Introduction - Cysmiq

Overview

The Cysmiq API provides programmatic access to your security data, enabling automation, custom integrations, and reporting workflows.

All API requests use the following base URL:

Base URL

https://app.cysmiq.com/api/v1

Endpoints include your workspace slug as a path parameter, for example:

Example endpoint

https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities

The API uses bearer token authentication. Include your API key in the Authorization header:

curl https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities \
  -H "Authorization: Bearer YOUR_API_KEY"

API keys require the vulnerabilities:read scope to access vulnerability endpoints. To create an API key, see Managing API keys.

API requests are rate limited to 60 requests per minute per API token. Exceeding this limit returns a 429 Too Many Requests response.

List endpoints support cursor-based pagination. Responses include a next_cursor field when more results are available:

Paginated response

{
  "items": [...],
  "next_cursor": "eyJpZCI6MTIzNH0"
}

Pass the cursor value to fetch the next page:

Next page request

curl "https://app.cysmiq.com/api/v1/{tenant_slug}/vulnerabilities?repo=org/repo&cursor=eyJpZCI6MTIzNH0" \
  -H "Authorization: Bearer YOUR_API_KEY"

The API returns standard HTTP status codes:

Status	Description
200	Success
401	Unauthorized - invalid or missing API key
403	Forbidden - insufficient permissions or scope
404	Not found - resource doesn’t exist
422	Validation error - invalid filter values
429	Too many requests - rate limit exceeded
500	Server error

Error responses include a message:

Error response

{
  "message": "Repository not found."
}

Validation errors include field-specific details:

Validation error

{
  "message": "The given data was invalid.",
  "errors": {
    "repo": ["The repo field is required."]
  }
}