The RedStrike REST API lets you automate everything you can do in the dashboard: manage targets, launch scans, pull findings, and generate reports. This page is an overview of the core surface.

TL;DR

Authenticate with a bearer API key. Base URL is https://api.redstrike.io/v1. Endpoints exist for targets, scans, findings, reports, and integrations. Responses are JSON; errors use standard HTTP status codes. Keys are scoped by role.

Authentication

Every request carries an API key as a bearer token. Create keys under Settings → API keys (see Roles & Permissions).

curl https://api.redstrike.io/v1/targets \
  -H "Authorization: Bearer $REDSTRIKE_API_KEY"

Keys inherit a role and org scope. Never embed keys in client-side code or commit them to source control — use a secrets manager and rotate regularly.

Base URL and versioning

https://api.redstrike.io/v1

The API is versioned in the path. Breaking changes ship under a new version; additive changes may appear within a version.

Core endpoints

Method & path	Description
`GET /targets`	List targets in the org
`POST /targets`	Add a target (returns verification info)
`GET /targets/{id}`	Fetch a single target
`POST /scans`	Launch a scan for a target
`GET /scans/{id}`	Get scan status and progress
`GET /scans/{id}/findings`	List findings from a scan
`GET /findings`	List/filter findings across the org
`PATCH /findings/{id}`	Update status (accept/dismiss/assign)
`POST /reports`	Generate a report (PDF/JSON/CSV)
`GET /reports/{id}`	Fetch report status / download URL

Launch a scan

curl -X POST https://api.redstrike.io/v1/scans \
  -H "Authorization: Bearer $REDSTRIKE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "target_id": "tgt_123", "profile": "standard" }'

{
  "id": "scan_456",
  "target_id": "tgt_123",
  "profile": "standard",
  "status": "queued",
  "created_at": "2026-07-16T10:00:00Z"
}

Poll GET /scans/scan_456 until status is complete, then read GET /scans/scan_456/findings.

Filtering findings

Most list endpoints accept query parameters for filtering and pagination:

curl "https://api.redstrike.io/v1/findings?severity=critical&status=verified&limit=50" \
  -H "Authorization: Bearer $REDSTRIKE_API_KEY"

Paginated responses include a next_cursor; pass it as ?cursor= to continue.

Errors

The API uses conventional HTTP status codes and a JSON error body:

Status	Meaning
`400`	Invalid request parameters
`401`	Missing or invalid API key
`403`	Key's role lacks permission
`404`	Resource not found in this org
`409`	Conflict (e.g. duplicate target)
`429`	Rate limited — back off and retry

{ "error": { "code": "forbidden", "message": "Key role 'viewer' cannot run scans." } }

Rate limits

Requests are rate-limited per key. When you receive 429, honor the Retry-After header before retrying.

API Reference