How to call the API
All paths below are relative to your tenant base URL — one host for the whole API. Client tooling reads it from RELIXQ_API_BASE_URL. Endpoints are grouped below by what they do, not by how the service is built internally.
- JWT bearer token
Authorization: Bearer <access_token>. Tokens are validated against the auth service published JWKS atGET /auth/.well-known/jwks.json. Obtain them viaPOST /auth/login, the OIDC and SAML flows, or the device-code flow used by the CLI.- API keys
- For long-lived programmatic access — CI, scripts, service accounts. Create and manage them under
/api/v1/api-keysand present them as bearer credentials. The full key is shown once at creation; only a hash is stored. - Revocation
- Enforced through a JTI blacklist. A revoked token or key is rejected immediately, even before its expiry.
- Tenancy
- The API design scopes every request to the active organization carried in the token and uses PostgreSQL row-level security as a database boundary. Switch the active organization with
POST /api/v1/me/orgs/{orgId}/switch. Production control-verification status is published separately in the Trust Center.
Identity, organizations and API keys
| Method | Path | Purpose |
|---|---|---|
| POST | /auth/signup | Create an account with email and password |
| POST | /auth/verify-email[/resend] | Verify an email address; resend the verification email |
| POST | /auth/login | Sign in; returns access and refresh tokens |
| POST | /auth/refresh | Exchange a refresh token for a new access token |
| POST | /auth/logout | End the session and blacklist the token JTI |
| POST | /auth/password/forgot|reset|change | Password reset and change flows |
| POST | /auth/email/change[/confirm] | Two-step email-address change |
| GET | /auth/login | Begin an OIDC SSO login (browser redirect) |
| GET | /auth/callback | OIDC redirect callback |
| GET | /auth/.well-known/jwks.json | Public signing keys for token verification |
| POST | /auth/device/code|approve|token | The device-code flow used by the CLI |
| GET/POST | /auth/saml/{orgSlug}/sso|acs | SP-initiated SAML SSO and assertion consumer |
| POST | /auth/mfa/totp/setup|verify | Enroll and verify a TOTP authenticator |
| POST | /auth/mfa/webauthn/assertion|verify | WebAuthn assertion begin and verify |
| GET/POST/PUT/PATCH/DELETE | /scim/v2/Users[/{id}] | SCIM 2.0 provisioning from your identity provider |
| POST/GET/DELETE | /api/v1/api-keys[/{id}] | Create, list, and revoke API keys |
| GET/POST | /api/v1/me/orgs[/{orgId}/switch] | List your organizations; switch active context |
| POST | /api/v1/orgs | Create an organization |
| GET/PATCH/DELETE | /api/v1/orgs/{orgId}/members[/{userId}] | List members, change a role, remove a member |
| POST | /api/v1/orgs/{orgId}/transfer-ownership | Transfer organization ownership |
| POST/GET/DELETE | /api/v1/orgs/{orgId}/invitations[/{id}] | Invite, list, and revoke invitations |
| GET/POST | /api/v1/invitations/{token}[/accept] | Preview and accept an invitation |
Projects, services and repositories
| Method | Path | Purpose |
|---|---|---|
| POST/GET | /api/v1/projects | Create a project; list projects in the active org |
| GET/PATCH | /api/v1/projects/{id} | Project detail; update project settings |
| POST | /api/v1/projects/{id}/archive|delete|restore | Archive, soft-delete, and restore a project |
| GET | /api/v1/projects/{id}/audit | Project audit trail |
| GET | /api/v1/orgs/{orgSlug}/projects[/{slug}] | URL-friendly addressing by org and project slug |
| GET/POST | /api/v1/projects/{projectId}/applications | List and create applications |
| PATCH/DELETE | /api/v1/applications/{appId} | Update and delete an application |
| GET/POST | /api/v1/applications/{appId}/services | List and create services |
| PATCH/DELETE | /api/v1/services/{serviceId} | Update and delete a service |
| GET/POST/DELETE | /api/v1/projects/{projectId}/repositories | Manage repository connections |
| GET/POST/PATCH/DELETE | /api/v1/projects/{projectId}/members | Manage project membership and roles |
