{ "info": { "name": "CMDash Public API (v2 + v1)", "description": "Postman collection for the CMDash Public API, generated from the published OpenAPI document (apps/portal/public/docs/openapi.json), which is itself the runtime spec. V2 folders come first — v2 is the current version; v1 folders follow and are deprecated (sunset Wed, 24 Feb 2027 00:00:00 GMT). See docs/developers/public-api-versioning.md.\n\nSet the `apiKey` collection variable to a CMDash API key (Settings → API Keys). Requests with a `:param` segment bind it from the request's Path Variables tab; optional query parameters ship disabled, tick the ones you want.", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "item": [ { "name": "V2 Assets", "description": "Current API version — use this for new integrations.", "item": [ { "name": "List assets", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Paginated, newest-stable ordering. Read-only; requires the `assets:read` key permission.", "url": { "raw": "{{baseUrl}}/v2/assets?assetType=&criticality=&limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "assets" ], "query": [ { "key": "assetType", "value": "", "disabled": true }, { "key": "criticality", "value": "", "disabled": true }, { "key": "limit", "value": "", "description": "Max results (default 50, maximum 500; a larger value is clamped, a non-numeric value is a 400)", "disabled": true }, { "key": "offset", "value": "", "description": "Rows to skip", "disabled": true } ] } } }, { "name": "Get one asset by id", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Requires the `assets:read` key permission.", "url": { "raw": "{{baseUrl}}/v2/assets/:id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "assets", ":id" ], "variable": [ { "key": "id", "value": "", "description": "Asset UUID" } ] } } } ] }, { "name": "V2 Audit-logs", "description": "Current API version — use this for new integrations.", "item": [ { "name": "List audit logs with pagination and optional filters", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": { "raw": "{{baseUrl}}/v2/audit-logs?page=&limit=&action=&from=&to=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "audit-logs" ], "query": [ { "key": "page", "value": "", "disabled": true }, { "key": "limit", "value": "", "disabled": true }, { "key": "action", "value": "", "description": "Filter by action prefix (e.g. \"user.\", \"integration.\")", "disabled": true }, { "key": "from", "value": "", "description": "ISO 8601 start date", "disabled": true }, { "key": "to", "value": "", "description": "ISO 8601 end date", "disabled": true } ] } } }, { "name": "Export audit logs as CSV or JSON for external auditors", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "CSV is UTF-8 WITH a byte order mark, CRLF records (RFC 4180) and Title Case headers (ID, Timestamp, User Email, User Name, Action, Resource, IP Address, Metadata) — the format changed in v8.13.0; see docs/developers/public-api-versioning.md \"v2 CSV export format change\". The filename is cmdash--audit-log-.csv. An empty date range returns 200 with a header row and no data rows (it used to 404). The export is capped at 10,000 rows: X-Total-Count is how many rows match the range, X-Truncated says whether the cap applied, X-Ceiling is the cap, and a capped CSV ends with a trailer row saying so. X-Total-Records (rows in the file) is unchanged.", "url": { "raw": "{{baseUrl}}/v2/audit-logs/export?format=&from=&to=&action=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "audit-logs", "export" ], "query": [ { "key": "format", "value": "", "description": "Export format (default: csv)", "disabled": true }, { "key": "from", "value": "", "description": "ISO 8601 start date (default: 90 days ago)", "disabled": true }, { "key": "to", "value": "", "description": "ISO 8601 end date (default: now)", "disabled": true }, { "key": "action", "value": "", "description": "Filter by action prefix", "disabled": true } ] } } } ] }, { "name": "V2 Collector", "description": "Current API version — use this for new integrations.", "item": [ { "name": "Connector definitions this tenant has marked COLLECTOR-mode. Never includes credentials — a collector supplies those from its own environment.", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": { "raw": "{{baseUrl}}/v2/collector/definitions?connectorId=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "collector", "definitions" ], "query": [ { "key": "connectorId", "value": "", "disabled": true } ] } } }, { "name": "Register the collector’s Ed25519 public key with a one-time token and a proof of possession. The private key never leaves the collector.", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"enrollmentId\": \"\",\n \"registrationToken\": \"\",\n \"publicKey\": \"\",\n \"proof\": \"\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/collector/keys", "host": [ "{{baseUrl}}" ], "path": [ "v2", "collector", "keys" ] } } }, { "name": "Replace the collector’s key; the rotation is signed by BOTH the registered key and the new one.", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"enrollmentId\": \"\",\n \"newPublicKey\": \"\",\n \"t\": 0,\n \"proofOld\": \"\",\n \"proofNew\": \"\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/collector/keys/rotate", "host": [ "{{baseUrl}}" ], "path": [ "v2", "collector", "keys", "rotate" ] } } }, { "name": "Push results collected inside your own network. Requires a valid X-CMDash-Collector-Signature.", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"connectorId\": \"conn-uuid-001\",\n \"collectedAt\": \"2026-03-31T12:00:00.000Z\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/collector/push", "host": [ "{{baseUrl}}" ], "path": [ "v2", "collector", "push" ] } } } ] }, { "name": "V2 Compliance", "description": "Current API version — use this for new integrations.", "item": [ { "name": "List compliance frameworks with progress", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Identical to v1.", "url": { "raw": "{{baseUrl}}/v2/compliance/frameworks", "host": [ "{{baseUrl}}" ], "path": [ "v2", "compliance", "frameworks" ] } } }, { "name": "Get control statuses for a framework", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns all controls for a framework with their current assessment status and notes. v2 change from v1: an unknown