Cloud Audits API
Query cloud audit posture findings and asset inventories via the Nullify API
Posture findings live under the
/cspmnamespace. Asset-inventory and organizational-context lookups live under the/contextnamespace.
Cloud Audits (CSPM) covers AWS, GCP, Azure, and Kubernetes. Auditing is automatic — Nullify audits whenever a connected account's inventory refreshes, rather than on a fixed schedule.
Base URL
https://api.<TENANT>.nullify.ai
List Findings
Retrieve cloud misconfiguration findings across your connected AWS, GCP, Azure, and Kubernetes accounts:
Returns a filtered set of CSPM findings based on query parameters
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
Maximum number of findings to return
Token for pagination
Sort order (asc or desc)
Field to sort by (priority, time, severity)
Filter by severity
Filter by status
Filter by account ID
Filter by region
Filter by resource type
Filter by scan ID
OK
Bad Request
Internal Server Error
GET /cspm/findings HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"findings": [
{
"accountId": "text",
"accountName": "text",
"aiDevTitle": "text",
"aiTitle": "text",
"allowlistReason": "text",
"allowlistType": "AI",
"category": "text",
"cloudProvider": "text",
"complianceFrames": [
{
"control": "text",
"framework": "text",
"version": "text"
}
],
"createdAt": "text",
"id": "text",
"isAllowlisted": true,
"isArchived": true,
"isFalsePositive": true,
"isLatest": true,
"isResolved": true,
"message": "text",
"priorityLabel": "URGENT",
"priorityOverride": "URGENT",
"priorityScore": 1,
"region": "text",
"resourceArn": "text",
"resourceId": "text",
"resourceName": "text",
"resourceType": "text",
"ruleId": "text",
"ruleUrl": "text",
"severity": "CRITICAL",
"tenantId": "text",
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "Nullify"
},
"title": "text",
"triageEnd": "2026-01-01T00:00:00.000Z",
"triageStart": "2026-01-01T00:00:00.000Z",
"updatedAt": "text"
}
],
"nextToken": "text",
"numItems": 1,
"version": "text"
}Get a Finding
Pull full detail for a single posture finding, including affected resource and remediation guidance:
Returns a specific CSPM finding by ID
ID of the CSPM finding
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Not Found
Internal Server Error
GET /cspm/findings/{findingId} HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"finding": {
"accountId": "text",
"accountName": "text",
"aiDevTitle": "text",
"aiTitle": "text",
"allowlistReason": "text",
"allowlistType": "AI",
"autoFixCurrentActivity": "text",
"autoFixEndTime": "2026-01-01T00:00:00.000Z",
"autoFixStartTime": "2026-01-01T00:00:00.000Z",
"autoFixState": "none",
"autofixVerdictAt": "2026-01-01T00:00:00.000Z",
"autofixVerdictExplanation": "text",
"autofixVerdictReason": "AGENT_ERROR",
"budgetExhausted": true,
"budgetLimit": 1,
"budgetUsed": 1,
"category": "text",
"cloudProvider": "text",
"complianceFrames": [
{
"control": "text",
"framework": "text",
"version": "text"
}
],
"concurrencyLimit": 1,
"createdAt": "text",
"currentConfig": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"deletedAt": "2026-01-01T00:00:00.000Z",
"description": "text",
"devDescription": "text",
"expectedConfig": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"exploitabilityConfidence": "text",
"exploitabilityLabel": "text",
"failedTriage": true,
"fixCommit": "text",
"fixSource": "text",
"fixedAt": "2026-01-01T00:00:00.000Z",
"id": "text",
"impactConfidence": "text",
"impactLabel": "text",
"installationId": "text",
"isAllowlisted": true,
"isArchived": true,
"isAutoFixableAgentVerdict": true,
"isFalsePositive": true,
"isFixed": true,
"isLatest": true,
"isResolved": true,
"message": "text",
"platform": "text",
"priorityLabel": "URGENT",
"priorityLabelReason": "text",
"priorityOverride": "URGENT",
"priorityScore": 1,
"pullRequestsAutofix": [
{
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "Nullify"
},
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"region": "text",
"resolvedAt": "2026-01-01T00:00:00.000Z",
"resourceArn": "text",
"resourceId": "text",
"resourceName": "text",
"resourceTags": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"resourceType": "text",
"ruleId": "text",
"ruleUrl": "text",
"scanId": "text",
"severity": "CRITICAL",
"severityConfidence": "text",
"severityLabel": "CRITICAL",
"severityOverride": "CRITICAL",
"severityScore": 1,
"tenantId": "text",
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "Nullify"
},
"ticketState": "text",
"title": "text",
"triageAgentVersion": "text",
"triageDurationSeconds": 1,
"triageEnd": "2026-01-01T00:00:00.000Z",
"triageLlmCostUsd": 1,
"triageStart": "2026-01-01T00:00:00.000Z",
"triageTokenCount": 1,
"triageTraceId": "text",
"updatedAt": "text",
"userNotes": "text"
},
"version": "text"
}Create a Ticket for a Finding
Open a tracking ticket for a posture finding:
Creates a ticket for a given CSPM finding on the tenant's configured ticket integration
The ID of the CSPM finding to create a ticket for
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Internal Server Error
Not Implemented
POST /cspm/findings/{findingId}/ticket HTTP/1.1
Host: api.<TENANT>.nullify.ai
Content-Type: application/json
Accept: */*
Content-Length: 987
{
"assignees": [
{
"asana": {
"id": "text"
},
"azure": {
"id": "text"
},
"azureEntra": {
"id": "text"
},
"bitbucket": {