| GET/POST | /api/v1/projects/{projectId}/services/{serviceId}/data-assets | List and declare data assets a service handles — feeds QAST classification |
| GET/POST/PATCH/DELETE | /api/v1/projects/{projectId}/saved-views | Manage saved finding views |
Scans and schedules
| Method | Path | Purpose |
|---|---|---|
| POST/GET | /api/v1/scans | Start a scan run; list scan runs |
| GET | /api/v1/scans/{id} | Scan run detail with per-job status |
| POST | /api/v1/scans/{id}/cancel | Cancel a running scan |
| POST | /api/v1/scans/{id}/retry-failed | Retry only the failed jobs of a run |
| GET | /api/v1/scans/{id}/events | Live progress stream (Server-Sent Events) |
| GET/PUT | /api/v1/projects/{projectId}/schedules | Read and set the recurring scan schedule |
Findings, scores, inventory and CBOM
| Method | Path | Purpose |
|---|---|---|
| GET | /api/v1/scores/projects/{projectId} | Project risk score summary |
| GET | /api/v1/scores/projects/{projectId}/relixq | Project RelixQ Score with its explanation envelope |
| GET | /api/v1/scores/projects/{projectId}/agility | Crypto-agility scorecard |
| GET | /api/v1/scores/projects/{projectId}/trend | Score trend over time |
| GET | /api/v1/scores/projects/{projectId}/pr/{prNumber} | PR-scoped score delta |
| GET | /api/v1/scores/services/{serviceId}[/relixq] | Service risk score and RelixQ Score |
| GET | /api/v1/scores/applications/{applicationId}/relixq | Application RelixQ Score |
| GET | /api/v1/scores/organizations/{organizationId}/relixq | Organization RelixQ Score |
| GET | /api/v1/projects/{projectId}/findings | List findings (filterable) |
| GET | /api/v1/projects/{projectId}/findings/aggregate | Aggregates by severity, algorithm, language, service, or PQC readiness |
| GET | /api/v1/findings | Cross-project finding search, org-scoped |
| GET/PATCH | /api/v1/findings/{id} | Finding detail; update triage status |
| GET | /api/v1/projects/{projectId}/cbom | Export the Cryptographic Bill of Materials |
| GET | /api/v1/projects/{projectId}/assets[/{assetId}] | List crypto assets; asset detail |
| GET | /api/v1/projects/{projectId}/assets/{assetId}/evidence|findings | Evidence ledger and linked findings |
| POST | /api/v1/projects/{projectId}/assets/ingest | Ingest an externally produced asset inventory |
| GET | /api/v1/projects/{projectId}/tls/endpoints | Honest-empty. TLS endpoint posture |
| GET | /api/v1/projects/{projectId}/tls/certificates | Honest-empty. Certificate inventory |
Blast radius, attack paths and simulation
| Method | Path | Purpose |
|---|---|---|
| GET | /api/v1/projects/{projectId}/graph/services/{sid} | Graph neighbourhood of a service |
| GET | /api/v1/projects/{projectId}/graph/findings/{fid}/blast-radius | Transitive impact of a finding |
| GET | /api/v1/projects/{projectId}/graph/exposure-paths | Paths from public exposure to vulnerable cryptography |
| GET | /api/v1/projects/{projectId}/graph/attack-paths | Projected quantum-attack paths |
| GET | /api/v1/projects/{projectId}/graph/hndl-exposures | Harvest-now-decrypt-later exposure query |
| GET | /api/v1/projects/{projectId}/graph/recommendations | Migration-order recommendations |
| GET | /api/v1/projects/{projectId}/graph/viz | Graph payload shaped for visualization |
| POST | /api/v1/projects/{projectId}/graph/simulate | What-if migration simulation |
Quantum exposure assessment (QAST)
| Method | Path | Purpose |
|---|---|---|
| POST/GET | /api/v1/projects/{projectId}/pentest/roe[/{id}] | Record and read signed Rules of Engagement |
| POST/GET | /api/v1/projects/{projectId}/pentest/runs[/{id}] | Start a run; run detail and status |
| POST | .../pentest/runs/{id}/halt|retest | Emergency-halt a run; launch a retest |
| POST/GET | .../pentest/runs/{id}/probe-results | Submit and list probe results |
| GET | .../pentest/runs/{id}/audit | Run audit trail — who consented, what was probed |
| GET | .../pentest/runs/{id}/exposures|attack-paths|break-proofs | Classifications, projections, and proofs from the run |
