Every API here is available over the APIs.io API and to AI agents over MCP.
---
openapi: 3.0.0
info:
title: Secureframe API
description: |
## Introduction
[Secureframe](https://secureframe.com/) exposes a REST API for use by customers, partners, and community developers.
The Secureframe API utilizes [resource-oriented endpoints](https://cloud.google.com/apis/design/resources) and returns requests in the form of standard JSON responses, based on the [JSON API spec](https://jsonapi.org/). Search utilizes [Lucene Syntax](https://lucene.apache.org/core/2_9_4/queryparsersyntax.html).
API URL (latest version): https://api.secureframe.com
New to Secureframe?\
Customers: [Start here](https://secureframe.com/request-demo)\
Partners: [Start here](https://secureframe.com/contact/partner)
### MCP Documentation
Looking for MCP documentation? [Start here](https://mcp.secureframe.com/mcp_docs)
## Authentication
Secureframe utilizes API keys to authenticate requests. API keys are assigned on a per company <> user basis. API secrets can only be viewed a single time at key creation. Please securely store your secrets and do not share your keys in a public medium. If you forget your secret, you must generate a new API key.
To view, create, and revoke API keys, navigate to the Secureframe Console -> Your Profile -> Company settings -> API keys. This page is protected by RBAC and only accessible by certain roles.
To authenticate with an API Key and Secret, include the header `'Authorization: <YOUR_API_KEY> <YOUR_KEY_SECRET>'` in your request.
```
--header 'Authorization: <YOUR_API_KEY> <YOUR_SECRET_KEY>'
```
Requests made via HTTP will be redirected to HTTPS.
## Authorization
Secureframe utilizes role-based access control (RBAC) to determine which requests are authorized based on the assigned company <> user.
As an example, let’s say a user is assigned to a custom role called “Risk Manager”, and that role does not have permission to view Tests. If a request is made to a Tests endpoint with an API Key <> Secret pair assigned to that user, the request will fail.
To determine the permissions of each role, navigate to the Secureframe Console -> Personnel -> Personnel settings -> Roles and click into the applicable role.
## Creating a Request
Reference the below template in `cURL` for creating a request with parameters:
```bash
curl --location -g --request GET \
--header 'Authorization: <YOUR_API_KEY> <YOUR_SECRET_KEY>' \
'https://api.secureframe.com/<ENDPOINT>?include[<PARAM>]=<VALUE>
```
Note: Our API does not directly support bulk updates - only one object can be updated per request. That said, you can utilize loops to mimic bulk operations.
## Request History
API requests, just like console-based requests, are tracked in the Audit Log (note: API vs Console requests are not differentiated visually).
To access the Audit Log, navigate to the Secureframe Console -> Your Profile -> Company settings -> Audit Log. This page is protected by RBAC and only accessible by certain roles.
## Rate Limiting
Requests are limited to 500 requests per minute per IP address. If the limit is exceeded, requests will be blocked until requests are available based on the aforementioned limit.
## Errors
| HTTP Status Code | Description |
| ----------------------- | ------------------------------------------------------------------------------------- |
| 200 - OK | Request successful |
| 400 - Bad Request | Invalid request |
| 401 - Unauthorized | Invalid authentication to make requested response. API key and/or secret are invalid. |
| 403 - Forbidden | Invalid authorization to requested resource. Insufficient permissions based on RBAC. |
| 429 - Too Many Requests | Rate limit of 500 requests per minute has been reached for the IP address. |
| 500 | Internal server error |
## Versioning
Secureframe makes many additive API changes that are _backwards compatible_ and able to be supported in all API versions:
- Adding operations
- Adding optional parameters
- Adding optional request headers
- Adding response attributes
- Adding response headers
Backwards _incompatible_ changes require Secureframe to release a new dated API version, as the can potentially break an integration:
- Removing operations
- Removing, renaming, or changing the type of a parameter
- Adding a required parameter or making a previously optional parameter now required
- Removing attributes from request responses
- Adding a required header
- Introducing new parameter data validation constraints
- Updating authentication and authorization mechanisms
| Dated Version (Release Date) | API URL | Deprecation Date |
| :--------------------------- | :--------------------------- | :--------------- |
| 2023-10-18 | https://api.secureframe.com/ | - |
## API Changelog
### 2023-10-18
- Released API Dated Version 2023-10-18
- Initial release.
