Xygeni User Guides
  • Welcome to Xygeni
  • Getting Started
    • Create a Free Trial Account
    • Quick start with your code repository
    • Quick start with Xygeni CLI
    • Quick start with a preloaded project
    • Log in to Xygeni
    • Subscribe to Xygeni
  • Introduction to Xygeni
    • Key Concepts
      • Projects in Xygeni
      • Project Baseline
      • Detected Issues
      • Remediation Actions
      • Policies
      • Risk Level
      • SDLC Inventory
      • Standards Compliance
      • GuardRails
    • Xygeni Products
    • How Xygeni works
    • Xygeni Web UI Overview
      • Projects Screen
        • Risk Level
    • Integrating Xygeni into your Workflow
    • Prioritization Funnels
      • Custom Funnels
      • Prioritization Criteria (Stages)
        • Reachability
        • Exploitability
        • Fixable
    • Guardrails
    • Generate a SBOM
    • Reports
      • Trends
      • Scan History
    • Supported Integrations
    • Customizations
  • Xygeni Products
    • Application Security Posture Management (ASPM)
      • ASPM User Interface Guide
      • All Risks
        • Statistics
        • Issues Evolution
        • Issue Comparison Between Different Scans
      • Governance
      • Inventory
        • All Assets
        • Repositories
        • Components
        • CI/CD Assets
        • Delivery Assets
        • Systems & Tools
        • Collaborators
      • Health Check
      • Inventory Scanner
        • Inventory Scanner Configuration
        • Inventory Collaborators Scan
      • Importing reports from 3rd party tools
        • External Scanners Supported
          • Report upload for Kiuwan
            • ExportRule (.java)
    • Code Security (SAST)
      • Code Security (SAST) User Interface Guide
        • Risks (SAST)
        • Malicious Code
      • Malware Scanner
        • Malware Scanner Configuration
        • Malware Detectors
      • SAST Scanner
        • SAST Scanner Configuration
    • Open Source (SCA)
      • Open Source (SCA) User Interface Guide
      • Open Source Components
      • Supported Package Managers for dependency resolution
      • Risks (SCA)
      • OSS Prioritization Funnels
      • OSS Auto-Remediation
      • Malware Early Warning (MEW)
        • How Malware Early Warning works
        • Common types of Malware found in open source packages
      • Dependency Scanner
        • Dependency scanner configuration
        • Dependency Analyzers
      • Suspect Dependencies Scanner
        • Suspect Deps Scanner Configuration
        • Suspect Deps Detectors
    • CI/CD Security
      • CI/CD Security User Interface Guide
      • CI/CD Details
      • Build Attestations
      • CI/CD Scanner
        • CI/CD Misconfigurations Scanner Configuration
      • Compliance Scanner
        • Supported compliance standards
    • Secrets Security
      • Secrets User Interface Guide
      • Secrets Scanner
        • Secrets scanner configuration
      • Secret Leaks Handling
        • Secret Leaks Handling
        • How to Prevent Hard-Coded Secrets
        • Secret Leaks Handling CheatSheet
      • Secrets Auto-Remediation
    • IaC Security
      • IaC User Interface Guide
      • IaC Scanner
        • IaC Scanner Configuration
    • Malware
    • Build Security
      • Build Security Concepts
      • Build Attestations
      • Attestation format
      • How SALT works
      • Installing Salt CLI
      • Salt Command-Line Reference
      • SALT Architecture
      • SALT How To…​
    • Anomalous Activity Detection
      • Anomalous Activity Detection User Interface Guide
      • Xygeni Sensors
        • Xygeni Sensor for Azure
        • Xygeni Sensor for BitBucket
        • Xygeni Sensor for GitHub
          • GitHub Audit Log Processing
        • Xygeni Sensor for GitLab
        • Xygeni Sensor for Jenkins
        • Anomaly Detection's Detectors
      • Code Tampering Scanner
        • Code Tampering Scanner Configuration
    • Compliance & Malware Insights
      • SSCS Compliance
      • Malicious Packages DB
  • Scan Management
    • Manage Scans
    • Scan History
  • Xygeni Scanner CLI
    • Xygeni Scanners
    • Xygeni CLI Overview
      • Xygeni CLI Prerequisites
      • Xygeni CLI Installation
      • Xygeni CLI Docker Image
      • Xygeni CLI Authentication
        • CLI Authentication with Xygeni
      • SCM, CI/ CD and Container Registry tokens
      • Xygeni CLI Operation Modes
        • Single scan
          • Scanning a docker image
        • Multi Scan
        • Organization scan
      • Xygeni CLI Configuration options
      • Xygeni CLI Output Formats
      • Exporting Xygeni results to 3rd party tools
      • Automatic Remediation
      • Generate SBOM with the Xygeni CLI
      • CLI utils
        • Credentials Encryption
        • Central Configuration
      • Xygeni Guardrails
        • CI/CD Audit Analysis
      • Xygeni CLI Error Codes
      • Xygeni Scanner Reference
  • Xygeni Administration
    • Platform Administration
      • Profile
      • Subscription
      • Users Management
      • Projects Management
      • Groups Management
      • Policies
      • Integrations
        • Xygeni Single Sign-On (SSO) Authentication
          • SSO - OKTA
          • SSO - Microsoft Entra ID
        • Integrate Scanner CLI into CI/CD Systems
          • Azure Pipelines Integration
          • BitBucket Integration
          • CircleCI Integration
          • GitHub Actions Integration
          • GitLab Runner Integration
          • Jenkins Integration
          • Travis CI Integration
        • Git Hooks with Xygeni
        • Collaboration & communication Tools
        • Ticketing Systems
        • Remediation systems
      • Notifications
    • Rest API
  • Support
  • Changelog
    • Version 5.11 - April 11, 2025
    • Version 5.9 – March 26, 2025
Powered by GitBook
On this page
  • Xygeni REST API
  • API Endpoints
  • Generating an API client
  • Usage
Export as PDF
  1. Xygeni Administration

Rest API

PreviousNotificationsNextSupport

Last updated 28 days ago

Xygeni REST API

The Xygeni API is based on the OpenAPI ("Swagger") standards and allows retrieval of security issues, project risk summary, trends in security position, and report generation, plus administration.

