API Reference & Webhooks

The RiskShelter API allows security teams and DevSecOps pipelines to automate attack surface monitoring, trigger vulnerability scans, and ingest continuous risk telemetry directly into SIEM/SOAR platforms.

Authentication

All API requests require a valid API token provided in the Authorization header as a Bearer token:

curl -X GET "https://api.riskshelter.com/v1/domains" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

You can generate and revoke API keys from your organization's Team Settings under the API & Integrations section.

Core Endpoints

1. Domains & Perimeter

• GET /v1/domains: List all monitored root domains and their current risk score.
• POST /v1/domains: Add a new authorized root domain to your attack surface inventory.
• GET /v1/domains/:id/subdomains: Retrieve discovered subdomains with DNS, IP, and status telemetry.

2. Scanning & Assessment

• POST /v1/scans: Trigger an automated security scan on a verified target domain.
• GET /v1/scans/:id: Retrieve scan execution status, progress, and finding summaries.
• GET /v1/scans/history: Fetch historical scan executions with start times and durations.

3. Vulnerabilities & Findings

• GET /v1/vulnerabilities: Query detected exposures filtered by severity (CRITICAL, HIGH, MEDIUM, LOW), CVSS score, or compliance framework.
• GET /v1/vulnerabilities/:id: Retrieve full vulnerability details and remediation steps.

Webhook Notifications

RiskShelter supports real-time event webhooks for immediate alerting when high-severity risks are uncovered:

• scan.completed: Fired when a scheduled or on-demand scan finishes.
• vulnerability.critical_detected: Fired when a critical CVE is surfaced.
• asset.new_subdomain: Fired when a previously unseen subdomain is discovered.

Rate Limiting & Safety

To protect target infrastructure and ensure high availability, API requests are subject to rate limiting:

• Standard tiers: up to 60 requests per minute.
• Enterprise tiers: custom dedicated capacity.

All scans conform strictly to the Rules of Engagement.