version: '2023-10-18'
x-logo:
url: https://media.secureframe.com/logo-dark.svg
servers:
- url: https://api.secureframe.com
- url: https://api-uk.secureframe.com
paths:
"/cloud_resources/{cloud_resource_id}/framework_asset_scopes":
get:
tags:
- Cloud Resource Framework Asset Scope
operationId: cloudResourcesCompanyFrameworkAssetScopesIndex
parameters:
- name: cloud_resource_id
description: Scope response to cloud_resource_id
required: true
in: path
schema:
type: string
- name: include
description: Comma delimited string of relationships to include.
required: false
in: query
schema:
type: array
items:
type: string
enum:
- manually_scoped_by
explode: false
style: form
- name: page
description: 'Used for pagination of response data (default: page 1). Specifies
the offset of the next block of data to receive.'
required: false
in: query
schema:
type: integer
- name: per_page
description: 'Used for pagination of response data (default: 100 items per
response). Specifies the number of results for a given page.'
required: false
in: query
schema:
type: integer
- name: relationships
description: 'Set to true to return the associated relationships data within
the response. (default: false)'
required: false
in: query
schema:
type: boolean
responses:
default:
description: ''
content:
application/json:
schema:
type: object
properties:
data:
type: array
description: List of resources matching the query
items:
type: object
description: Data envelope for the response
properties:
id:
type: string
format: uuid
description: The identifier for this resource
type:
type: string
description: The type of resource this object is
attributes:
"$ref": "#/components/schemas/FrameworkAssetScope"
relationships:
type: object
description: Nested objects related to the top level object
links:
type: object
description: Links to related API resources
meta:
type: object
description: Metadata about the list response
properties:
total:
type: integer
description: Total number of records matching the query across
all pages, independent of page and per_page
included:
type: array
items:
type: object
description: Various objects that have been included via the
`include` param
properties:
id:
type: string
format: uuid
description: The identifier for this resource
'403':
description: Forbidden
'401':
description: Unauthorized
'400':
description: Bad Request
description: |-
Returns a list of Framework Asset Scopes for the Cloud Resource by ID
The absence of a Framework Asset Scope indicates the asset is not in scope for the Framework.
summary: List Framework Asset Scopes
security:
- header_authorization: &1 []
x-controller: api/cloud_resources/company_framework_asset_scopes
x-action: index
post:
tags:
- Cloud Resource Framework Asset Scope
operationId: cloudResourcesCompanyFrameworkAssetScopesCreate
parameters:
- name: active
description: Flag to indicate if this Framework Asset Scope is active.
required: false
in: query
schema:
type: boolean
- name: cloud_resource_id
description: Scope response to cloud_resource_id
required: true
in: path
schema:
type: string
- name: framework_id
description: The ID of the Framework assigned to this Framework Asset Scope.
required: false
in: query
schema:
type: string
format: uuid
- name: manually_scoped_reason
description: Reason if this Framework Asset Scope is manually scoped.
required: false
in: query
schema:
type: string
responses:
default:
description: ''
content:
application/json:
schema:
type: object
properties:
data:
type: array
description: List of resources matching the query
items:
type: object
description: Data envelope for the response
properties:
id:
type: string
format: uuid
description: The identifier for this resource
type:
type: string
description: The type of resource this object is
attributes:
"$ref": "#/components/schemas/FrameworkAssetScope"
relationships:
type: object
description: Nested objects related to the top level object
links:
type: object
description: Links to related API resources
meta:
type: object
description: Metadata about the list response
properties:
total:
type: integer
description: Total number of records matching the query across
all pages, independent of page and per_page
included:
type: array
items:
type: object
description: Various objects that have been included via the
`include` param
properties:
id:
type: string
format: uuid
description: The identifier for this resource
'404':
description: Resource not found
'403':
description: Forbidden
'401':
description: Unauthorized
'400':
description: Bad Request
description: Create a Framework Asset Scope for the Cloud Resource by ID
summary: Create Framework Asset Scope
security:
- header_authorization: *1
x-controller: api/cloud_resources/company_framework_asset_scopes
x-action: create
"/cloud_resources":
get:
tags:
- Cloud Resource
operationId: cloudResourcesIndex
parameters:
- name: include
description: 'Comma delimited string of relationships to include. Note: company_vendor_connection
is deprecated, please use integration_connection instead.'
required: false
in: query
schema:
type: array
items:
type: string
enum:
- company_vendor_connection
- integration_connection
- owner
explode: false
style: form
- name: page
description: 'Used for pagination of response data (default: page 1). Specifies
the offset of the next block of data to receive.'
