Changelog

1.7.0 (October 2026)

• New: Asset Discovery. Everything that can be done on the Asset Discovery pages can now be done through the API: list discovered assets (GET /api/v1/(api_key)/discovery/groups, GET /api/v1/(api_key)/discovery/group/(group_id)), add them to scope (POST /api/v1/(api_key)/discovery/add), suppress and restore them (POST /api/v1/(api_key)/discovery/suppress, POST /api/v1/(api_key)/discovery/unsuppress), see scope usage and the discovery schedule (GET /api/v1/(api_key)/discovery/stats), export them as CSV (GET /api/v1/(api_key)/discovery/export), and request a licence upgrade (POST /api/v1/(api_key)/discovery/upgrade).

1.6.0 (October 2026)

• POST /api/v1/(api_key)/vulnerability/(vulnerability_id)/update accepts a suppression period in days when setting the false_positive or acceptable_risk status, using the same periods as the web interface (14, 30, 60, 90, 180, 366 or 99999 for permanent). Previously the API always applied the 14-day default.

1.5.0 (October 2026)

• New: download reports. GET /api/v1/(api_key)/scan/(scan_id)/report reports on a scan’s latest run and GET /api/v1/(api_key)/scan/(scan_id)/run/(run_id)/report on a given run.
• Two report types: full (docx, xlsx or csv) and executive (pdf).
• Reports can be filtered by severity and by a list of vulnerability status values (default unfixed,investigating).
• The request blocks until the report is ready and returns the file. Reports are cached for up to 30 minutes; no_cache=1 builds a new one. A build that is still running after the request’s wait returns 202 with Retry-After, and retrying waits for the same build.
• The run id of GET /api/v1/(api_key)/scan/(scan_id)/run/(run_id)/report must belong to the scan in the URL.

1.4.2 (November 2023)

• Vuln lists now support severity and priority.
• Fixed the bug where proiority was mapping to severity

1.4.1 (November 2023)

• Scan configuration now accepts tags.

1.4 (September 2023)

• API service re-built and updated to take advantage of new database models and resources

1.3 (September 2019)

• CST Vulnerabilities can be viewed, confirmed, created, updated, deleted.

1.2 (May 2019)

• Vulnerabilities can be deleted.
• Scan results can be deleted.
• Added parameters to the Vulnerabilities detail endpoint.

1.1 (July 2018)

• Scan profiles can be used for new/update of scan definitions.
• Include the vulnerabilities count (grouped by severity) in the data returned for a given run.

1.0 (September 2017)

Initial version.