| GET | .../pentest/runs/{id}/report[/download] | Run report and file download |
| POST/GET | /api/v1/projects/{projectId}/pentest/gates | Evaluate and list gate decisions |
| GET/POST | /api/v1/projects/{projectId}/pentest/data-assets | List and declare HNDL-relevant data assets |
| POST/GET | /api/v1/projects/{projectId}/reports[/{id}][/download] | Generate, list, read, and download assessment reports |
| GET/POST | /api/v1/projects/{projectId}/pentest/lab/pqc | Honest-empty. List and ingest PQC lab results |
| POST | /api/v1/projects/{projectId}/pentest/remediation/from-findings | Create remediation items from findings |
| GET | /api/v1/pentest/remediation | List remediation items, org-scoped |
| POST | /api/v1/pentest/remediation/{id}/{transition} | Lifecycle transitions: assign, in-progress, waiting-vendor, fix, verify, request-exception, approve-exception, accept-risk, reopen |
AI, egress, runtime and GitHub
| What you want to do | Endpoints |
|---|---|
| Explain a finding, suggest a fix, or generate a migration plan | POST /api/v1/ai/explain, /suggest-fix, /migration-plan, /feedback; check remaining usage with GET /api/v1/ai/budget |
| Manage ticketing, chat and alert rules | These paths are not /api/v1-prefixed: /integrations, /alerts/rules, /notifications/rules, PUT /notifications/rules/yaml, /notifications/unsubscribe |
| Manage SIEM and observability export | Also not /api/v1-prefixed: /api/connections/catalog, /api/connections[/{id}], PATCH /api/connections/{id}/streams, POST /api/connections/{id}/test, GET /api/connections/{id}/deliveries, /api/projects/{projectId}/routes |
| Send runtime telemetry, and read what it correlated to | Ingest: POST /v1/otlp/traces, /v1/datadog/logs, /v1/logstream — HMAC-signed, not bearer auth. Read back: GET /api/v1/findings/{id}/runtime |
| Mint a short-lived GitHub installation token | POST /api/v1/tokens/{installationId} |
| Manage policies, exceptions and the audit chain | Documented in Governance |
OpenAPI specifications
The tables on this page are an endpoint map, not a schema reference — they tell you what exists and what it is for, with one line per endpoint. For exact request and response shapes, authoritative OpenAPI documents are published for the scan lifecycle, the findings and scoring API, and the runtime telemetry API. Ask your account team for the current versions.
Webhook receivers you point providers at
These are not endpoints you call — they are addresses you configure in another product so it can notify RelixQ. Each verifies the provider signature before it changes anything. Setup is covered in Integrations.
| Endpoint | Configure it in | What it does |
|---|---|---|
POST /webhooks/github | The RelixQ GitHub App | Triggers scans on push and pull request; keeps repository connections in sync |
POST /webhooks/jira | Jira | Closing a ticket updates the linked finding |
POST /webhooks/azure-boards | Azure Boards | Work-item state sync |
POST /webhooks/linear | Linear | Issue state sync |
POST /webhooks/servicenow | ServiceNow | Incident state sync |
POST /slack/actions | Your Slack app | Handles the action buttons on RelixQ notifications |
Related pages
CLI: platform and QAST commands
The commands that talk to your tenant — login, org, use, remote-scan, submit, report, rules — plus the `pentest` group for quantum exposure assessment and the release gate.
Integrations: SIEM export, alerting and ticketing
The current configuration guide for SIEM and observability export, incidents, tickets, notifications, and status sync; the public catalog separately shows the final-state SaaS roadmap.
Security model, tenancy and data handling
The intended tenant-isolation design, the two collection paths into the managed SaaS service, credential handling, active-probing consent, and the boundary between product architecture and production-verified assurance claims.
Governance, policies and exceptions
The policy engine that renders release-gate decisions, the TTL-bounded exception workflow, and the tamper-evident audit chain that makes both defensible to an auditor.