responses:
'200':
description: Success (status as documented)
x-evidence:
kind: code-example
language: curl
snippet: curl) to send requests through the Astra Proxy Service, but no API endpoints are appearing in the Astra dashboard or inventory.
Common Causes and Fixes Requests are not returning 2XX or 3XX status codes Astra Proxy only captures traffic that results in a successful
response. Requests returning 4XX or 5XX errors are not logged. Check the response status code in your API client and ensure requests
a
/v1/old-customer-orders:
get:
operationId: get_v1_old_customer_orders
tags:
- Old Customer Orders
summary: Example GET https://api.example.com/v1/old-customer-orders
x-source: https://help.getastra.com/articles/3497171462-how-to-mitigate-the-risks-for-api-endpoints
responses:
'200':
description: Success (status as documented)
x-evidence:
kind: documentation
/v1/user-login:
get:
operationId: get_v1_user_login
tags:
- User Login
summary: Example GET https://api.example.com/v1/user-login
x-source: https://help.getastra.com/articles/3497171462-how-to-mitigate-the-risks-for-api-endpoints
responses:
'200':
description: Success (status as documented)
x-evidence:
kind: documentation
/v1/user-profile:
get:
operationId: get_v1_user_profile
tags:
- User Profile
summary: Example GET https://api.example.com/v1/user-profile?userId=123
x-source: https://help.getastra.com/articles/3497171462-how-to-mitigate-the-risks-for-api-endpoints
responses:
'200':
description: Success (status as documented)
x-evidence:
kind: documentation
/v2/remove-user-account:
delete:
operationId: delete_v2_remove_user_account
tags:
- Remove User Account
summary: Example DELETE https://api.example.com/v2/remove-user-account
x-source: https://help.getastra.com/articles/3497171462-how-to-mitigate-the-risks-for-api-endpoints
responses:
'200':
description: Success (status as documented)
x-evidence:
kind: documentation
components:
schemas:
PostUsersRequest:
type: object
properties:
name:
type: string
email:
type: string
age:
type: integer
preferences:
type: object
properties:
theme:
type: string
notifications:
type: boolean
PostUsersResponse:
type: object
properties:
id:
type: integer
name:
type: string
email:
type: string
created_at:
type: string
format: date-time
status:
type: string
securitySchemes:
bearer:
type: http
scheme: bearer
security:
- bearer: []
tags:
- name: Api
- name: Data
- name: Data Sync Service
- name: Old Customer Orders
- name: Remove User Account
- name: Resource
- name: Secure
- name: Token
- name: User Login
- name: User Profile
- name: Users