API
Available at Team and above. Issue and revoke keys yourself at /dashboard/api. A key can only ever read its own account.
Authentication
curl https://cra.synthworx.com/api/v1/products \
-H "Authorization: Bearer crak_your_key_here"Endpoints
| Method | Path | What |
|---|---|---|
| GET | /api/v1/products | List your products. |
| POST | /api/v1/products | Create a product. Body: name, model, manufacturer_name, product_type. |
| GET | /api/v1/products/:id/sboms | List SBOMs for a product, newest first. |
| GET | /api/v1/sboms/:id?format=cyclonedx | Export an SBOM. format is cyclonedx or spdx. |
| POST | /api/v1/sboms | Attach an SBOM. Body: product_id, release, document (CycloneDX or SPDX). |
| POST | /api/v1/scans | Start a binary scan. Returns an upload URL and a short-lived token. |
| GET | /api/v1/scans/:id | Scan status and, when finished, the component list. |
| GET | /api/v1/products/:id/findings | Open findings, ranked by KEV membership and EPSS. |
| POST | /api/v1/vex | Publish a VEX statement. Body: product_id, cve_id, status, justification. |
| GET | /api/v1/products/:id/documents | Generated documents and their versions. |
| GET | /api/v1/cases | Article 14 cases. Rehearsal cases are flagged mode=rehearsal. |
Rate limits
1,000 requests an hour per key. Binary scans are limited by your plan quota and scan credits rather than by request rate.
CI integration
The GitHub Action and GitLab CI job wrap the same endpoints. Anything the CI integration does, you can do with a key and curl, which is the point of publishing them.