A bearer-token public API covering assets, scans, findings, and reports. Per-scope access tokens, documented rate limits, and HMAC-signed webhook callbacks for fanout. Audit-log and gateway-events read APIs are on the roadmap; webhook callbacks already deliver gateway.block and finding.created today.
Six properties a caller can rely on. Read and write are separate scopes on every resource, and anything that starts a worker job carries both a rate cap and a queue-depth cap.
Per-scope bearer tokens minted in the security settings page. Token format pnxt_live_ plus thirty-two base62 characters; only the SHA-256 hash lives in the database. Revoke at any time; the next request is rejected within milliseconds.
endpoints:read, endpoints:write, scans:read, scans:write, findings:read, findings:write, reports:read. audit:read ships with the planned audit-log read API. Each scope is independently grantable; tokens carry only the scopes the operator selects.
Standard tenants receive 60 requests per minute per token with a burst allowance of 120. Enterprise contracts may negotiate higher limits. Limits are published in response headers (X-RateLimit-Remaining, X-RateLimit-Reset).
Path-prefixed (/api/v2). Breaking changes ship under a new major prefix; old majors receive deprecation notices in the X-Penaxtra-Deprecation header six months before sunset.
Outbound HMAC-signed callbacks on finding.created, scan.completed, gateway.block, and report.ready. SSRF-guarded URL validation; retry with exponential backoff to a dead-letter queue.
Every API call is recorded against the calling token in the append-only audit log. Token usage report available to owner and admin roles.
OpenAPI 3.1 specification, code samples in curl and Python, and example payloads for every endpoint.
Headless ingestion of findings into your GRC platform, automated remediation tickets, or a custom dashboard for the model-risk committee. The API covers it.