Prepare a system
Set up organisation and system context, configure assessment projects and maintain supporting contacts and registers using the appropriate scoped credentials.
API and integrations
Connect your tools to your assessment work.
Connect scripts, agents and integration tools to read and update assessment records, attach evidence and generate documents. Use scoped read/write tokens for the work you want to automate.
Scripts, agents and integrationsPreparation, evidence collection and assessment work
Scoped API tokenRead/write access with selected permissions
Your SecBoost recordsSystem context, controls, evidence, assessments and documents
Retrieve records and outputs. Send updates, evidence and generation requests.
Support preparation and assessment.
Use the API for the repeated work around an assessment, while keeping records in the same project workflow.
Keep evidence connected
Update implementation notes, upload configuration exports and link supporting records to the relevant control. Maintain evidence metadata as the system changes.
Perform assessment work
Read authorised evidence and assessment information, record assessment details and perform permitted workflow transitions. The normal review and approval rules still apply.
Produce and retrieve documents
Maintain document-library content, request Documentation Suite generation, check its status and download the resulting output when it is ready.
Give your integration the access it needs.
Choose a target, select the relevant permissions and enable read/write access to maintain records and run supported workflows. Set an expiry and revoke the token when it is no longer needed.
API requests follow the owner’s current access, the product tier and normal workflow rules. Approval permissions are selected explicitly.
Explore the developer resources.
Browse the API guide and permissions, or download the OpenAPI definition to plan your integration. The guide covers setup, reads, updates, evidence uploads and document generation.
For writes, follow the documented concurrency and retry rules. Check status after asynchronous operations such as evidence uploads and document generation.
- Read the API and agent guideWorkflows, request examples and recovery
- Read authentication and permissionsToken types, scope and read/write access
- Download the OpenAPI definitionPaths, fields and operation permissions
Public documentation snapshot: 2026-10-09. Your deployment’s documentation describes its installed version.
Already using SecBoost? Get your deployment’s documentation
Developer resources for
Working with the API
API questions
Can agents update SecBoost through the API?
Yes. With a read/write token and the relevant permissions, an agent can update implementation and assessment records, attach evidence and request document generation. The same scope, access and workflow rules apply as for other integrations.
What if I want an agent to have read-only access?
Create a read-only token for the records it needs. The agent can summarise evidence, prepare reports or transfer permitted data to another system, without editing SecBoost. It can download existing document outputs, but generating new SecBoost documents requires read/write access.
Does an API token grant access to everything?
No. Access depends on the selected permissions, credential type and target, the owner’s current permissions and access, product tier and normal workflow rules. Project credentials are bound to one project; organisation credentials support the permitted work within one organisation.
Which documentation should I use?
Use the public snapshot to explore the API and plan an integration. When connecting to SecBoost, use the guides and OpenAPI definition served by your deployment: they describe the contract for its installed version.
Are these ready-made integrations?
The API supports your own scripts, agents and integration tools. The examples on this page describe workflows you can build using the API. They do not imply a preconfigured connector to every reporting or assurance platform.
What would you like to connect?
Tell us which records you need, which tools use them and whether your integration needs to read or write.