API Reference

Programmatic access to the APVISO control plane. Manage self-hosted runners and targets, start BYOK pentests, and retrieve findings through our REST API.

Authentication

All API requests require an API key passed in the X-API-Key header. Keys are prefixed with apvk_. Generate one in Settings → API Keys.

bash
curl -H "X-API-Key: apvk_your_key_here" \
  https://apviso.com/api/v1/quota

Base URL

All endpoints are relative to:

https://apviso.com/api/v1

Rate Limits

API requests are limited to 120 requests per minute per API key. Rate limit information is included in response headers:

HeaderDescription
x-ratelimit-limitMaximum requests per window
x-ratelimit-remainingRemaining requests in current window
x-ratelimit-resetUnix timestamp when the window resets

When the limit is exceeded, the API returns 429 Too Many Requests with a Retry-After header.

Error Codes

StatusMeaning
200Success
201Resource created
202Accepted (e.g., report still generating)
400Bad request - invalid parameters
401Unauthorized - invalid or missing API key
402Payment or license action required
403Forbidden - insufficient plan or inactive license
404Resource not found
409Conflict (e.g., target has pentests, can't delete)
422Validation error
429Rate limit exceeded
500Internal server error

Endpoints

Browse endpoints by section. Each section page includes request/response examples and parameter details.

Quota

Check your self-hosted license summary

GET

Runners

Register and monitor customer-installed self-hosted runners

GETGETPOST

Targets

Manage self-hosted pentest targets

POSTGETGETDELETE+5 more

Pentests

Start and manage penetration test pentests

POSTPOSTGETGET+1 more

Findings

View and manage vulnerability findings

GETPATCHPATCH

Reports

Access pentest reports in markdown and PDF formats

GETPOSTGET

Schedules

Set up recurring automated pentests (Team+ tier)

POSTGETGETPATCH+1 more