Skip to content

Secutec External API

The External API is the machine-to-machine interface to the MySecutec platform. Poll your organization's threats, assets and DNS data through a stable, versioned contract, and feed them into your own SIEM, ticketing or reporting tooling.

Base URL

https://api.secutec.com/v1

All endpoints are versioned in the path — see Versioning.

Quick start

Request an access token with the client credentials issued for your organization, then call the API with it:

TOKEN=$(curl -s \
  -d "grant_type=client_credentials" \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  https://auth.my.secutec.com/realms/secutec/protocol/openid-connect/token \
  | jq -r .access_token)

curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.secutec.com/v1/assets?limit=5"

{
  "assets": [
    {
      "id": "9c5b94b1-35ad-49bb-b118-8e8fc24abf80",
      "type": "domain",
      "name": "example.com",
      "identifying_properties": { "domain": "example.com" },
      "public_facing": true,
      "business_value": 3,
      "note": null,
      "version": null,
      "deleted": false,
      "deleted_at": null,
      "modules": ["lcm", "dnm"],
      "first_seen_at": "2026-03-02T08:14:07Z",
      "updated_at": "2026-08-01T16:22:41Z"
    }
  ],
  "pagination": {
    "next_cursor": "eyJ1IjoiMjAyNi0wOC0wMVQxNjoyMjo0MVoi...",
    "page_size": 1
  }
}

Tokens are valid for 5 minutes — see Authentication. List endpoints are cursor-paginated deltas — see Pagination & deltas. Blocked DNS queries have their own filters and time window — see DNS blocks. Threat verdicts and notes can be written back — see Updating threat status and Updating a threat's note.

Conventions that apply everywhere

  • One organization per credential. Your token is scoped to your organization; there is no organization parameter to pass, and no way to address another organization's data.
  • Resource-named envelopes. List responses put the items in an array named after the resource (assets, threats, blocks) next to a pagination object. Single-resource responses return the object bare.
  • Stable errors. Every error is an RFC 9457 problem document with a type URI you can match on — see Errors.
  • Additive evolution. New optional fields can appear on /v1 at any time; ignore fields you do not recognise — see Versioning.

Reference

  • API reference — every endpoint, parameter and schema.
  • openapi.json — the machine-readable OpenAPI 3 specification, suitable for client generators. The rendered reference is built from this exact file.