API quickstart
The Platform API is a JSON:API over HTTPS. This page covers the base URL, authentication, and conventions. For the full schema, see the Platform API reference.
Base URL
Section titled “Base URL”https://api.disclosebot.io/v1Authentication
Section titled “Authentication”Authenticated requests use a Bearer token in the Authorization header:
curl https://api.disclosebot.io/v1/policies \ -H "Authorization: Bearer disclosebot_svc_xxxxxxxx"Tokens are prefixed by the kind of holder they belong to:
| Prefix | Holder |
|---|---|
disclosebot_svc_… | An organization service account token (server-to-server integration). |
Create service accounts and mint tokens from API Service Accounts in the app. Treat tokens as secrets; keep them out of source control and rotate them if exposed.
Conventions
Section titled “Conventions”- Format: requests and responses follow JSON:API. Send and accept
application/vnd.api+json. - Resources: the API exposes
policies,briefs,vulns,assets,organizations,directory_listings, and more. See the reference for the full list and schemas. - Relationships, filtering, and pagination follow JSON:API conventions.
Public read endpoints (no auth)
Section titled “Public read endpoints (no auth)”Published policies, briefs, and portals can be read without a token, by id or shortcode:
curl https://api.disclosebot.io/v1/p/policies/<shortcode>curl https://api.disclosebot.io/v1/p/briefs/<shortcode>- Browse the Platform API reference.
- Embed a policy on your site; see Share & embed a policy.