Skip to content
SYNTHESISCYBER
Start free

API reference

REST API documentation

JSON over HTTPS. Every request is authenticated, rate limited, and written to the account audit log.

Developer overview

Authentication

Scoped bearer keys

Send your API key as a bearer token on every request. Keys are environment-scoped, shown once at creation, and stored hashed. A leaked key can be revoked instantly from the dashboard without affecting other integrations.

curl https://api.synthesiscyber.app/v1/account \
  -H "Authorization: Bearer sk_live_your_key_here" \
  -H "Accept: application/json"

Conventions

Rate limits and errors

Rate limits

600 requests per minute per key. Every response carries X-RateLimit-Remaining and X-RateLimit-Reset. Exceeding the limit returns 429 with a Retry-After header.

Error format

Errors use application/problem+json with a stable machine-readable type, a human summary, and a request identifier to quote in support.

{
  "type": "https://api.synthesiscyber.app/errors/invalid_scope",
  "title": "Key lacks the required scope",
  "status": 403,
  "detail": "This key is read-only. Enable the vault:write scope to continue.",
  "request_id": "req_8f31c2ba"
}

Endpoints

Available resources

GET
/v1/account

Returns the authenticated account, plan, and feature entitlements.

GET
/v1/vault/items

Lists vault item metadata — identifiers, labels, categories, and timestamps. Ciphertext is returned only to the owning session; the API never returns plaintext.

GET
/v1/audit-events

Cursor-paginated audit log of logins, security changes, exports, and admin actions.

POST
/v1/incidents

Creates an incident record for the authenticated account with encrypted note content.

GET
/v1/usage

Current period usage against plan limits for storage, items, and API calls.

POST
/v1/webhooks

Registers a webhook endpoint and returns the signing secret exactly once.

Webhooks

Events you can subscribe to

Each delivery is signed with HMAC-SHA256. Verify the signature before trusting the payload.

subscription.updated

Plan change, renewal, cancellation, or payment failure.

security.setting_changed

Two-factor state, session revocation, or password change.

audit.event_created

Any new entry written to the account audit log.

export.completed

A requested data export finished and is available to download.

The API is in active development alongside the account system. Endpoints listed here are the committed surface for the first stable release; breaking changes are announced 90 days in advance.