Balbix

aid: balbix
name: Balbix
description: Balbix is a cyber risk and exposure management platform founded in 2015 in San Jose, California. The Balbix Security
  Cloud (Balbix D3) ingests telemetry from 70+ security and IT systems through pre-built connectors and sensors, unifies it
  into a single asset, application, vulnerability and software inventory model, and quantifies breach risk in dollar terms
  so security teams can prioritize remediation. The platform covers cyber asset attack surface management (CAASM), continuous
  threat exposure management (CTEM), AppSec risk, and cyber risk quantification (CRQ), and ships BIX, a natural-language AI
  assistant for security posture questions. Balbix exposes a read-only REST API (v1) for programmatic access to assets, vulnerabilities,
  misconfigurations, software inventory, applications and application artifacts. Balbix was acquired by SAFE Security in November
  2025; balbix.com now redirects to safe.security and the Balbix product documentation is published as the "Balbix Help" section
  of docs.safe.security.
url: https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/apis.yml
x-type: company
x-source: harvest:secondary-market
x-tier: profiled
x-tier-reason: enrichment-pipeline
x-successor:
  company: SAFE Security
  url: https://safe.security/
  event: acquisition
  date: '2025-11-18'
  note: balbix.com issues an HTTP 301 to https://safe.security/ (probed 2026-08-02). Balbix product docs live at https://docs.safe.security/
    under the "Balbix Help" section; the platform continues to operate on the balbix.net domain.
specificationVersion: '0.20'
created: '2026-08-02'
modified: '2026-08-02'
tags:
- Company
- Cybersecurity
- Security
- Risk Management
- Vulnerability Management
- Exposure Management
- Asset Management
- Cyber Asset Attack Surface Management
- Continuous Threat Exposure Management
- Cyber Risk Quantification
- Application Security
apis:
- aid: balbix:balbix-rest-api
  name: Balbix REST API
  description: 'Read-only REST API (v1) for programmatic access to Balbix Assets and their associated Vulnerabilities, Misconfigurations,
    Software Inventory, Applications and application Artifacts. Authentication is a two-part scheme: HTTP Basic credentials
    plus a customer key are exchanged at /apis/v1/gen_token for a 30-minute Authorization token, which is sent alongside a
    per-tenant Client-API-Key header on every call. Endpoints are served from a per-customer tenant host on the balbix.net
    domain. The API is read-only, reads from a replica database, supports 4 concurrent sessions per customer, and is documented
    as unsuitable for bulk export.'
  humanURL: https://docs.safe.security/balbixhelp/docs/balbix-rest-api-guide-v20
  baseURL: https://app.balbix.net/apis/v1
  x-base-url-template: https://{tenant}.balbix.net/apis/v1
  x-base-url-note: Balbix issues each customer a tenant-specific Base URL. The documentation uses https://rs005tra.balbix.net/apis/v1
    in its curl examples and https://rs002tra.balbix.net in in-app links. app.balbix.net is the Balbix-operated platform entry
    point (Okta-fronted).
  x-access: gated
  x-access-note: API credentials are issued per customer tenant by Balbix Engineering / Customer Success; self-service credential
    creation is documented as planned but not yet available.
  tags:
  - Assets
  - Vulnerabilities
  - Misconfigurations
  - Software Inventory
  - Applications
  - Security
  properties:
  - type: APIReference
    url: https://docs.safe.security/balbixhelp/docs/balbix-rest-api-guide-v20
  - type: Documentation
    url: https://docs.safe.security/balbixhelp/docs/balbix-rest-api-guide-v20
  - type: Authentication
    url: authentication/balbix-authentication.yml
  - type: Conventions
    url: conventions/balbix-conventions.yml
  - type: RateLimits
    url: rate-limits/balbix-rate-limits.yml
  - type: DataModel
    url: data-model/balbix-data-model.yml
  x-evidence:
    fetched: '2026-08-02'
    url: https://docs.safe.security/balbixhelp/docs/balbix-rest-api-guide-v20.md
    http_status: 200
    content_type: text/markdown
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- type: Website
  url: https://safe.security/
- type: LegacyWebsite
  url: https://www.balbix.com/
- type: DeveloperPortal
  url: https://docs.safe.security/
- type: Documentation
  url: https://docs.safe.security/balbixhelp/docs/dashboard-overview
- type: APIReference
  url: https://docs.safe.security/balbixhelp/docs/balbix-rest-api-guide-v20
- type: GettingStarted
  url: https://docs.safe.security/balbixhelp/docs/implementing-the-ctem-cycle-with-balbix
- type: Support
  url: https://docs.safe.security/balbixhelp/docs/support.md
- type: HelpCenter
  url: https://support.balbix.com/hc/en-us
- type: Login
  url: https://app.balbix.net/
- type: Blog
  url: https://safe.security/resources/blog/
- type: TermsOfService
  url: https://safe.security/terms-of-service/
- type: PrivacyPolicy
  url: https://safe.security/privacy-policy/
- type: Security
  url: https://safe.security/security/
- type: Compliance
  url: https://safe.security/security/
- type: TrustCenter
  url: security/balbix-trust-center.yml
- type: VulnerabilityDisclosure
  url: security/balbix-vulnerability-disclosure.yml
- type: DomainSecurity
  url: security/balbix-domain-security.yml
- type: Authentication
  url: authentication/balbix-authentication.yml
- type: OAuthScopes
  url: scopes/balbix-scopes.yml
- type: WellKnown
  url: well-known/balbix-well-known.yml
- type: Conventions
  url: conventions/balbix-conventions.yml
- type: RateLimits
  url: rate-limits/balbix-rate-limits.yml
- type: DataModel
  url: data-model/balbix-data-model.yml
- type: Lifecycle
  url: lifecycle/balbix-lifecycle.yml
- type: ChangeLog
  url: changelog/balbix-changelog.yml
- type: Conformance
  url: conformance/balbix-conformance.yml
- type: Integrations
  url: integrations/_index.yml
- type: LLMsTxt
  url: llms/balbix-llms.txt
x-enrichment:
  date: '2026-08-02'
  status: enriched
  artifacts_added: 16
  pass: local-v1
  not_published:
    note: Probed and confirmed ABSENT on 2026-08-02 — recorded here so a later pass does not re-litigate them, and so no pointer
      is emitted for something that does not exist.
    openapi: No OpenAPI/Swagger on www.balbix.com, balbix.net, app.balbix.net or docs.safe.security (/openapi.json, /openapi.yaml,
      /swagger.json, /api-docs, /v1/openapi.json all 404/502/auth-redirect).
    graphql: none
    mcp_server: none
    agent_card: /.well-known/agent-card.json and /.well-known/agent.json return 404 on every host probed — no a2a/ artifact
      written, by contract.
    asyncapi_or_webhooks: no outbound event or webhook surface published
    packages_sdks: no first-party client library on npm, PyPI, RubyGems or crates.io
    cli: none
    sandbox: none
    status_page: none (status.balbix.com and status.safe.security do not resolve; safesecurity.statuspage.io is inactive)
    deprecation_policy: none published
    security_txt: none on any host
    idempotency: not applicable — the REST API is documented as read-only
    errors: no error catalogue, status-code table or error envelope is published
    github_org: github.com/balbix exists but has 0 public repositories