- contact@verticalserve.com
- Continuous compliance, proven every hour
Everything the console does is an API call. These are the conventions and the calls most teams automate first.
Every endpoint is under /api and answers {status: "SUCCESS"|"FAIL", data, error_message, error_code}. Authenticate with Authorization: Bearer <access token> from sign-in, or an API key (Users & access → API keys) sent the same way, Authorization: Bearer <key>. A key acts with its holder’s roles. Public endpoints are /api/health, the Trust Center under /api/public/trust/ and the agent’s /api/agent/checkin, which carries its own device key. The API publishes its OpenAPI docs at /docs.
| Area | Endpoints |
|---|---|
| Overview | GET /overview, GET /portfolio (SaaS) |
| Library | /library/frameworks, /library/controls, /library/monitors, /library/policies, /library/risks, /library/connectors |
| Frameworks | /frameworks, POST /frameworks/adopt, /frameworks/{id}/requirements, /frameworks/{id}/description, PUT /requirements/{id} |
| Controls & monitors | /controls, /controls/{id}, POST /controls/evaluate; /monitors?status&category, POST /monitors/run, /monitors/{id}/exceptions |
| Integrations & inventory | /integrations/catalog, /integrations, /integrations/{id}/test, /sync, /resources; /resources?type |
| Evidence & policies | /evidence (multipart or JSON), /evidence/{id}/download; /policies, /versions, /submit, /approve, /publish, /pdf |
| People & devices | /people, /people/sync, /me/tasks, /devices, /agent/install |
| Vendors, risks, access, issues | /vendors, /vendor-reviews/{id}, /risks, /risks/matrix, /access-reviews, /access-review-items/{id}, /issues, /issues/{id}/push |
| Audits | /audits, /audits/{id}/controls, /requests, /populations, /findings, /access, /package; /audit-populations/{id}/sample |
| Trust & AI | /trust, /trust/documents, /trust/requests; /questionnaires, /questionnaires/{id}/answer, /export; /knowledge; /ai/ask, /ai/status |
| Settings | GET/PUT /settings, POST /settings/onboard |
curl -s https://assure.example.com/api/monitors?status=failing -H "Authorization: Bearer $ASSURE_API_KEY" \
| jq -r '.data[] | "\(.severity)\t\(.code)\t\(.summary.failing) failing"'Each monitor carries summary {total, passing, failing, excepted}, the controls it feeds, its remediation and, on GET /monitors/{id}, the failing resources with their reasons and its run history.
curl -s -X POST https://assure.example.com/api/monitors/run -H "Authorization: Bearer $ASSURE_API_KEY"curl -s -X POST https://assure.example.com/api/evidence -H "Authorization: Bearer $ASSURE_API_KEY" \
-F file=@pentest-2026.pdf -F title="Penetration test 2026" \
-F control_ids="$VUL03_ID" -F collected_at=2026-10-20Add -F request_id=… to answer an audit request with the same upload; the request moves to submitted. Links and statements are JSON: {"kind": "link", "title": …, "url": …, "control_ids": […]}.
curl -s -X POST https://assure.example.com/api/questionnaires/$QID/answer -H "Authorization: Bearer $ASSURE_API_KEY" \
-H "Content-Type: application/json" -d '{}'
curl -s -o answers.xlsx "https://assure.example.com/api/questionnaires/$QID/export?format=xlsx" -H "Authorization: Bearer $ASSURE_API_KEY"Approved answers are never overwritten by a later run. format=csv gives the same columns as CSV.