API Reference

Complete REST API documentation for automating Pemvosec and building custom integrations. The API follows RESTful conventions with JSON request/response bodies.

Authentication

Bearer token authentication via JWT. Include token in Authorization header.

RBAC Enforced

All endpoints enforce role-based access control. Ensure your token has required permissions.

Rate Limits

10,000 requests/hour for Essentials, 100,000 for Complete, unlimited for Enterprise.

Base URL

https://api.pemvosec.com

Production

All API endpoints are prefixed with /api/v1 for versioning. The current stable version is v1.

Authentication

Pemvosec API uses Bearer token authentication. Include your JWT token in the Authorization header of all requests.

curl -X GET \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  https://api.pemvosec.com/api/v1/aspm/findings

Keep your token secure

Never expose your API token in client-side code or public repositories. Use environment variables and server-side requests.

Endpoint Overview

Authentication

User authentication and session management

GET

/api/v1/auth/googleStart Google OAuth flow

GET

/api/v1/auth/meGet current user info

POST

/api/v1/auth/logoutLog out current session

POST

/api/v1/auth/refreshRefresh access token

Blades

Security blade management across all 16 modules

GET

/api/v1/bladesList all available blades

GET

/api/v1/blades/:idGet blade details and status

GET

/api/v1/blades/:id/configGet blade configuration

PUT

/api/v1/blades/:id/configUpdate blade configuration

GET

/api/v1/blades/:id/findingsGet findings for a blade

Findings

Unified findings across all security blades

GET

/api/v1/findingsList all findings (all blades)

GET

/api/v1/findings/:idGet finding details

PATCH

/api/v1/findings/:idUpdate finding status

POST

/api/v1/findings/:id/suppressSuppress a finding

GET

/api/v1/findings/statsGet findings statistics

Antivirus (AV)

Threat detection and malware prevention

GET

/api/v1/av/statusGet AV status

GET

/api/v1/av/threatsList detected threats

POST

/api/v1/av/scanTrigger scan

GET

/api/v1/av/quarantineList quarantined items

EDR

Endpoint Detection & Response

GET

/api/v1/edr/endpointsList endpoints

GET

/api/v1/edr/alertsList EDR alerts

GET

/api/v1/edr/processesGet process tree

POST

/api/v1/edr/isolateIsolate endpoint

ASPM

Application Security - code scanning, SAST, SCA

GET

/api/v1/aspm/repositoriesList connected repositories

POST

/api/v1/aspm/repositoriesConnect a repository

GET

/api/v1/aspm/scansList ASPM scans

POST

/api/v1/aspm/scansTrigger a scan

Mail Security

Email protection and anti-phishing

GET

/api/v1/mail/threatsList email threats

GET

/api/v1/mail/quarantineList quarantined emails

POST

/api/v1/mail/releaseRelease email from quarantine

IAM

Identity & Access Management

GET

/api/v1/iam/identitiesList identities

GET

/api/v1/iam/access-reviewsList access reviews

POST

/api/v1/iam/mfaConfigure MFA

Vulnerability Management

CVE tracking and prioritization

GET

/api/v1/vm/vulnerabilitiesList vulnerabilities

GET

/api/v1/vm/vulnerabilities/:cveGet CVE details

GET

/api/v1/vm/trendsGet vulnerability trends

Compliance

Compliance frameworks and reporting

GET

/api/v1/compliance/frameworksList frameworks

GET

/api/v1/compliance/statusGet compliance status

POST

/api/v1/compliance/reportsGenerate compliance report

Reports

Report generation and scheduling

GET

/api/v1/reportsList reports

POST

/api/v1/reportsGenerate report

GET

/api/v1/reports/:id/downloadDownload report

Integrations

Third-party integrations

GET

/api/v1/integrationsList integrations

POST

/api/v1/integrationsCreate integration

DELETE

/api/v1/integrations/:idRemove integration

Users & RBAC

User management and access control

GET

/api/v1/usersList users

POST

/api/v1/usersCreate user

GET

/api/v1/rolesList roles

GET

/api/v1/permissionsList permissions

Webhooks

Webhook configuration and receivers

GET

/api/v1/webhooksList webhooks

POST

/api/v1/webhooksCreate webhook

POST

/webhooks/githubGitHub event receiver

POST

/webhooks/gitlabGitLab event receiver

Interactive API Documentation

Open Swagger UI

Interactive API Explorer

Our full interactive API documentation is available via Swagger UI. Test endpoints, view request/response schemas, and explore the complete API.

Open Swagger UI Download OpenAPI Spec

What you can do with the API Explorer:

Test API endpoints with your credentials
View detailed request/response schemas
Generate code snippets in multiple languages
Explore all available API operations

Error Handling

The API uses standard HTTP status codes and returns errors in a consistent JSON format.

Status Code	Meaning
200	Success
201	Created
400	Bad Request - Invalid parameters
401	Unauthorized - Invalid or missing token
403	Forbidden - Insufficient permissions
404	Not Found - Resource does not exist
429	Rate Limited - Too many requests
500	Server Error - Something went wrong

Error Response Format

{
  "statusCode": 400,
  "error": "Bad Request",
  "message": "Validation failed: severity must be one of critical, high, medium, low"
}