The api base URL is

API Endpoints

Most Xygeni API endpoints return JSON output.

The easiest way to find the endpoint for a particular need is by browsing in the .

Generating an API client

Instead of providing a downloadable client for different platforms / languages, it is recommended to generate the client from the OpenAPI specification (if you trust the publicly available generators). This allows it to control the generation of the client, and keeps it updated to the latest API version.

For generating an api client for a target programming language, the OpenAPI / Swagger specification can be downloaded from (YAML) or (JSON).

curl https://get.xygeni.io/latest/swagger/swagger.yaml xygeni-api.yaml
iwr -OutFile xygeni-api.yaml https://get.xygeni.io/latest/swagger/swagger.yaml

Method 1: Using Swagger editor

The most interactive way to create a client from a swagger file is using the online swagger editor. Go to Use . Select file, import URL and type in the URL of the Xygeni API URL. Alternatively you can select File, Import File and upload the downloaded swagger.yaml file.

Next select Generate Client and select the language of your choice. The end result is a zip file you can download with the generated client code.

Method 2: Using swagger-codegen

Method 3: Using OpenAPI Generator

# For Unix / macOS
curl https://repo1.maven.org/maven2/org/openapitools/openapi-generator-cli/6.2.1/openapi-generator-cli-6.2.1.jar -O openapi-generator-cli.jar

# For Windows
iwr -OutFile openapi-generator-cli.jar https://repo1.maven.org/maven2/org/openapitools/openapi-generator-cli/6.2.1/openapi-generator-cli-6.2.1.jar

java -jar openapi-generator-cli.jar config-help -g java

openapi-generator-cli generate -i xygeni-api.yaml -g typescript-fetch -o out \
    -c config.yaml

Usage

An api client generated for your language of choice could be convenient. Alternatively, there are popular frameworks for invoking api endpoints that could be used. A third option is to use a command-line tool like curl or wget.

Authentication

Authenticating api calls require an Authorization header: Authorization: Bearer <TOKEN_HERE>.

curl -s -H "Authorization: Bearer ${XYGENI_TOKEN}" -L "{api_key}/secret/"

{
  "secrets": [
    {
      "id": 41,
      "detector": {
        "code": "atlassian_oauth2_key",
        "type": "access_key",
        "description": "Access Key"
      },
      "endLine": 3,
...

The Xygeni API may also use basic authentication with username and password, but it is not recommended. Use an access token instead.

An example of basic authentication with curl on the same endpoint:

curl -s -u "USERNAME:PASSWORD" -L "https://api.xygeni.io/secret/"

As a shorthand, in the following examples, a XY_API_TOK environment variable with value Authorization: Bearer ${XYGENI_TOKEN} will be used.

Fetching data

curl -s -H "$XY_API_TOK" https://api.xygeni.io/projects/list

curl -s -H "$XY_API_TOK" {api_url}/misconfigurations

Administration

Create projects

You need MANAGER_PROJECT or ROOT roles for creating projects for your organization.

Delete project

This is a destructive operation. Project data is removed from the platform.

Instead of using the interactive editor, you may use the . This is the recommended alternative in general, as it provides much more control on the generated client code.

is another nice client generator for api clients from OpenAPI / Swagger documents.

You may download the and run its help command:

There are that wrap the Java-based OpenAPI generator CLI, that you may try for convenience. You may then replace java -jar openapi-generator-cli.jar with openapi-generator-cli command, for example.

It is recommended to define a like my_config.yaml with options for your language of choice, and then call the generator with the config file:

The is the reference to the available endpoints.

Most API endpoints require authentication (except /ping to check for platform availability). The recommended way to authenticate operations is using an access token (also known as apikey or API token). Go to for full details.

Let’s assume that the access token is set in the XYGENI_TOKEN environment variable. The following is an example using curl for the endpoint:

Most endpoints for fetching issues need a projectId parameter. The list of project IDs for the organization’s projects could be fetched using the endpoint:

The endpoints could be used to fetch data for the different issue types. For example, to get the latest misconfigurations:

For automation, you may need to create projects. The endpoint creates a project.

Sometimes projects terminate, software is decommissioned or replaced, and so on. The allows us to remove a given project AND ALL ITS DATA.

https://api.xygeni.io
online API documentation
https://get.xygeni.io/latest/swagger/swagger.yaml
https://get.xygeni.io/latest/swagger/swagger.json
https://editor-next.swagger.io/
swagger-codegen
OpenAPI Generator
openapi-generator-cli.jar
other alternatives
configuration file
online API documentation
/secret
GET /projects/list
Analysis
POST /project/create
DELETE /project/{projectId}
Generate Access Token