API reference

SpectraPRO API at a glance

The JSON API is served below `/api`. Workspace endpoints require authenticated access, and trial capabilities use the API credential issued to the requester.

Last updated 14 July 2026

Core resources

Authentication

`POST /api/auth/register` and `POST /api/auth/login` establish workspace access.

Assets

`GET /api/assets` lists authorized assets; asset creation accepts the supported target types and environment metadata.

Scans

`POST /api/scans` starts an assessment, while `GET /api/scans` and `GET /api/scans/:id` return status and results.

Response and safety conventions

JSON contracts

Requests and responses use JSON unless an export endpoint explicitly returns a document.

Tenant scope

Authenticated resources are restricted to the caller's authorized workspace and role.

Rate and authorization errors

Clients should handle 401, 403, 404, 409, 429, and 5xx responses without automatically widening scan scope.

Next step