Rapid7

Rapid7 Reports API

Reports provide the ability to share information with stakeholders at both scan and app levels. The following table lists the report templates and the various formats that are available: Report Type Report Format VULN_SUMMARY PDF HTML CSV VULN_REMEDIATION PDF HTML PCI_COMPLIANCE PDF HTML PCI4_COMPLIANCE PDF HTML OWASP_2013_COMPLIANCE PDF HTML OWASP_2017_COMPLIANCE PDF HTML OWASP_2021_COMPLIANCE PDF HTML OWASP_2023API_COMPLIANCE PDF HTML OWASP_2025_COMPLIANCE PDF HTML GDPR_2016_COMPLIANCE PDF HTML SOX_COMPLIANCE PDF HTML HIPAA_COMPLIANCE PDF HTML EXEC_SINGLE_APP (deprecated) PDF HTML EXEC_ALL_APPS (deprecated) PDF EXEC_SINGLE_APP_NEW_VULNS PDF HTML EXEC_ALL_APP_NEW_VULNS PDF EXEC_SINGLE_APP_ALL_VULNS PDF HTML EXEC_ALL_APP_ALL_VULNS PDF EXEC_IAS_IVM_COMPOSITE PDF

GitHub OpenAPI

Operations 4

GET /reports Get Reports #
POST /reports Generate Report #
GET /reports/{report-id} Get Report #
DELETE /reports/{report-id} Delete Report #

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/rapid7/refs/heads/main/openapi/rapid7-reports-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/rapid7-reports-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

rapid7-reports-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: InsightAppSec Reports API
  description: Welcome to the reference documentation for the public APIs available for InsightAppSec.
  version: v1
servers:
- url: https://[region].api.insight.rapid7.com/ias/v1
tags:
- name: Reports
  description: Reports provide the ability to share information with stakeholders at both scan and app levels.
paths:
  /reports:
    get:
      tags:
      - Reports
      summary: Get Reports
      description: 'Get a page of Reports, based on the supplied pagination parameters.

        The default sort for Reports is "generatedDate" (descending); for a full list of sortable properties, refer to the Search Catalog detailed in the Search API.'
      operationId: get-reports
      parameters:
      - name: index
        in: query
        schema:
          type: integer
          format: int32
      - name: size
        in: query
        schema:
          type: integer
          format: int32
      - name: sort
        in: query
        schema:
          type: string
      - name: page-token
        in: query
        schema:
          type: string
      responses:
        '415':
          description: Unsupported Media Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PageReport'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    post:
      tags:
      - Reports
      summary: Generate Report
      description: 'Generate a new Report


        The following table outlines per report type whether a field is required (✅), optional (✳) or not to be included (❌) for report generation


