DEVELOPER API v2.7.2

Platform API

Connect your workspace data to the tools you build.

First request Get API access

REST JSON OpenAPI 3.1.0

endpoints: 187
resource groups: 21
data models: 124

Explore endpoints

Your first request

Public example

Base URL https://api.csfaas.comREST · application/json

GET/meExample endpoint

Who am I

Confirm your user, workspace and permissions.

Authenticate

Request

Read the result

Headers & response fields

Request headers

Authorizationstring required

Bearer YOUR_API_KEY
Use a key created in Settings → API & MCP.

X-Workspace-Iduuid optional

Target workspace (required for the browser JWT scheme; ignored for API keys, which are workspace-bound).

Response fields 200 · application/json

data.userobject

data.workspace_idstring

data.channelstring

data.permissionsobject

Response statuses

200

The resource. An unauthorized/absent resource is 404; an RLS-empty relation is null.

401

Missing or invalid credentials.

403

Workspace or member API approval is missing, workspace access is disabled, or membership is unavailable.

429

Rate limit exceeded (120 reads/min; 30 writes/min — separate buckets).

Your permissions apply

Your workspace roles apply to every request. Writes also need a credential with write access.

RequestcURL

curl --request GET 'https://api.csfaas.com/me' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_API_KEY'

ResponseSelected fields · fictional data

{
  "data": {
    "user": {
      "id": "6a1f0f0e-1111-4a5a-9c3b-9f4b7f4a2b10",
      "email": "you@org.com"
    },
    "workspace_id": "ef0a094f-2222-4bd4-8a1e-33d2b1c0a001",
    "channel": "api_key"
  }
}

This documentation sample does not make an API request. API calls require an approved workspace and an included member.

What the API covers

19 resource groups

Read and write the same records as the app, under the same roles. Every group below is documented in the full reference.

GETRead: 75
POSTCreate & act: 54
PATCHUpdate: 29
DELETEDelete: 29

General19 endpoints
Identity, workspace, members, settings and usage.
GET 10POST 7DELETE 2
Risks9 endpoints
Risk register, scoring and top-risk analytics.
GET 5POST 2PATCH 1DELETE 1
Demands6 endpoints
Risk demands, their links, history and workflow actions.
GET 2POST 2PATCH 1DELETE 1
Remediations6 endpoints
Remediation plans, due dates and actions.
GET 2POST 2PATCH 1DELETE 1
Controls6 endpoints
Implemented controls from current policy versions.
GET 2POST 2PATCH 1DELETE 1
Catalogs9 endpoints
Searchable control and threat databases.
GET 1POST 4PATCH 2DELETE 2
Policies9 endpoints
Policies, elements, versions and framework links.
GET 3POST 3PATCH 1DELETE 2
Frameworks14 endpoints
Frameworks, elements, versions and changelog.
GET 4POST 5PATCH 3DELETE 2
Audits32 endpoints
Audits, findings, recommendations and actions.
GET 5POST 10PATCH 9DELETE 8
Third parties6 endpoints
Third parties, their links and risk exposure.
GET 2POST 2PATCH 1DELETE 1
Assets12 endpoints
Assets and their links.
GET 4POST 4PATCH 2DELETE 2
Forms16 endpoints
Questionnaires, submissions and answers.
GET 8POST 4PATCH 2DELETE 2
Prompts6 endpoints
The versioned, reusable AI prompt library.
GET 3POST 1PATCH 1DELETE 1
Evidences7 endpoints
Evidence metadata and permission-checked file content.
GET 3POST 2PATCH 1DELETE 1
Activity1 endpoint
Workspace activity feed and event catalog.
GET 1
Inbox3 endpoints
Your notifications, followed items and ownership.
GET 3
Reference14 endpoints
Parameter sets, roles, workflow and tags.
GET 7POST 3PATCH 2DELETE 2
Search & statistics2 endpoints
Global search and the statistics hub.
GET 2
Discovery2 endpoints
Machine-readable description of reads and writes.
GET 2

Explore the API

187 endpoints

Risks, compliance, assets and more. A preview of 16 endpoints, including your first request.

GET/risksList risk assessmentsRisks
GET/demandsList risk demandsDemands
POST/remediationsCreate a remediation planRemediations
GET/controlsList implemented controls (current policy versions)Controls
GET/policiesList security policiesPolicies
GET/frameworksList frameworksFrameworks
GET/auditsList audits with countsAudits
GET/third-partiesList third partiesThird parties
PATCH/assets/{id}Update an assetAssets
GET/formsList forms (questionnaires)Forms
GET/promptsList the reusable AI prompt libraryPrompts
GET/evidencesSearch evidence metadata (11 domains)Evidences
GET/searchGlobal search across all entitiesSearch & statistics
GET/statistics/{module}The statistics hub (overview / risks / policies / frameworks / third-parties)Search & statistics
GET/catalog/{kind}Search the controls / threats databaseCatalogs

171 more endpoints in the full reference, with request details, examples and data models.

Full reference

Unlock all 187 endpoints

The complete reference opens for members of a workspace with API access. Sign in with your CSFaaS account to check yours.

Every parameter, request body and response schema
Editable cURL, JavaScript and Python examples
124 data models with field-level detail
The OpenAPI 3.1 definition, ready to download

CSFaaS approves your workspace for the API
A workspace manager includes you in Settings
You sign in here with the same account

Sign in to the API reference

Use your CSFaaS account to check workspace access.