FortPilot Pro LogoFortPilot Pro
Sign InSign Up
Back to Home

Developer-First REST API

Build custom security workflows. Trigger scans from GitHub Actions and consume rich JSON data programmatically.

Integrate Security into Your Toolchain

For enterprise engineering teams, clicking around a UI is just a fallback. True DevSecOps requires programmatic access to security tooling. FortPilot offers a comprehensive, versioned REST API secured by Bearer tokens.

Trigger a headless scan the moment a Pull Request is opened. If the API returns a critical severity vulnerability, automatically fail the build and prevent the code from reaching production.

What is the FortPilot REST API?

Our REST API exposes 100% of the functionality available in our web dashboard. It allows your developers to programmatically create targets, trigger scans, poll for status, and download vulnerability payloads in structured JSON format.

Why API Integration Matters

Shift-Left Security

Finding a vulnerability in production is expensive. By integrating our API into your CI/CD pipeline (Jenkins, GitLab CI, GitHub Actions), you catch vulnerabilities at the commit stage, drastically reducing remediation costs.

Custom Dashboards

If your organization uses a centralized security information and event management (SIEM) tool or a custom dashboard, you can ingest our JSON findings directly into your existing single-pane-of-glass.

How to Use the REST API

  1. Generate a token: Create a scoped Bearer token in your FortPilot account settings.
  2. Read the docs: Explore our interactive Swagger/OpenAPI documentation.
  3. Make a request: Send a POST request to /v1/scans to initiate a security audit against your staging server.
  4. Handle webhooks: Configure a webhook endpoint to receive a callback payload when the scan completes.

REST API FAQ

Is the API rate-limited?

Yes. API rate limits depend on your subscription tier to ensure platform stability. However, they are highly generous for typical CI/CD workloads.

Do you provide SDKs?

Currently, we provide official SDKs for Node.js and Python. However, because it's a standard REST API, it can be consumed by any language.

Are Webhooks supported?

Yes, we support secure HTTP webhooks with cryptographic signature verification so your endpoints know the request came from FortPilot.

Key Capabilities

CI/CD Pipeline Blocking

Fail builds automatically in Jenkins, GitLab, or GitHub Actions based on configurable severity thresholds.

Secure Webhook Callbacks

Receive instant, cryptographically signed POST requests to your endpoints when a scan finishes.

Rich JSON Schemas

Parse detailed finding descriptions, CVSS scores, and step-by-step remediation guidance programmatically.

OpenAPI Specification

Integrate faster using our beautifully documented, interactive Swagger OpenAPI specification.

Scoped Bearer Tokens

Generate API keys with strict, least-privilege permissions (e.g., scan-only or read-only access).

Custom Automation

Build custom security bots, Jira ticket auto-generators, or Slack integrations.