        Report Type name type format scanId filter


        VULN_SUMMARY ✅

        ✅

        ✅

        ✅

        ✳


        VULN_REMEDIATION ✅

        ✅

        ✅

        ✅

        ✳


        PCI_COMPLIANCE ✅

        ✅

        ✅

        ✅

        ✳


        PCI4_COMPLIANCE ✅

        ✅

        ✅

        ✅

        ✳


        OWASP_2013_COMPLIANCE ✅

        ✅

        ✅

        ✅

        ✳


        OWASP_2017_COMPLIANCE ✅

        ✅

        ✅

        ✅

        ✳


        OWASP_2021_COMPLIANCE ✅

        ✅

        ✅

        ✅

        ✳


        OWASP_2023API_COMPLIANCE ✅

        ✅

        ✅

        ✅

        ✳


        OWASP_2025_COMPLIANCE ✅

        ✅

        ✅

        ✅

        ✳


        GDPR_2016_COMPLIANCE ✅

        ✅

        ✅

        ✅

        ✳


        SOX_COMPLIANCE ✅

        ✅

        ✅

        ✅

        ✳


        HIPAA_COMPLIANCE ✅

        ✅

        ✅

        ✅

        ✳


        EXEC_SINGLE_APP (deprecated) ✅

        ✅

        ✅

        ❌

        ✳


        EXEC_ALL_APPS (deprecated) ✅

        ✅

        ✅

        ❌

        ✳


        EXEC_SINGLE_APP_NEW_VULNS ✅

        ✅

        ✅

        ❌

        ✳


        EXEC_ALL_APPS_NEW_VULNS ✅

        ✅

        ✅

        ❌

        ✳


        EXEC_SINGLE_APP_ALL_VULNS ✅

        ✅

        ✅

        ❌

        ✳


        EXEC_ALL_APPS_ALL_VULNS ✅

        ✅

        ✅

        ❌

        ✳'
      operationId: generate-report
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ReportGeneration'
        required: true
      responses:
        '415':
          description: Unsupported Media Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '201':
          description: Created
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Action conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '422':
          description: Resource validation error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationErrors'
  /reports/{report-id}:
    get:
      tags:
      - Reports
      summary: Get Report
      description: 'Get a Report

        NOTE: This API allows for the retrieval of both Report Information and Report Contents depending on which Mime-Type the client advertises acceptance of in the Accept header passed in the call.

        When retrieving only the Report Information the client should supply an Accept header value that indicates acceptance of the application/json mime type only.


        To download the Report Contents the client is required to supply Accept header values that indicate acceptance of application/pdf for PDF reports, application/zip for HTML reports or text/csv for CSV reports. To ensure errors can be returned application/json should also be provided as the second Accept header value. Attempts to download a report for which the generation status is not COMPLETE will result in a response of "204 No Content".