required: false
in: query
schema:
type: integer
- name: per_page
description: 'Used for pagination of response data (default: 100 items per
response). Specifies the number of results for a given page.'
required: false
in: query
schema:
type: integer
- name: q
description: Search and filter the Cloud Resource data using Lucene syntax.
required: false
in: query
schema:
type: string
- name: relationships
description: 'Set to true to return the associated relationships data within
the response. (default: false)'
required: false
in: query
schema:
type: boolean
- name: sort
description: 'Comma delimited string of fields to sort the results by, applied
in the order given. Prefix a field with `-` to sort it in descending order,
for example `?sort=-cloud_resource_type,created_at`. Sortable fields: `cloud_resource_type`,
`created_at`, `id`, `in_audit_scope`, `region`, `third_party_id`, `updated_at`,
`vendor_name`.'
required: false
in: query
schema:
type: string
responses:
default:
description: ''
content:
application/json:
schema:
type: object
properties:
data:
type: array
description: List of resources matching the query
items:
type: object
description: Data envelope for the response
properties:
id:
type: string
format: uuid
description: The identifier for this resource
type:
type: string
description: The type of resource this object is
attributes:
"$ref": "#/components/schemas/CloudResource"
relationships:
type: object
description: Nested objects related to the top level object
links:
type: object
description: Links to related API resources
meta:
type: object
description: Metadata about the list response
properties:
total:
type: integer
description: Total number of records matching the query across
all pages, independent of page and per_page
included:
type: array
items:
type: object
description: Various objects that have been included via the
`include` param
properties:
id:
type: string
format: uuid
description: The identifier for this resource
'403':
description: Forbidden
'401':
description: Unauthorized
'400':
description: Bad Request
description: |
Returns a list of Cloud Resources.
### Search parameters
- `cloud_resource_type` — The type of this Cloud Resource
- Valid values: `account`, `acm_certificate`, `alert`, `analytics`, `api_management_service`, `app_gateway`, `app_workflow`, `athena_workgroup`, `audit_config_all_services`, `authentication_policy`, `authorization_role_assignment`, `autoscaling_group`, `batch_account`, `cdn`, `certificate`, `check_point_quantum_access_layer`, `check_point_quantum_access_role`, `check_point_quantum_access_rulebase`, `check_point_quantum_access_rule`, `check_point_quantum_host`, `check_point_quantum_https_layer`, `check_point_quantum_https_rulebase`, `check_point_quantum_ips_status`, `check_point_quantum_nat_rulebase`, `check_point_quantum_network`, `check_point_quantum_tcp_service`, `check_point_quantum_threat_indicator`, `check_point_quantum_udp_service`, `cloudfront_distribution`, `cloudtrail`, `cloudwatchlogs_log_group`, `cluster`, `cluster_node_pool`, `compute_backend_service`, `compute_disk`, `compute_instance`, `compute_network`, `compute_subnetwork`, `compute_target_http_proxy_list`, `compute_url_map`, `configservice_recorder`, `container_cluster`, `container_registry`, `crypto_key`, `data_collection_rule`, `data_collection_rule_association`, `database`, `database_backup`, `database_firewall_rule`, `database_replica`, `datadog_dashboard`, `datadog_monitor`, `datalake_analytics`, `datalake_storage`, `desktop_virtualization_application_group`, `desktop_virtualization_host_pool`, `desktop_virtualization_workspace`, `dms_instance`, `diagnostic_setting`, `dns_managed_zone`, `docker_image`, `domain`, `domain_record`, `droplet`, `droplet_neighbor`, `dynamodb_table`, `ec2_image`, `ec2_instance`, `ec2_security_group`, `ec2_snapshot`, `ec2_subnet`, `ec2_volume`, `ec2_vpc`, `ec2_vpc_peering_connections`, `ecr_repository`, `efs_filesystem`, `eks_cluster`, `elasticloadbalancing`, `elb`, `elbv2`, `elbv2_listener`, `es_domain`, `event_hub`, `firehose_stream`, `firewall`, `floating_ip`, `fsx_file_system`, `glacier_vault`, `guardduty_detector`, `heroku_addon`, `heroku_app`, `iam_certificate`, `iam_group`, `iam_mfa_device`, `iam_password_policy`, `iam_role`, `iam_user`, `iam_account`, `iam_credential_report`, `image`, `iot`, `key`, `key_vault`, `keyring`, `kinesis_stream`, `kms_key`, `lambda_function`, `load_balancer`, `log_alert`, `log_profile`, `metric`, `microsoft_compute_virtualmachines`, `microsoft_compute_virtualmachines_scaleset`, `microsoft_container_images`, `microsoft_dbformysql_servers`, `microsoft_dbforpostgresql_servers`, `microsoft_sentinel_alert_rule`, `microsoft_sentinel_content_package`, `microsoft_sentinel_data_connector`, `microsoft_sentinel_incident`, `microsoft_sentinel_threat_indicator`, `microsoft_sql_servers`, `microsoft_sql_servers_blob_auditing_policy`, `microsoft_sql_servers_databases`, `microsoft_storage_storageaccounts`, `monitor_action_group`, `monitoring_alert_policy`, `monitor_scheduled_query_rule`, `nat_gateway`, `network_interface`, `network_load_balancer`, `network_policy`, `network_watcher`, `operational_insights_workspace`, `organizations_account`, `password_policy`, `policy_assignment`, `project`, `project_resource`, `public_ip_address`, `rds_cluster`, `rds_instance`, `rds_snapshot`, `redis_service`, `resourcemanager_project`, `redshift`, `region`, `registry`, `registry_repository`, `route53domain`, `route_table`, `s3_bucket`, `sagemaker_notebook`, `search_service`, `security_auto_provisioning_setting`, `security_contact`, `security_pricing`, `security_group`, `servicebus`, `service_account`, `ses_dkim`, `ses_ruleset`, `snapshot`, `sns_topic`, `space`, `space_cor`, `sql_instance`, `sqs_queue`, `ssl_proxy`, `ssm_instance`, `ssm_parameter`, `storage_bucket`, `storage_container`, `storage_volume`, `subscription`, `transfer_server`, `virtual_machine_extension`, `virtual_network`, `vpc`, `vpc_member`, `web_app_service`, `xray_encryption_config`
- `created_at` — The date this Cloud Resource was created
- `id` — The ID of the Cloud Resource
- `in_audit_scope` — Flag to indicate if this Cloud Resource is in scope. [DEPRECATED - Use the Cloud Resource Framework Asset Scope [endpoint](/tag/Cloud-Resource-Framework-Asset-Scope#operation/cloudResourcesCompanyFrameworkAssetScopesIndex)]
- Valid values: `true`, `false`
- `region` — The region this Cloud Resource belongs to
- `third_party_id` — The identifier for this Cloud Resource on the vendor side
- `updated_at` — The date this Cloud Resource was last updated
- `vendor_name` — The name of the vendor that this Cloud Resource is from
summary: List Cloud Resources
security:
- header_authorization: &2 []
x-controller: api/cloud_resources
x-action: index
"/cloud_resources/{id}":
get:
tags:
- Cloud Resource
operationId: cloudResourcesShow
parameters:
- name: id
description: Scope response to id
required: true
in: path
schema:
type: string
- name: include
description: 'Comma delimited string of relationships to include. Note: company_vendor_connection
is deprecated, please use integration_connection instead.'
required: false
in: query
schema:
type: array
items:
type: string
enum:
- company_vendor_connection
- integration_connection
- owner
explode: false
style: form
- name: relationships
description: 'Set to true to return the associated relationships data within
the response. (default: false)'
required: false
in: query
schema:
type: boolean
responses:
default:
description: ''
content:
application/json:
schema:
type: object
properties:
data:
type: object
description: Data envelope for the response
properties:
id:
type: string
format: uuid
description: The identifier for this resource
type:
type: string
description: The type of resource this object is
attributes:
"$ref": "#/components/schemas/CloudResource"
relationships:
type: object
description: Nested objects related to the top level object
links:
type: object
description: Links to related API resources
included:
type: array
items:
type: object
description: Various objects that have been included via the
`include` param
properties:
id:
type: string
format: uuid
description: The identifier for this resource
'404':
description: Resource not found
'403':
description: Forbidden
'401':
description: Unauthorized
'400':
description: Bad Request
description: Returns a single Cloud Resource by ID
summary: Get a Cloud Resource
security:
- header_authorization: *2
x-controller: api/cloud_resources
x-action: show
put:
tags:
- Cloud Resource
operationId: cloudResourcesUpdate
parameters:
- name: id
description: Scope response to id
required: true
in: path
schema:
type: string
- name: in_audit_scope
description: Flag to indicate if this Cloud Resource is in scope. [DEPRECATED
- Use the Cloud Resource Framework Asset Scope [endpoint](/tag/Cloud-Resource-Framework-Asset-Scope#operation/cloudResourcesCompanyFrameworkAssetScopesCreate)]
required: false
in: query
schema:
type: boolean
- name: out_of_audit_scope_reason
description: Out of scope reason if the Cloud Resource is not in scope. [DEPRECATED
- Use the Cloud Resource Framework Asset Scope [endpoint](/tag/Cloud-Resource-Framework-Asset-Scope#operation/cloudResourcesCompanyFrameworkAssetScopesCreate)]
required: false
in: query
schema:
type: string
enum:
- development_asset
- staging_asset
- out_of_scope_production_asset
- name: owner_id
description: ID of the User that's the owner of this Cloud Resource.
