Skip to content

REST API Endpoints

Complete reference for all CertifyClouds REST API endpoints.

Authentication

Login

POST /auth/login
Content-Type: application/json

{
  "username": "admin",
  "password": "yourpassword"
}

Response: 

{
  "access_token": "eyJhbGciOiJIUzI1NiIs...",
  "token_type": "bearer",
  "expires_in": 28800
}

Logout

POST /auth/logout
Authorization: Bearer {token}

Get Current User

GET /auth/me
Authorization: Bearer {token}

Health & System

Health Check

GET /health

No authentication required.

License Status

GET /system/license/status

No authentication required.

Identity Info

GET /identity
Authorization: Bearer {token}

Returns current Azure identity information.

Discovery

Start Scan

POST /api/assets/discovery/scan
Authorization: Bearer {token}
Content-Type: application/json

{
  "mode": "full" | "delta" | "force",
  "subscriptions": ["sub-id-1", "sub-id-2"]  // optional
}

Get Scan Status

GET /api/assets/discovery/scan/{scan_id}/status
Authorization: Bearer {token}

Get Scan Results

GET /api/assets/discovery/scan/{scan_id}/results
Authorization: Bearer {token}

List Scans

GET /api/assets/discovery/scans
Authorization: Bearer {token}

Query params: limit, offset

List Assets

GET /api/assets/discovery/assets
Authorization: Bearer {token}

Query params: - type: secret, key, certificate - status: healthy, warning, critical, expired - vault: vault name filter - subscription: subscription ID

Get Asset Details

GET /api/assets/discovery/assets/{asset_id}
Authorization: Bearer {token}

List Vaults

GET /api/assets/discovery/vaults
Authorization: Bearer {token}

Compliance

Get Score

GET /compliance/score
Authorization: Bearer {token}

Response: 

{
  "score": 87.5,
  "passed": 42,
  "failed": 6,
  "total": 48,
  "bySeverity": {
    "critical": 0,
    "high": 2,
    "medium": 3,
    "low": 1
  }
}

List Violations

GET /compliance/violations
Authorization: Bearer {token}

Query params: severity, framework, limit, offset

Evaluate Compliance

POST /compliance/evaluate
Authorization: Bearer {token}

List Frameworks

GET /compliance/frameworks
Authorization: Bearer {token}

Get Framework Details

GET /compliance/frameworks/{framework_id}
Authorization: Bearer {token}

Alerts

List Rules

GET /alerts/rules
Authorization: Bearer {token}

Create Rule

POST /alerts/rules
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "Expiring Secrets Alert",
  "alertType": "secret_expiring",
  "thresholdDays": 30,
  "deliveryMethod": "email",
  "deliveryMode": "digest",
  "recipients": ["team@company.com"],
  "enabled": true
}

Update Rule

PUT /alerts/rules/{rule_id}
Authorization: Bearer {token}
Content-Type: application/json

{
  "thresholdDays": 14,
  "enabled": false
}

Delete Rule

DELETE /alerts/rules/{rule_id}
Authorization: Bearer {token}

Test Rule

POST /alerts/rules/{rule_id}/test
Authorization: Bearer {token}

Get History

GET /alerts/history
Authorization: Bearer {token}

Query params: start_date, end_date, status

Subscriptions

List Subscriptions

GET /subscriptions
Authorization: Bearer {token}

Add Subscription

POST /subscriptions
Authorization: Bearer {token}
Content-Type: application/json

{
  "subscriptionId": "12345678-1234-1234-1234-123456789012",
  "name": "Production"
}

Remove Subscription

DELETE /subscriptions/{subscription_id}
Authorization: Bearer {token}

Test Connection

POST /subscriptions/{subscription_id}/test
Authorization: Bearer {token}

Audit

List Entries

GET /audit/entries
Authorization: Bearer {token}

Query params: - start_date: ISO 8601 date - end_date: ISO 8601 date - event_type: event type filter - actor: actor filter - limit, offset: pagination

Export Entries

GET /audit/export
Authorization: Bearer {token}

Query params: format (json, csv, pdf), start_date, end_date

Rotation (PRO)

Run Discovery

POST /api/automation/rotation/discover
Authorization: Bearer {token}

List Apps

GET /api/automation/rotation/apps
Authorization: Bearer {token}

Get Matches

GET /api/automation/rotation/apps/{app_id}/matches
Authorization: Bearer {token}

Rotate Secret

POST /api/automation/rotation/rotate
Authorization: Bearer {token}
Content-Type: application/json

{
  "appId": "12345678-1234-1234-1234-123456789012",
  "secretId": "secret-key-id",
  "expiryDays": 365,
  "updateKeyVaults": true
}

Get History

GET /api/automation/rotation/history
Authorization: Bearer {token}

Sync (PRO)

List Records

GET /api/automation/sync/records
Authorization: Bearer {token}

Create Record

POST /api/automation/sync/records
Authorization: Bearer {token}
Content-Type: application/json

{
  "sourceVault": "kv-production",
  "sourceSecret": "api-key",
  "targetProvider": "aws",
  "targetService": "secretsmanager",
  "targetName": "certifyclouds/api-key",
  "targetRegion": "us-east-1",
  "scheduleHours": 6,
  "enabled": true
}

Trigger Sync

POST /api/automation/sync/records/{record_id}/sync
Authorization: Bearer {token}

Get Status

GET /api/automation/sync/records/{record_id}/status
Authorization: Bearer {token}

Configure Provider

POST /api/automation/sync/providers/{provider}
Authorization: Bearer {token}
Content-Type: application/json

{
  "accessKeyId": "AKIA...",
  "secretAccessKey": "...",
  "region": "us-east-1"
}

Dependencies (PRO)

List Dependencies

GET /api/assets/dependencies
Authorization: Bearer {token}

Get Blast Radius

GET /api/assets/dependencies/blast-radius/{secret_id}
Authorization: Bearer {token}

Full-Stack Rotation

POST /api/assets/dependencies/rotate/{secret_id}
Authorization: Bearer {token}
Content-Type: application/json

{
  "includeResources": ["resource-id-1", "resource-id-2"],
  "skipVerification": false
}

Users (PRO)

List Users

GET /auth/users
Authorization: Bearer {token}

Create User

POST /auth/users
Authorization: Bearer {token}
Content-Type: application/json

{
  "username": "jsmith",
  "email": "jsmith@company.com",
  "password": "SecurePassword123!",
  "role": "user"
}

Update User

PUT /auth/users/{user_id}
Authorization: Bearer {token}
Content-Type: application/json

{
  "email": "john.smith@company.com",
  "role": "admin"
}

Delete User

DELETE /auth/users/{user_id}
Authorization: Bearer {token}

Unlock User

POST /auth/users/{user_id}/unlock
Authorization: Bearer {token}

B2C Registry (PRO)

List Tenants

GET /b2c/tenants
Authorization: Bearer {token}

Register Tenant

POST /b2c/tenants
Authorization: Bearer {token}
Content-Type: application/json

{
  "tenantId": "12345678-...",
  "tenantDomain": "company.onmicrosoft.com",
  "displayName": "Production B2C",
  "clientId": "...",
  "clientSecret": "...",
  "autoDiscover": true,
  "discoveryIntervalHours": 24
}

Discover Credentials

POST /b2c/tenants/{tenant_id}/discover
Authorization: Bearer {token}

Test Connection

POST /b2c/tenants/{tenant_id}/test
Authorization: Bearer {token}