Skip to main content

API

Everything you can do in the Red Kite interface, and more, is available through the API. Use it to automate your workflows, feed Red Kite with data from other systems, or send Red Kite's results to the tools your teams already use.

Authentication​

The API uses API keys. Create one in your profile, then pass it in the x-api-key header of every request. See API keys.

export RK_API_KEY="my key value"
curl -H "x-api-key: $RK_API_KEY" https://<your-red-kite-url>/api/

The API is available under /api/ on your Red Kite URL. An unauthenticated GET /api/ping request replies with a simple string, which is handy to check connectivity.

Reference documentation​

The OpenAPI documentation of your instance lists every endpoint, with its parameters and responses:

  • Swagger UI: https://<your-red-kite-url>/api/docs/
  • OpenAPI JSON: https://<your-red-kite-url>/api/docs-json

Filtering​

The endpoints that list resources and intel accept the same query language as the interface. For instance, confidence:verified port:22 returns the verified SSH ports. See Searching for the full syntax.

Integrating third-party systems​

Red Kite can be connected to your other tools in three ways.

As a data source​

Feed Red Kite with data coming from other systems, such as a CMDB, a DNS provider, a cloud provider or an IP address management tool:

  • with a job that queries the system and emits findings for the domains, hosts and IP ranges it knows, triggered by a cron subscription;
  • or with a script that pushes the data to the API.

As an output​

Send Red Kite's results to the systems your teams already use. For example:

  • open Jira tickets for new intel or new verified resources;
  • send the new resources of the week to a chat channel;
  • export the resources in JSON or CSV for reporting.

A script using the API can query the resources and intel with the same filters as the interface, for instance is:open severity:critical on intel.

For orchestration​

Use Red Kite as the source of truth to drive other tools. For example, launch Nessus scans on the assets you verified: a job that calls the Nessus API with a secret, run by a subscription, or an external script that gets the hosts matching confidence:verified from the API and starts the scans.

tip

Create a dedicated user for each integration, with only the permissions it needs, and give its API key an expiration date. See Managing roles and permissions.