API Reference
Relevant source files
The following files were used as context for generating this wiki page:
The FixOps API is a comprehensive RESTful interface designed to facilitate automated security decision-making, artifact ingestion, and DevSecOps orchestration. It serves as the central hub for integrating security tools (SAST, SCA, DAST), business context, and cloud findings into a unified pipeline. The API surface covers 291 endpoints, providing deep integration for enterprise workflows, compliance reporting, and automated remediation.
Sources: CLI_API_INVENTORY.md:129-130, tests/e2e/comprehensive_e2e_test.py:1176-1178
Core Pipeline and Ingestion
The ingestion layer is responsible for receiving security artifacts and normalizing them for the processing pipeline. It supports diverse formats including SARIF, CycloneDX, and SPDX.
Data Flow for Artifact Ingestion
The following diagram illustrates the flow from artifact submission to pipeline readiness:
The system utilizes specific loaders for different security findings, ensuring that data is correctly parsed before being registered in the runtime state.
Sources: CLI_API_INVENTORY.md:179-218, tests/test_comprehensive_e2e.py:35-132
Primary Ingestion Endpoints
| Endpoint | Method | Purpose | Supported Formats |
|---|---|---|---|
/inputs/sarif | POST | Static analysis findings | SARIF 2.1.0 |
/inputs/sbom | POST | Software Bill of Materials | CycloneDX (v1.4/1.5), SPDX, Syft JSON |
/inputs/cve | POST | Vulnerability feeds | NVD JSON 5.0 |
/inputs/cnapp | POST | Cloud security findings | AWS Security Hub, Azure Defender, GCP SCC |
/inputs/design | POST | Architecture context | CSV |
Sources: CLI_API_INVENTORY.md:189-218, samples/api-examples/README.md:46-95, tests/e2e/comprehensive_e2e_test.py:168-175
Security Decision Engine
The Decision Engine evaluates ingested findings against business context and AI-driven analysis. It provides verdicts such as allow, block, or review based on weighted consensus from multiple Large Language Models (LLMs).
LLM Consensus Architecture
FixOps employs a multi-model approach to ensure accuracy and reduce false positives.
The engine computes consensus confidence by analyzing the variance between model outputs; high variance triggers an "expert validation" flag.
Sources: samples/api-examples/README.md:113-137, tests/e2e/comprehensive_e2e_test.py:1000-1045
Infrastructure and Inventory
This module manages the registration of applications, services, and teams, providing the necessary metadata for risk-based decisions.
Application Registration Parameters
When registering an application via POST /api/v1/inventory/applications, the following fields are required or recommended:
- name: Unique identifier for the application.
- criticality: Business impact level (e.g.,
critical,high,medium). - data_classification: Type of data handled (e.g.,
PII,PCI,PHI). - internet_facing: Boolean indicating public exposure.
- tech_stack: Primary language or framework (e.g.,
java,python,rust).
Sources: tests/e2e/comprehensive_e2e_test.py:465-475, samples/api-examples/README.md:185-195
Integration and Webhooks
FixOps supports bidirectional integration with enterprise tools such as Jira, ServiceNow, and Slack.
Webhook Event Handling
The API provides dedicated receivers for external events:
/api/v1/webhooks/jira: Processes issue updates and transitions./api/v1/webhooks/servicenow: Receives incident events./api/v1/webhooks/outbox: Manages outbound events destined for external systems.
Sources: CLI_API_INVENTORY.md:144-162, samples/api-examples/README.md:450-465
Advanced Testing and Analysis
Beyond standard ingestion, FixOps offers specialized modules for reachability analysis and AI-powered penetration testing (PentAGI).
PentAGI Logic
PentAGI automates vulnerability verification through targeted scanning and exploit simulation.
Key Analytics Endpoints
The analytics module provides insights into security posture and pipeline ROI:
GET /api/v1/analytics/dashboard/overview: High-level security metrics.GET /api/v1/analytics/mttr: Mean Time to Remediation statistics.GET /api/v1/analytics/noise-reduction: Impact of AI-driven deduplication.
Sources: CLI_API_INVENTORY.md:131-135, tests/e2e/comprehensive_e2e_test.py:900-915
Conclusion
The FixOps API Reference provides the technical foundation for a high-performance security decision platform. By leveraging artifact normalization, multi-LLM consensus, and deep enterprise integrations, the API enables teams to automate security gating with high confidence and minimal latency. Success in deployment relies on correct artifact ingestion and the enrichment of findings with business-specific criticality and classification data.
Sources: tests/e2e/comprehensive_e2e_test.py:1260-1285, samples/api-examples/README.md:650-670