required: false
in: query
schema:
type: string
format: uuid
responses:
default:
description: ''
content:
application/json:
schema:
type: object
properties:
data:
type: object
description: Data envelope for the response
properties:
id:
type: string
format: uuid
description: The identifier for this resource
type:
type: string
description: The type of resource this object is
attributes:
"$ref": "#/components/schemas/CloudResource"
relationships:
type: object
description: Nested objects related to the top level object
links:
type: object
description: Links to related API resources
included:
type: array
items:
type: object
description: Various objects that have been included via the
`include` param
properties:
id:
type: string
format: uuid
description: The identifier for this resource
'404':
description: Resource not found
'403':
description: Forbidden
'401':
description: Unauthorized
'400':
description: Bad Request
description: Update a Cloud Resource by ID
summary: Update a Cloud Resource
security:
- header_authorization: *2
x-controller: api/cloud_resources
x-action: update
"/comments":
get:
tags:
- Comment
operationId: commentsIndex
parameters:
- name: include
description: Comma delimited string of relationships to include.
required: false
in: query
schema:
type: array
items:
type: string
enum:
- author
explode: false
style: form
- name: page
description: 'Used for pagination of response data (default: page 1). Specifies
the offset of the next block of data to receive.'
required: false
in: query
schema:
type: integer
- name: per_page
description: 'Used for pagination of response data (default: 100 items per
response). Specifies the number of results for a given page.'
required: false
in: query
schema:
type: integer
- name: q
description: Search and filter the Comment data using Lucene syntax.
required: false
in: query
schema:
type: string
- name: relationships
description: 'Set to true to return the associated relationships data within
the response. (default: false)'
required: false
in: query
schema:
type: boolean
- name: sort
description: 'Comma delimited string of fields to sort the results by, applied
in the order given. Prefix a field with `-` to sort it in descending order,
for example `?sort=-commentable_type,commentable_id`. Sortable fields: `commentable_type`,
`commentable_id`, `company_id`, `content`, `id`.'
required: false
in: query
schema:
type: string
responses:
default:
description: ''
content:
application/json:
schema:
type: object
properties:
data:
type: array
description: List of resources matching the query
items:
type: object
description: Data envelope for the response
properties:
id:
type: string
format: uuid
description: The identifier for this resource
type:
type: string
description: The type of resource this object is
attributes:
"$ref": "#/components/schemas/Comment"
relationships:
type: object
description: Nested objects related to the top level object
links:
type: object
description: Links to related API resources
meta:
type: object
description: Metadata about the list response
properties:
total:
type: integer
description: Total number of records matching the query across
all pages, independent of page and per_page
included:
type: array
items:
type: object
description: Various objects that have been included via the
`include` param
properties:
id:
type: string
format: uuid
description: The identifier for this resource
'403':
description: Forbidden
'401':
description: Unauthorized
'400':
description: Bad Request
description: |
Returns a list of Comments.
### Search parameters
- `commentable_type` — The type of the commentable object
- Valid values: `Company`, `CompanyAudit`, `CompanyAuditTest`, `CompanyControlV2`, `CompanyFrameworkRequirement`, `CompanyTest`, `CompanyRisk`, `Evidence`, `PoamItem`, `CompanySspReportAssessmentObjective`, `CompanySspReportRequirement`, `Policy`, `VendorRiskDetail`, `VendorRiskReviewItem`, `VendorRiskDocument`, `VendorRiskReviewAnswer`
- `comm
# --- truncated at 32 KB (471 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/secureframe/refs/heads/main/openapi/secureframe-public-api-openapi.yml