"id": "text"
},
"createdAt": "text",
"createdBy": "text",
"email": "text",
"github": {
"id": 1,
"nodeId": "text"
},
"gitlab": {
"id": 1
},
"googleWorkspace": {
"id": "text"
},
"id": "text",
"isBot": true,
"jira": {
"id": "text",
"name": "text"
},
"lastUpdatedBy": "text",
"linear": {
"id": "text"
},
"name": "text",
"okta": {
"id": "text"
},
"provider": {
"asana": {
"id": "text"
},
"azure": {
"id": "text"
},
"azureEntra": {
"id": "text"
},
"bitBucket": {
"id": "text"
},
"gitHub": {
"id": 1,
"nodeId": "text"
},
"gitlab": {
"id": 1
},
"googleWorkspace": {
"id": "text"
},
"id": "Nullify",
"jira": {
"id": "text",
"name": "text"
},
"linear": {
"id": "text"
},
"okta": {
"id": "text"
},
"slack": {
"id": "text",
"name": "text"
},
"teams": {
"id": "text",
"teamIDs": [
"text"
]
}
},
"slack": {
"id": "text",
"name": "text"
},
"slug": "text",
"teams": {
"id": "text",
"teamIDs": [
"text"
]
},
"updatedAt": "text",
"username": "text"
}
],
"campaignId": "text",
"campaignTitle": "text",
"message": "text",
"project": "text",
"userCanonicalId": "text"
}{
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "Nullify"
},
"version": "text"
}List Scans
Review the cloud scans Nullify has executed for your accounts:
Returns a list of CSPM scans
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
Maximum number of scans to return
Token for pagination
Pagination offset; overrides nextToken when set
Filter by scan status
Filter by account ID
Filter by region
Filter by scan type
Server-side text search over account / region / provider
OK
Bad Request
Internal Server Error
GET /cspm/scans HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"nextToken": "text",
"numItems": 1,
"scans": [
{
"accountId": "text",
"accountName": "text",
"cloudProvider": "AWS",
"createdAt": "text",
"duration": 1,
"endedAt": "2026-01-01T00:00:00.000Z",
"findingsCount": 1,
"id": "text",
"isArchived": true,
"progress": 1,
"region": "text",
"regionsToScan": [
"text"
],
"scanType": "full",
"scannerVersion": "text",
"startedAt": "2026-01-01T00:00:00.000Z",
"status": "queued",
"summary": {
"criticalFindings": 1,
"failedChecks": 1,
"highFindings": 1,
"infoFindings": 1,
"lowFindings": 1,
"mediumFindings": 1,
"passedChecks": 1,
"resourcesScanned": 1,
"rulesEvaluated": 1,
"totalFindings": 1
},
"tenantId": "text",
"updatedAt": "text"
}
],
"totalCount": 1,
"version": "text"
}Get a Scan
Returns a specific CSPM scan by ID
ID of the CSPM scan
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Not Found
Internal Server Error
GET /cspm/scans/{scanId} HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"scan": {
"accountId": "text",
"accountName": "text",
"cloudProvider": "AWS",
"createdAt": "text",
"duration": 1,
"endedAt": "2026-01-01T00:00:00.000Z",
"executionArn": "text",
"failureReason": "text",
"findingsCount": 1,
"findingsS3Bucket": "text",
"findingsS3Key": "text",
"id": "text",
"installationId": "text",
"isArchived": true,
"platform": "text",
"progress": 1,
"region": "text",
"regionsToScan": [
"text"
],
"resourceCoverage": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"resourceTypes": [
"text"
],
"rulesToScan": [
"text"
],
"scanConfig": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"scanType": "full",
"scannerConfig": "text",
"scannerVersion": "text",
"startedAt": "2026-01-01T00:00:00.000Z",
"status": "queued",
"summary": {
"criticalFindings": 1,
"failedChecks": 1,
"highFindings": 1,
"infoFindings": 1,
"lowFindings": 1,
"mediumFindings": 1,
"passedChecks": 1,
"resourcesScanned": 1,
"rulesEvaluated": 1,
"totalFindings": 1
},
"tenantId": "text",
"updatedAt": "text"
},
"version": "text"
}Autofix
Where a misconfiguration maps to an infrastructure-as-code change, Nullify can generate a fix and open a pull request against the code that provisioned the resource. Trigger a fix, then preview the cached diff before a PR is opened:
Generates a fix and creates an IaC pull request for a CSPM finding.
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Conflict
Internal Server Error
POST /cspm/findings/{findingId}/autofix/fix HTTP/1.1
Host: api.<TENANT>.nullify.ai
Content-Type: application/json
Accept: */*
Content-Length: 472
{
"force": true,
"gitRepositoryProvider": {
"azure": {
"projectId": "text",
"projectName": "text",
"repositoryId": "text",
"repositoryName": "text"
},
"bitbucket": {
"projectKey": "text",
"projectName": "text",
"repositoryId": "text",
"repositoryName": "text"
},
"github": {
"hasIssue": true,
"nodeId": "text",
"owner": "text",
"ownerId": 1,
"repositoryId": 1,
"repositoryName": "text"
},
"gitlab": {
"projectId": 1,
"projectName": "text"
},
"id": "Nullify"
},
"message": "text",
"originCampaignId": "text",
"useCachedFix": true
}{
"autoFixState": "none",
"error": "text",
"version": "text"
}Asset Inventory
Asset-inventory and organizational-context lookups live under the /context namespace. Use these to retrieve the application catalog and the service graph Nullify uses to route cloud audit findings to the right owners:
The context service also exposes /context/applications/{applicationId}, /context/repositories, /context/repositories/{repositoryId}, and /context/applications/rebuild for managing the asset inventory.
Cloud Audits enrich these datasets with misconfiguration evidence before handing work to Security Program Management campaigns and autofix.
Last updated