        This request can be polled until the status becomes COMPLETE'
      operationId: get-report
      parameters:
      - name: report-id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '415':
          description: Unsupported Media Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '200':
          description: OK
          content:
            text/csv:
              schema:
                type: string
                format: binary
            application/zip:
              schema:
                type: string
                format: binary
            application/pdf:
              schema:
                type: string
                format: binary
            application/json:
              schema:
                $ref: '#/components/schemas/EntityModelReport'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
      - Reports
      summary: Delete Report
      description: Delete an existing Report
      operationId: delete-report
      parameters:
      - name: report-id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '415':
          description: Unsupported Media Type
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '204':
          description: No Content
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Unauthenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Action conflict
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    PageMetadata:
      properties:
        index:
          type: integer
          format: int64
        size:
          type: integer
          format: int64
        sort:
          type: string
        total_data:
          type: integer
          format: int64
        total_pages:
          type: integer
          format: int64
        page_token:
          type: string
    EntityModelReport:
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
          description: The name of the Report
          readOnly: true
        type:
          type: string
          description: The type of the Report.<br/><code>EXEC_SINGLE_APP</code> is deprecated. Use <code>EXEC_SINGLE_APP_NEW_VULNS</code> or <code>EXEC_SINGLE_APP_ALL_VULNS</code> instead. <br/><code>EXEC_ALL_APPS</code> is deprecated. Use <code>EXEC_ALL_APPS_NEW_VULNS</code> or <code>EXEC_ALL_APPS_ALL_VULNS</code> instead.
          enum:
          - VULN_SUMMARY
          - VULN_REMEDIATION
          - PCI_COMPLIANCE
          - PCI4_COMPLIANCE
          - OWASP_2013_COMPLIANCE
          - OWASP_2017_COMPLIANCE
          - OWASP_2021_COMPLIANCE
          - OWASP_2023API_COMPLIANCE
          - OWASP_2025_COMPLIANCE
          - GDPR_2016_COMPLIANCE
          - SOX_COMPLIANCE
          - HIPAA_COMPLIANCE
          - EXEC_SINGLE_APP
          - EXEC_ALL_APPS
          - EXEC_SINGLE_APP_NEW_VULNS
          - EXEC_ALL_APPS_NEW_VULNS
          - EXEC_SINGLE_APP_ALL_VULNS
          - EXEC_ALL_APPS_ALL_VULNS
          - EXEC_IAS_IVM_COMPOSITE
          - TARGET_DISCOVERY
          readOnly: true
        format:
          type: string
          description: The format of the Report
          enum:
          - HTML
          - CSV
          - PDF
          readOnly: true
        owner:
          $ref: '#/components/schemas/ReadOnlyIdResource'
        generated_date:
          type: string
          format: date-time
          description: The time the Report was generated
          readOnly: true
        app:
          $ref: '#/components/schemas/ReferenceResource'
        status:
          type: string
          description: The status of the Report
          enum:
          - PROCESSING
          - FAILED
          - COMPLETE
          readOnly: true
        links:
          type: array
          items:
            $ref: '#/components/schemas/Link'
          readOnly: true
    ValidationError:
      properties:
        type:
          type: string
          description: The type of the validation error
          enum:
          - OBJECT
          - PROPERTY
          readOnly: true
        context:
          type: string
          description: An optional contextual indicator of a part of the request which failed validation
          readOnly: true
        explanation:
          type: string
          description: Details of the validation error
          readOnly: true
    ReportGeneration:
      properties:
        name:
          type: string
          description: The name of the Report
          example: Weekly Report
        type:
          type: string
          description: The type of the Report.<br/><code>EXEC_SINGLE_APP</code> is deprecated. Use <code>EXEC_SINGLE_APP_NEW_VULNS</code> or <code>EXEC_SINGLE_APP_ALL_VULNS</code> instead. <br/><code>EXEC_ALL_APPS</code> is deprecated. Use <code>EXEC_ALL_APPS_NEW_VULNS</code> or <code>EXEC_ALL_APPS_ALL_VULNS</code> instead.
