Introduction

Welcome

CybeDefend is an advanced API designed for application security analysis. It provides a comprehensive solution for managing users, organizations, and projects. With secure authentication and granular permission management, CybeDefend excels in static, dynamic, and Infrastructure as Code security analyses (SAST, DAST, IaC, etc.).

Base URLs

Requests are region-specific. Use the URL matching your organization’s region:

Region	API base URL
EU	`https://api-eu.cybedefend.com`
US	`https://api-us.cybedefend.com`

Authentication

All API requests require a valid short-lived JWT Bearer token passed in the Authorization header:

Authorization: Bearer <access_token>

Access tokens are obtained by exchanging a Personal Access Token (PAT) through the CybeDefend identity provider.

Obtaining an Access Token (PAT → JWT)

The exchange is performed against the region-specific authentication domain:

Region	Auth URL
EU	`https://auth-eu.cybedefend.com`
US	`https://auth-us.cybedefend.com`

The token exchange requires the CLI application ID (appId). Only the CLI client is authorized to exchange a PAT for an access token — other clients (VS Code, IntelliJ) use a browser-based OAuth flow and have separate app IDs.

Step 1 — Retrieve the CLI Application ID

Fetch the current app IDs for your region:

# EU
curl https://api-eu.cybedefend.com/client-apps

# US
curl https://api-us.cybedefend.com/client-apps

Example response:

{
  "cli": {
    "appId": "fm90ay05zohu8fk2q45ms"
  },
  "vscode": {
    "appId": "r84p1y100lf9hgvoey40c"
  },
  "intellij": {
    "appId": "t40evldybv8uh97gsu7u1"
  }
}

The CLI appId to use:

Region	CLI `appId`
EU	`fm90ay05zohu8fk2q45ms`
US	`7o6r9cvvi8um0kisvn7hm`

These values are provided as a reference. Always verify against the live /client-apps endpoint before using them — the app ID may change between releases.

Step 2 — Exchange Your PAT for an Access Token

Send a POST request to the /oidc/token endpoint of your region’s auth domain, using the urn:ietf:params:oauth:grant-type:token-exchange grant type:

curl -X POST https://auth-eu.cybedefend.com/oidc/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
  -d "client_id=fm90ay05zohu8fk2q45ms" \
  -d "subject_token=YOUR_PAT" \
  -d "subject_token_type=urn:logto:token-type:personal_access_token" \
  -d "resource=https://api-eu.cybedefend.com"

curl -X POST https://auth-us.cybedefend.com/oidc/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
  -d "client_id=7o6r9cvvi8um0kisvn7hm" \
  -d "subject_token=YOUR_PAT" \
  -d "subject_token_type=urn:logto:token-type:personal_access_token" \
  -d "resource=https://api-us.cybedefend.com"

Example response:

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "openid profile email"
}

Step 3 — Call the API

Use the access_token from the response as a Bearer token in all subsequent requests:

curl https://api-eu.cybedefend.com/organizations \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."

Access tokens expire after 10 minutes. Repeat the exchange in Step 2 to obtain a fresh token.

API Key — Deprecated

API Keys are fully deprecated and no longer functional. The X-API-Key header and all API key-based authentication have been removed. Please use Personal Access Tokens (PAT) as described above.

Getting Started

Organization

Project

Team

User

Scanning

Vulnerabilities

SCA Licenses

Reports & Statistics

AI Agent

Policy Management

Source Code Integrations

Container Registries

SSO

Welcome

Base URLs

Authentication

Obtaining an Access Token (PAT → JWT)

Step 1 — Retrieve the CLI Application ID

Step 2 — Exchange Your PAT for an Access Token

Step 3 — Call the API

API Key — Deprecated

​Welcome

​Base URLs

​Authentication

​Obtaining an Access Token (PAT → JWT)

​Step 1 — Retrieve the CLI Application ID

​Step 2 — Exchange Your PAT for an Access Token

​Step 3 — Call the API

​API Key — Deprecated

Welcome

Base URLs

Authentication

Obtaining an Access Token (PAT → JWT)

Step 1 — Retrieve the CLI Application ID

Step 2 — Exchange Your PAT for an Access Token

Step 3 — Call the API

API Key — Deprecated