Nullify API

The Nullify REST API is available to enterprise tenants for automation, reporting, and connector use cases. Each section below documents a functional area of the platform.

All requests require a service-account token sent via the Authorization: Bearer <token> header. See Authentication for details.

For the full machine-readable contract, download the OpenAPI specification.

Key Endpoints

Domain	Endpoint	Purpose
Code Review	GET /sast/events	Stream new findings, suppressions, and fixes for every repository.
Code Review	GET /sast/findings	List open findings with rich filters for ownership, severity, and status.
Code Review	POST /sast/findings/{findingId}/autofix/fix	Queue an automated remediation pull request for supported languages.
Code Review	POST /sast/findings/{findingId}/allowlist	Record a governed exception while keeping audit history intact.
Dependency Analysis	GET /sca/dependencies/findings	Fetch dependency findings with reachability and policy metadata.
Dependency Analysis	POST /sca/dependencies/findings/{findingId}/autofix/fix	Generate upgrade branches or pull requests with updated manifests and lockfiles.
Dependency Analysis	GET /sca/containers/findings	Review container image issues across registries and environments.
Secrets & Data Guardrails	GET /secrets/findings	Enumerate secret, credential, and sensitive-data alerts by repository or service.
Secrets & Data Guardrails	POST /secrets/findings/{findingId}/allowlist	Suppress a finding once the credential is rotated or data remediated.
Pentests	POST /dast/pentest/start	Launch a new autonomous pentest for an onboarded application.
Pentests	GET /dast/pentest/scans/{scanId}/findings	Retrieve findings, reproduction steps, and ownership mapping for a pentest.
Bug Hunts	GET /dast/bughunt/findings	Fetch external attack-surface findings from bug hunts.
Supply Chain Posture	GET /scpm/findings	List supply-chain posture findings (typosquats, unpinned deps, CI/CD hardening).
Cloud Audits	GET /cspm/findings	Pull cloud misconfiguration findings across AWS, GCP, Azure, and Kubernetes.
Cloud Audits	GET /context/applications	Pull the catalog of audited services with their cloud posture classification and owners.
Security Program Management	POST /manager/campaigns	Launch or update campaigns that coordinate remediation across teams and connectors.
Admin	GET /admin/repositories	Sync the repository catalogue, default policies, and ownership assignments.
Admin	GET /admin/teams	Pull team definitions and CODEOWNERS mappings for asynchronous routing.

Security Program Management

Security Program Management does not yet have a dedicated reference page, but its endpoints are available under the /manager namespace and documented in full in the OpenAPI specification. The main endpoint groups are:

Area	Example endpoint	Purpose
Campaigns	GET, POST /manager/campaigns	List, create, and update campaigns; inspect a campaign's findings and events.
Action items	GET /manager/action-items	List the items Nullify has raised for human input, and reopen or resolve them.
Escalations	GET /manager/escalations	List and manage current escalations.
Threat investigations	GET /manager/threat-investigations	Track disclosed threats, affected repositories, and remediation progress.
Strategy	GET /manager/strategy	The rolling quarterly security strategy, with version history.
Chat	GET /manager/chat/sessions	List and inspect chat sessions with Nullify.

Each dedicated page in this section includes usage examples, and the OpenAPI specification provides the full contract for automation.