REST API

Everything in the console is available through the REST API at https://<your-cerberon-host>/api. Requests and responses are JSON, except uploads (multipart) and report downloads.

Authenticate

Create a token under Profile > API Tokens (see API tokens) and send it as a bearer token:

export CERBERON_URL="https://cerberon.example.com"
export CERBERON_TOKEN="<token>"

curl -sSf -H "Authorization: Bearer $CERBERON_TOKEN" "$CERBERON_URL/api/capabilities"

A token has its owner’s role and project access. A Read token can make GET and HEAD requests only.

Conventions

• Errors return a non-2xx status and {"error": "<reason>"}.
• Permissions. A request the token’s role does not allow returns 403.
• Idempotency. POST /api/jobs accepts an Idempotency-Key header. Retrying with the same key returns the original scan rather than starting a second one.
• Rate limits. Uploads are limited per user per minute. A limited request returns 429 with Retry-After.

Health

Method	Path	Auth	Returns
GET	/healthz	None	200 when the server is up.
GET	/readyz	None	200 when the database and services are ready.
GET	/api/capabilities	Token	The scan types available on this instance.

Scans

Method	Path	Permission	Purpose
POST	/api/uploads	scan:start	Upload an archive, lockfile, SBOM, collection or mobile package. Field name file. Returns artifact.id.
POST	/api/jobs	scan:start	Start a scan. See the request below.
GET	/api/jobs	view	List scans.
GET	/api/jobs/:id	view	A scan’s state, configuration and latest report.
GET	/api/jobs/:id/wait	view	Wait up to timeout seconds (default 30, maximum 120) for the scan to finish.
GET	/api/jobs/:id/gate	view	Evaluate the quality gate. See CI/CD and quality gates.
GET	/api/settings/gate-policy?project=:id	settings:manage	A project’s stored gate policy, the effective policy and the defaults.
PUT	/api/settings/gate-policy	settings:manage	Store a project’s gate policy: {"project_id": "…", "policy": {…}}. "policy": null returns the project to the defaults.
GET	/api/jobs/:id/controls	scan:cancel	The controls available for this scan now.
POST	/api/jobs/:id/control	scan:cancel	Apply a control: {"verb": "stop"}. Other verbs include pause and resume.
POST	/api/jobs/:id/retry	scan:start	Run the scan again.
DELETE	/api/jobs/:id	scan:delete	Delete the scan and its findings and reports.

Start a scan. The body names the scan type in capability, the target, and a consent block for scans that read source code:

{
  "capability": "sast",
  "target": { "kind": "git", "url": "https://git.example.com/team/app.git" },
  "consent": { "acknowledged": true, "mode": "rules-only" },
  "config": { "ref": { "branch": "main" } }
}

capability	target.kind values
sast	git, artifact
sca	git, artifact, image, sbom
dast	web, api
pentest	host
cloud	cloud
k8s	k8s
mobile	artifact

Findings

Method	Path	Permission	Purpose
GET	/api/findings	view	Findings across scans in your projects.
GET	/api/jobs/:id/findings	view	One scan’s findings.
POST	/api/findings/triage	finding:triage	Set the state of 1 to 200 findings.
GET, POST	/api/jobs/:id/findings/:fid/comments	view, finding:triage	Read or add comments.

Change state. workflow is one of open, in_review, to_fix, fixed, false_positive, accepted_risk or wont_fix:

{
  "workflow": "false_positive",
  "reason": "Input is validated by the API gateway",
  "items": [{ "job_id": "<scan id>", "finding_id": "<finding id>" }]
}

Reports and exports

Method	Path	Permission	Purpose
POST	/api/jobs/:id/report	report:export	Build a new report version.
GET	/api/reports/:id/download	report:export	Download a report. format is pdf, html, csv, sarif or json. Add redact=on to mask.
GET	/api/jobs/:id/sbom/export	report:export	Export the SBOM. See formats.
GET	/api/jobs/:id/cbom/export	report:export	Export the CBOM.
GET	/api/threats/export	report:export	Export the Threat Advisor list.

Share links

Method	Path	Permission	Purpose
POST	/api/jobs/:id/share	share:create	Create a link. Body: hours, masked, recipient.
POST	/api/shares/:id/revoke	share:create	Revoke a link.

Schedules

Method	Path	Permission	Purpose
GET	/api/schedules	view	List schedules.
POST	/api/schedules	scan:start	Create a schedule.
PUT	/api/schedules/:id	scan:start	Change name, target, cron expression, time zone or state.
POST	/api/schedules/:id/run	scan:start	Run now. enable and disable work the same way.
DELETE	/api/schedules/:id	scan:start	Delete a schedule.