API Overview

The Cyrion AI REST API gives you programmatic access to scans, findings, reports, integrations and your team. Everything you can do in the app can be automated.

The Cyrion AI REST API gives you programmatic access to scans, findings, reports, integrations and your team. Everything you can do in the app can be automated.

Info: API keys are available on the Hacker plan and above.

Base URL

https://app.cyrion.ai/api

Authentication

Create an API key under API Keys in the app, then send it as a bearer token:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://app.cyrion.ai/api/scans

Keys carry the permissions you grant when you create them. Keep them secret and rotate them regularly. A key can only use features included in your current plan.

Quick example

Create and start a scan:

curl -X POST "https://app.cyrion.ai/api/scans" \
  -H "Authorization: Bearer $CYRION_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "target": "https://staging.example.com",
    "target_type": "web_application",
    "scan_mode": "standard",
    "engagement_rules": "In scope: staging.example.com only. No destructive actions."
  }'

Then list its findings:

curl -H "Authorization: Bearer $CYRION_API_KEY" \
  https://app.cyrion.ai/api/scans/RUN_NAME/vulnerabilities

Request and response format

• Request bodies are JSON (Content-Type: application/json).
• Responses are JSON.
• Dates and times use ISO 8601.
• List endpoints are paginated with page and page_size.

Errors

Errors return a standard HTTP status code and a JSON body that describes the problem.

A 403 for a plan-gated feature includes the plan that unlocks it and an upgrade link.

Rate limits

Requests are limited per minute according to your plan.

Every response includes your current limits:

X-RateLimit-Limit: 120
X-RateLimit-Remaining: 115
X-RateLimit-Reset: 1700000000

When you are limited, the response is 429 with a Retry-After header.

Endpoint reference

• Scans: Create, run, and control autonomous security scans.
• Scheduled Scans: Recurring scans that run on a cron-style schedule.
• Vulnerabilities: Validated vulnerabilities discovered across your scans.
• Findings: Findings, triage state, and remediation tracking.
• Evidence: Proof-of-concept artifacts, uploads, and attack narratives.
• Comments: Discussion threads on activity and vulnerabilities.
• Activity & Statistics: Dashboards, phase metrics, and activity feeds.
• Reports: Generate, export, and manage assessment reports.
• Report Templates: Reusable report layouts and branding.
• Report Curation: Select, order, and edit the findings that appear in a report.
• Agents: Inspect, message, and stop agents running inside a scan.
• AI Assistant: Conversational assistant for questions about your scans and findings.
• Skills: Searchable security playbooks available to agents.
• Tasks: Remediation tasks and checklists.
• Account: Account lifecycle, data export, and deletion.
• Team & Permissions: Members, invitations, groups, roles, and permissions.
• SSO: Single sign-on configuration and domain verification.
• Subscription: Plans, usage, credits, and billing state.
• Payments: Checkout sessions, invoices, and payment methods.
• Clients: Client organizations that scans are performed for.
• Favorites: Pin scans, reports, and vulnerabilities for quick access.
• Notifications: In-app notifications and delivery preferences.
• Integrations: GitHub, Jira, and other connected services.
• Mobile & Web Security: Mobile app uploads and web/mobile security dashboards.