API

API Reference

A first-party control plane for findings, scans, and source connect. It does not proxy your database or run ad-hoc SQL.

REST API

Scoped keys and HMAC v2

Mint a key from Settings. Every /api/v1 call needs the bearer token plus HMAC v2 headers. Bearer-only access is not accepted.

Privileged source credentials can be submitted when the key has sources:privileged and the privileged connections flag is on. A standing API key is not the same as step-up MFA.

Base URL: https://secure.raven/api/v1
Authentication: Bearer + HMAC v2
Rate limit: 60 requests/minute per key
Contract: JSON, minimum-necessary fields
Example Request
curl -X GET \
  "https://secure.raven/api/v1/findings" \
  -H "Authorization: Bearer sr_live_..." \
  -H "x-raven-timestamp: 1770000000" \
  -H "x-raven-nonce: ..." \
  -H "x-raven-token-id: ..." \
  -H "x-raven-signature: ..."
Shipped

Routes that exist today

Controls, evidence, missions, webhooks, and language SDKs are not part of v1.

Systems

List tenant systems and create new inventory records. Tenant is taken from the API key, never from the body.

GET /api/v1/systems

Sources

Draft a source, accept risk, submit a credential once, test, authorize a scan, or disconnect. Not a SQL proxy.

POST /api/v1/sources

Findings

Read titles, severity, status, and remediation. Finding details that may contain key previews are omitted.

GET /api/v1/findings

Scans

Read session verdicts and enqueue safe_all_surfaces scans. API keys cannot start Full Active.

POST /api/v1/scans

Ingest

Probes push allowlisted events to the existing Edge ingest function. HMAC v2. Probe keys stay bound to one system.

POST /functions/v1/events-ingest

Get your API key and start building

Create an account, mint a scoped key, and keep the HMAC secret with the token id.

Get API KeyRead the contract