Skip to content

CyberOwl for developers / API v1

Your workflow
Connected

Bring campaigns, findings, and reports into the tools your team already uses.

Make your first request

01 / Get started

From a key to your first campaign

  1. Create an API key

    In the client portal, open Settings → API Keys. Choose the scopes your integration needs and save the key securely. Its full value is shown once.

  2. Send a request

    Include the key as a Bearer token. This example lists campaigns available to your organization.

TerminalGET /campaigns
curl -H "Authorization: Bearer co_live_xxxxx" "https://nx-cyberowl.com/api/v1/campaigns?status=in_progress&page=1&limit=10"

Replace co_live_xxxxx with your key. Run requests from your server; keep API keys out of browser code and public repositories.

02 / Authentication

Give each integration the access it needs

API keys can be created in the Client Portal under Settings > API Keys. The full key is shown only once at creation. Include it in the Authorization header.

Authorization: Bearer co_live_xxxxx

Available scopes

campaigns:readvulnerabilities:readreports:readreports:writeorganization:readusers:readcomments:readfiles:read

03 / Responses & limits

A consistent response

Authenticated API endpoints use this JSON envelope; this documentation endpoint is public.

{
  "success": "boolean",
  "data": "T | undefined",
  "error": "string | undefined",
  "meta": {
    "total": "number (for list endpoints)",
    "page": "number",
    "limit": "number"
  }
}

1,000 requests / 1 minuteRate limit per API key. Handle HTTP 429 by backing off before retrying.

04 / API reference

Everything you can connect

Each endpoint lists its required scope. Examples use your configured CyberOwl address.

GET

/api/v1/campaigns

List campaigns for your organization

Required scope: campaigns:read

status
Filter by campaign status (optional)
page
Page number (default: 1)
limit
Items per page (default: 20, max: 100)
Request example
curl -H "Authorization: Bearer co_live_xxxxx" "https://nx-cyberowl.com/api/v1/campaigns?status=in_progress&page=1&limit=10"
GET

/api/v1/campaigns/:campaignId

Get campaign details with assets. Finding statistics require vulnerabilities:read and are otherwise null.

Required scope: campaigns:read

Request example
curl -H "Authorization: Bearer co_live_xxxxx" "https://nx-cyberowl.com/api/v1/campaigns/uuid-here"
GET

/api/v1/vulnerabilities

List vulnerabilities across your organization's campaigns

Required scope: vulnerabilities:read

campaignId
Filter by campaign (optional)
severity
Filter by severity: critical, high, medium, low (optional)
status
Filter by status (optional)
page
Page number (default: 1)
limit
Items per page (default: 20, max: 100)
Request example
curl -H "Authorization: Bearer co_live_xxxxx" "https://nx-cyberowl.com/api/v1/vulnerabilities?severity=critical&page=1"
GET

/api/v1/vulnerabilities/:vulnId

Get vulnerability details. comments and evidence require comments:read and files:read respectively.

Required scope: vulnerabilities:read

Request example
curl -H "Authorization: Bearer co_live_xxxxx" "https://nx-cyberowl.com/api/v1/vulnerabilities/uuid-here"
GET

/api/v1/reports

List published reports for your organization

Required scope: reports:read

page
Page number (default: 1)
limit
Items per page (default: 20, max: 100)
Request example
curl -H "Authorization: Bearer co_live_xxxxx" "https://nx-cyberowl.com/api/v1/reports"
POST

/api/v1/reports

Trigger report generation for a campaign

Required scope: reports:write

campaignId
string (required)
type
"nexa_full" | "executive" | "technical" (required)
Request example
curl -X POST -H "Authorization: Bearer co_live_xxxxx" -H "Content-Type: application/json" -d '{"campaignId":"uuid-here","type":"executive"}' "https://nx-cyberowl.com/api/v1/reports"
GET

/api/v1/organization

Get organization details. The member list requires users:read and is otherwise null.

Required scope: organization:read

Request example
curl -H "Authorization: Bearer co_live_xxxxx" "https://nx-cyberowl.com/api/v1/organization"

Build something connected

Start with your workspace, then make it part of your workflow.

Open client portal