Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
openapi: 3.2.0
info:
title: PatchMon Integration Scoped API - Hosts API
version: 1.0.0
description: 'PatchMon API documentation for integrations. Covers scoped credentials, GetHomepage widget, agent endpoints, and auto-enrollment. For full application documentation, see: https://patchmon.net/docs/patchmon-api-integrations-guide#integration-api-documentation'
servers:
- url: /api/v1
description: API base path
tags:
- name: Scoped API - Hosts
description: Endpoints using scoped credentials (Basic Auth, integration_type api)
paths:
/api/hosts:
get:
tags:
- Scoped API - Hosts
summary: List hosts with IP, groups, and optional stats
description: Retrieve a list of all hosts with their IP addresses and associated host groups. Use include=stats to add package update counts (updates_count, security_updates_count, total_packages) to each host. Requires Basic Auth with scoped credentials (host:get permission).
security:
- basicAuth: []
parameters:
- name: hostgroup
in: query
description: Filter by host group name(s) or UUID(s). Comma-separated.
schema:
type: string
- name: include
in: query
description: 'Comma-separated. Supported: stats (adds updates_count, security_updates_count, total_packages, needs_reboot, os_type, os_version, last_update, status, effective_status, reporting_state, update_state). status is the stored provisioning lifecycle value, ''pending'' before the first check-in and ''active'' after it; it never becomes ''inactive''. effective_status is the value the web UI displays and is one of ''pending'' | ''active'' | ''inactive'', where ''inactive'' means an active host has not reported for more than twice the configured update interval. reporting_state is one of ''reporting'' | ''overdue'' | ''stale''. update_state is one of ''up_to_date'' | ''updates_pending'' | ''security_required''.'
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
example:
hosts:
- id: 550e8400-e29b-41d4-a716-446655440000
friendly_name: web-server-1
hostname: web1
ip: 192.168.1.10
host_groups:
- id: g1
name: Production
updates_count: 5
security_updates_count: 2
total_packages: 342
needs_reboot: false
os_type: Ubuntu
os_version: '22.04'
last_update: '2025-03-01T12:00:00Z'
status: active
effective_status: active
reporting_state: reporting
update_state: security_required
total: 1
'401':
description: Unauthorized
content:
application/json:
example:
error: Unauthorized
'403':
description: Forbidden
content:
application/json:
example:
error: Forbidden
'500':
description: Internal Server Error
content:
application/json:
example:
error: Internal Server Error
operationId: getApiHosts
x-operation-id-source: derived
components:
securitySchemes:
basicAuth:
type: http
scheme: basic
description: Basic Auth using API credentials (token_key:token_secret). Used for Scoped API and GetHomepage endpoints.
apiKeyAuth:
type: apiKey
in: header
name: X-API-ID
description: Agent API ID (host api_id). Used with X-API-KEY for agent/integration endpoints.
apiKeySecret:
type: apiKey
in: header
name: X-API-KEY
description: Agent API key. Used with X-API-ID for agent/integration endpoints.
autoEnrollmentKey:
type: apiKey
in: header
name: X-Auto-Enrollment-Key
description: Auto-enrollment token key. Used with X-Auto-Enrollment-Secret.
autoEnrollmentSecret:
type: apiKey
in: header
name: X-Auto-Enrollment-Secret
description: Auto-enrollment token secret.
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: PatchMon user session token, sent as a Bearer token or in the token cookie set at login. Used by web UI endpoints.