          enum:
          - VULN_SUMMARY
          - VULN_REMEDIATION
          - PCI_COMPLIANCE
          - PCI4_COMPLIANCE
          - OWASP_2013_COMPLIANCE
          - OWASP_2017_COMPLIANCE
          - OWASP_2021_COMPLIANCE
          - OWASP_2023API_COMPLIANCE
          - OWASP_2025_COMPLIANCE
          - GDPR_2016_COMPLIANCE
          - SOX_COMPLIANCE
          - HIPAA_COMPLIANCE
          - EXEC_SINGLE_APP
          - EXEC_ALL_APPS
          - EXEC_SINGLE_APP_NEW_VULNS
          - EXEC_ALL_APPS_NEW_VULNS
          - EXEC_SINGLE_APP_ALL_VULNS
          - EXEC_ALL_APPS_ALL_VULNS
          example: VULN_SUMMARY
        format:
          type: string
          description: The format of the Report
          enum:
          - HTML
          - CSV
          - PDF
          example: PDF
        scan:
          $ref: '#/components/schemas/scan'
        app:
          $ref: '#/components/schemas/app'
        start:
          type: string
          description: The start date range scope for the Report yyyy-mm-dd
        end:
          type: string
          description: The end date range scope for the Report yyyy-mm-dd
        month:
          type: string
          description: The month date range scope for the Report yyyy-mm
          example: 2023-12
        filter:
          type: string
          description: Search-format filter relevant to the Report Type that narrows its scope
          example: vulnerability.app.name CONTAINS 'Weekly'
      required:
      - format
      - name
      - type
      title: Report Generation
    app:
      description: The App that the Scan is associated with
      properties:
        id:
          type: string
          format: uuid
    Link:
      properties:
        rel:
          type: string
        href:
          type: string
        profile:
          type: string
        name:
          type: string
      readOnly: true
    PageReport:
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/EntityModelReport'
        metadata:
          $ref: '#/components/schemas/PageMetadata'
        links:
          type: array
          items:
            $ref: '#/components/schemas/Link'
          readOnly: true
    Error:
      properties:
        status:
          type: string
          description: A description of the type of error based on HTTP status code
          enum:
          - 100 CONTINUE
          - 101 SWITCHING_PROTOCOLS
          - 102 PROCESSING
          - 103 EARLY_HINTS
          - 103 CHECKPOINT
          - 200 OK
          - 201 CREATED
          - 202 ACCEPTED
          - 203 NON_AUTHORITATIVE_INFORMATION
          - 204 NO_CONTENT
          - 205 RESET_CONTENT
          - 206 PARTIAL_CONTENT
          - 207 MULTI_STATUS
          - 208 ALREADY_REPORTED
          - 226 IM_USED
          - 300 MULTIPLE_CHOICES
          - 301 MOVED_PERMANENTLY
          - 302 FOUND
          - 302 MOVED_TEMPORARILY
          - 303 SEE_OTHER
          - 304 NOT_MODIFIED
          - 305 USE_PROXY
          - 307 TEMPORARY_REDIRECT
          - 308 PERMANENT_REDIRECT
          - 400 BAD_REQUEST
          - 401 UNAUTHORIZED
          - 402 PAYMENT_REQUIRED
          - 403 FORBIDDEN
          - 404 NOT_FOUND
          - 405 METHOD_NOT_ALLOWED
          - 406 NOT_ACCEPTABLE
          - 407 PROXY_AUTHENTICATION_REQUIRED
          - 408 REQUEST_TIMEOUT
          - 409 CONFLICT
          - 410 GONE
          - 411 LENGTH_REQUIRED
          - 412 PRECONDITION_FAILED
          - 413 PAYLOAD_TOO_LARGE
          - 413 REQUEST_ENTITY_TOO_LARGE
          - 414 URI_TOO_LONG
          - 414 REQUEST_URI_TOO_LONG
          - 415 UNSUPPORTED_MEDIA_TYPE
          - 416 REQUESTED_RANGE_NOT_SATISFIABLE
          - 417 EXPECTATION_FAILED
          - 418 I_AM_A_TEAPOT
          - 419 INSUFFICIENT_SPACE_ON_RESOURCE
          - 420 METHOD_FAILURE
          - 421 DESTINATION_LOCKED
          - 422 UNPROCESSABLE_ENTITY
          - 423 LOCKED
          - 424 FAILED_DEPENDENCY
          - 425 TOO_EARLY
          - 426 UPGRADE_REQUIRED
          - 428 PRECONDITION_REQUIRED
          - 429 TOO_MANY_REQUESTS
          - 431 REQUEST_HEADER_FIELDS_TOO_LARGE
          - 451 UNAVAILABLE_FOR_LEGAL_REASONS
          - 500 INTERNAL_SERVER_ERROR
          - 501 NOT_IMPLEMENTED
          - 502 BAD_GATEWAY
          - 503 SERVICE_UNAVAILABLE
          - 504 GATEWAY_TIMEOUT
          - 505 HTTP_VERSION_NOT_SUPPORTED
          - 506 VARIANT_ALSO_NEGOTIATES
          - 507 INSUFFICIENT_STORAGE
          - 508 LOOP_DETECTED
          - 509 BANDWIDTH_LIMIT_EXCEEDED
          - 510 NOT_EXTENDED
          - 511 NETWORK_AUTHENTICATION_REQUIRED
          readOnly: true
