> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> CybeDefend API Documentation for Application Security Analysis

## Welcome

CybeDefend is an advanced API designed for application security analysis. It provides a comprehensive solution for managing users, organizations, and projects. With secure authentication and granular permission management, CybeDefend excels in static, dynamic, and Infrastructure as Code security analyses (SAST, DAST, IaC, etc.).

## Base URLs

Requests are region-specific. Use the URL matching your organization's region:

| Region | API base URL                    |
| ------ | ------------------------------- |
| EU     | `https://api-eu.cybedefend.com` |
| US     | `https://api-us.cybedefend.com` |

## Authentication

All API requests require a valid short-lived **JWT Bearer token** passed in the `Authorization` header:

```
Authorization: Bearer <access_token>
```

Access tokens are obtained by exchanging a **Personal Access Token (PAT)** through the CybeDefend identity provider.

***

## Obtaining an Access Token (PAT → JWT)

The exchange is performed against the region-specific authentication domain:

| Region | Auth URL                         |
| ------ | -------------------------------- |
| EU     | `https://auth-eu.cybedefend.com` |
| US     | `https://auth-us.cybedefend.com` |

The token exchange requires the **CLI application ID** (`appId`). Only the CLI client is authorized to exchange a PAT for an access token — other clients (VS Code, IntelliJ) use a browser-based OAuth flow and have separate app IDs.

### Step 1 — Retrieve the CLI Application ID

Fetch the current app IDs for your region:

```bash theme={null}
# EU
curl https://api-eu.cybedefend.com/client-apps

# US
curl https://api-us.cybedefend.com/client-apps
```

Example response:

```json theme={null}
{
  "cli": {
    "appId": "fm90ay05zohu8fk2q45ms"
  },
  "vscode": {
    "appId": "r84p1y100lf9hgvoey40c"
  },
  "intellij": {
    "appId": "t40evldybv8uh97gsu7u1"
  }
}
```

The CLI `appId` to use:

| Region | CLI `appId`             |
| ------ | ----------------------- |
| EU     | `fm90ay05zohu8fk2q45ms` |
| US     | `7o6r9cvvi8um0kisvn7hm` |

<Note>
  These values are provided as a reference. Always verify against the live `/client-apps` endpoint before using them — the app ID may change between releases.
</Note>

***

### Step 2 — Exchange Your PAT for an Access Token

Send a `POST` request to the `/oidc/token` endpoint of your region's auth domain, using the `urn:ietf:params:oauth:grant-type:token-exchange` grant type:

<CodeGroup>
  ```bash EU theme={null}
  curl -X POST https://auth-eu.cybedefend.com/oidc/token \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
    -d "client_id=fm90ay05zohu8fk2q45ms" \
    -d "subject_token=YOUR_PAT" \
    -d "subject_token_type=urn:logto:token-type:personal_access_token" \
    -d "resource=https://api-eu.cybedefend.com"
  ```

  ```bash US theme={null}
  curl -X POST https://auth-us.cybedefend.com/oidc/token \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
    -d "client_id=7o6r9cvvi8um0kisvn7hm" \
    -d "subject_token=YOUR_PAT" \
    -d "subject_token_type=urn:logto:token-type:personal_access_token" \
    -d "resource=https://api-us.cybedefend.com"
  ```
</CodeGroup>

Example response:

```json theme={null}
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "openid profile email"
}
```

***

### Step 3 — Call the API

Use the `access_token` from the response as a Bearer token in all subsequent requests:

```bash theme={null}
curl https://api-eu.cybedefend.com/organizations \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
```

Access tokens expire after 10 minutes. Repeat the exchange in Step 2 to obtain a fresh token.

***

## API Key — Deprecated

<Warning>
  **API Keys are fully deprecated and no longer functional.** The `X-API-Key` header and all API key-based authentication have been removed. Please use Personal Access Tokens (PAT) as described above.
</Warning>