Authentication
Bearer tokens issued from /portal/api-keys. Cookie auth for browser sessions. Per-tenant client_id scoping on every read.
API DOCUMENTATION · v4
Integrate Enigma into your workflow.
JSON-over-HTTPS. Bearer-token authentication. GraphQL for complex queries. OpenAPI 3.0 spec discoverable for partners. The full surface — issues, tenants, assessments, audit feed — is programmable.
Rate limits
1000 req/hour for read endpoints. Burst tokens supported. X-RateLimit-* headers on every response.
Terminology aliases
Issue / Tenant / Assessment alongside legacy Finding / Client / Scan. X-Deprecated-Fields response header lists legacy keys.
Webhooks
Subscribe at /api/webhooks. HMAC-signed payloads. Replay protection via nonce.
GraphQL
POST queries to /api/graphql. Introspection enabled for authenticated users. Schema discoverable.
SSE event stream
/api/v3/stream multiplexes scan-progress and agent-decision events per your tenant scope. Auto-reconnect on disconnect.
Key endpoints
| METHOD | PATH | DESCRIPTION |
|---|---|---|
| GET | /api/v3/sidebar/scopes | Tenant scope summary (issue counts, SLA state, last activity) |
| GET | /api/v3/issues/:id | Composite issue detail (core + evidence + compliance + history) |
| GET | /api/v3/stream | SSE multiplexed scan + agent event stream |
| GET | /api/issues | List issues (alias for /api/findings, dual-emit) |
| GET | /api/tenants | List tenants (alias for /api/clients) |
| GET | /api/assessments | List assessments (alias for /api/scans) |
| POST | /api/scans/start | Start a new assessment against an authorised target |
| GET | /api/search/global | Cross-search issues + tenants + assessments |
| POST | /api/graphql | GraphQL endpoint |
| GET | /api/openapi.json | OpenAPI 3.0 spec (full schema) |