        message:
          type: string
          description: A description of the error
          readOnly: true
        errorCode:
          type: string
          description: An optional code which may help support indicate the underlying cause of the error
          enum:
          - E1
          - E2
          - E3
          - E4
          - E5
          - E6
          - E7
          - E8
          - E9
          - E10
          - E11
          - E12
          - E13
          - E14
          - E15
          - E16
          - E17
          - E18
          - E19
          - E20
          - E22
          - E23
          - E24
          - E25
          - E26
          - E27
          - E28
          - E999
          readOnly: true
      title: Error
    ReferenceResource:
      description: The last editor of the comment
      properties:
        id:
          type: string
          format: uuid
      readOnly: true
      required:
      - id
    scan:
      description: The Scan associated with the Report
      properties:
        id:
          type: string
          format: uuid
    ReadOnlyIdResource:
      description: The ID of the module
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
      readOnly: true
    ValidationErrors:
      properties:
        status:
          type: string
          description: A description of the type of error based on HTTP status code
          enum:
          - 100 CONTINUE
          - 101 SWITCHING_PROTOCOLS
          - 102 PROCESSING
          - 103 EARLY_HINTS
          - 103 CHECKPOINT
          - 200 OK
          - 201 CREATED
          - 202 ACCEPTED
          - 203 NON_AUTHORITATIVE_INFORMATION
          - 204 NO_CONTENT
          - 205 RESET_CONTENT
          - 206 PARTIAL_CONTENT
          - 207 MULTI_STATUS
          - 208 ALREADY_REPORTED
          - 226 IM_USED
          - 300 MULTIPLE_CHOICES
          - 301 MOVED_PERMANENTLY
          - 302 FOUND
          - 302 MOVED_TEMPORARILY
          - 303 SEE_OTHER
          - 304 NOT_MODIFIED
          - 305 USE_PROXY
          - 307 TEMPORARY_REDIRECT
          - 308 PERMANENT_REDIRECT
          - 400 BAD_REQUEST
          - 401 UNAUTHORIZED
          - 402 PAYMENT_REQUIRED
          - 403 FORBIDDEN
          - 404 NOT_FOUND
          - 405 METHOD_NOT_ALLOWED
          - 406 NOT_ACCEPTABLE
          - 407 PROXY_AUTHENTICATION_REQUIRED
          - 408 REQUEST_TIMEOUT
          - 409 CONFLICT
          - 410 GONE
          - 411 LENGTH_REQUIRED
          - 412 PRECONDITION_FAILED
          - 413 PAYLOAD_TOO_LARGE
          - 413 REQUEST_ENTITY_TOO_LARGE
          - 414 URI_TOO_LONG
          - 414 REQUEST_URI_TOO_LONG
          - 415 UNSUPPORTED_MEDIA_TYPE
          - 416 REQUESTED_RANGE_NOT_SATISFIABLE
          - 417 EXPECTATION_FAILED
          - 418 I_AM_A_TEAPOT
          - 419 INSUFFICIENT_SPACE_ON_RESOURCE
          - 420 METHOD_FAILURE
          - 421 DESTINATION_LOCKED
          - 422 UNPROCESSABLE_ENTITY
          - 423 LOCKED
          - 424 FAILED_DEPENDENCY
          - 425 TOO_EARLY
          - 426 UPGRADE_REQUIRED
          - 428 PRECONDITION_REQUIRED
          - 429 TOO_MANY_REQUESTS
          - 431 REQUEST_HEADER_FIELDS_TOO_LARGE
          - 451 UNAVAILABLE_FOR_LEGAL_REASONS
          - 500 INTERNAL_SERVER_ERROR
          - 501 NOT_IMPLEMENTED
          - 502 BAD_GATEWAY
          - 503 SERVICE_UNAVAILABLE
          - 504 GATEWAY_TIMEOUT
          - 505 HTTP_VERSION_NOT_SUPPORTED
          - 506 VARIANT_ALSO_NEGOTIATES
          - 507 INSUFFICIENT_STORAGE
          - 508 LOOP_DETECTED
          - 509 BANDWIDTH_LIMIT_EXCEEDED
          - 510 NOT_EXTENDED
          - 511 NETWORK_AUTHENTICATION_REQUIRED
          readOnly: true
        message:
          type: string
          description: A description of the error
          readOnly: true
        errorCode:
          type: string
          description: An optional code which may help support indicate the underlying cause of the error
          enum:
          - E1
          - E2
          - E3
          - E4
          - E5
          - E6
          - E7
          - E8
          - E9
          - E10
          - E11
          - E12
          - E13
          - E14
          - E15
          - E16
          - E17
          - E18
          - E19
          - E20
          - E22
          - E23
          - E24
          - E25
          - E26
          - E27
          - E28
          - E999
          readOnly: true
        errors:
          type: array
          description: A list of validation errors, when the HTTP status code is 422
          items:
            $ref: '#/components/schemas/ValidationError'
          readOnly: true
      title: ValidationErrors