slug now returns a real 404 with the standard error envelope instead of v1's `200 { error: 'Framework not found' }` — see docs/developers/public-api-versioning.md.", "url": { "raw": "{{baseUrl}}/v2/compliance/frameworks/:slug/controls", "host": [ "{{baseUrl}}" ], "path": [ "v2", "compliance", "frameworks", ":slug", "controls" ], "variable": [ { "key": "slug", "value": "cmmc-l2", "description": "Framework slug (e.g., cmmc-l2, nist-csf, iso-27001)" } ] } } }, { "name": "Get compliance progress across all frameworks", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Identical to v1.", "url": { "raw": "{{baseUrl}}/v2/compliance/progress", "host": [ "{{baseUrl}}" ], "path": [ "v2", "compliance", "progress" ] } } } ] }, { "name": "V2 Evidence", "description": "Current API version — use this for new integrations.", "item": [ { "name": "List evidence items", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Paginated, newest-stable ordering. Read-only; requires the `evidence:read` key permission.", "url": { "raw": "{{baseUrl}}/v2/evidence?status=&collectionMethod=&frameworkSlug=&controlId=&limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "evidence" ], "query": [ { "key": "status", "value": "", "disabled": true }, { "key": "collectionMethod", "value": "", "disabled": true }, { "key": "frameworkSlug", "value": "", "disabled": true }, { "key": "controlId", "value": "", "disabled": true }, { "key": "limit", "value": "", "description": "Max results (default 50, maximum 500; a larger value is clamped, a non-numeric value is a 400)", "disabled": true }, { "key": "offset", "value": "", "description": "Rows to skip", "disabled": true } ] } } }, { "name": "File evidence against controls from your own tooling", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Rows are filed with collectionMethod=INTEGRATION and status=COLLECTED — a machine push is an integration signal, not something awaiting human review. Send an Idempotency-Key header to make a retry safe.", "body": { "mode": "raw", "raw": "{\n \"items\": [\n {\n \"title\": \"\",\n \"controlId\": \"\",\n \"frameworkSlug\": \"\"\n }\n ]\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/evidence", "host": [ "{{baseUrl}}" ], "path": [ "v2", "evidence" ] } } }, { "name": "Get one evidence by id", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Requires the `evidence:read` key permission.", "url": { "raw": "{{baseUrl}}/v2/evidence/:id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "evidence", ":id" ], "variable": [ { "key": "id", "value": "", "description": "Evidence UUID" } ] } } } ] }, { "name": "V2 Gate", "description": "Current API version — use this for new integrations.", "item": [ { "name": "Evaluate the posture-as-code CI gate", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Identical to v1 — see /v1/gate/evaluate for the full check description.", "body": { "mode": "raw", "raw": "{\n \"scoreDropThreshold\": 5,\n \"blockOnControlRegression\": true,\n \"controlRegressionWindowDays\": 30,\n \"blockOnExpiredException\": true,\n \"modelSlug\": \"cmmc-l2\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/gate/evaluate", "host": [ "{{baseUrl}}" ], "path": [ "v2", "gate", "evaluate" ] } } }, { "name": "Get the effective gate policy (defaults if never configured)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Identical to v1.", "url": { "raw": "{{baseUrl}}/v2/gate/policy", "host": [ "{{baseUrl}}" ], "path": [ "v2", "gate", "policy" ] } } } ] }, { "name": "V2 Incidents", "description": "Current API version — use this for new integrations.", "item": [ { "name": "List incidents", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Paginated, newest-stable ordering. Read-only; requires the `incidents:read` key permission.", "url": { "raw": "{{baseUrl}}/v2/incidents?status=&severity=&limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "incidents" ], "query": [ { "key": "status", "value": "", "disabled": true }, { "key": "severity", "value": "", "disabled": true }, { "key": "limit", "value": "", "description": "Max results (default 50, maximum 500; a larger value is clamped, a non-numeric value is a 400)", "disabled": true }, { "key": "offset", "value": "", "description": "Rows to skip", "disabled": true } ] } } }, { "name": "Get one incident by id", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Requires the `incidents:read` key permission.", "url": { "raw": "{{baseUrl}}/v2/incidents/:id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "incidents", ":id" ], "variable": [ { "key": "id", "value": "", "description": "Incident UUID" } ] } } } ] }, { "name": "V2 Integrations", "description": "Current API version — use this for new integrations.", "item": [ { "name": "List connected integrations", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Identical to v1.", "url": { "raw": "{{baseUrl}}/v2/integrations", "host": [ "{{baseUrl}}" ], "path": [ "v2", "integrations" ] } } }, { "name": "Get integration sync status and health", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns the integration connection details along with the last 5 sync log entries. v2 change from v1: an unknown/foreign id now returns a real 404 with the standard error envelope instead of v1's `200 { error: 'Integration not found' }` — see docs/developers/public-api-versioning.md.", "url": { "raw": "{{baseUrl}}/v2/integrations/:id/health", "host": [ "{{baseUrl}}" ], "path": [ "v2", "integrations", ":id", "health" ], "variable": [ { "key": "id", "value": "", "description": "Integration connection UUID" } ] } } }, { "name": "Trigger an on-demand sync for a connection", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "v2-only — enforces the previously-unenforced `integrations:write` key scope. Enqueues the same BullMQ sync job the authenticated dashboard's \"Sync now\" button uses. Held to the plan's sync floor (Free: one sync per 24 h, Starter: per 4 h, Essentials and above: per 1 h, on a deployment that enforces it), shared with scheduled syncs: a request inside the window is refused with 429 `SYNC_RATE_LIMITED_BY_TIER` and a `Retry-After` header. `enqueued` is false (still 202) when nothing was queued: a read-only license, or a connection removed mid-request.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/integrations/:id/sync", "host": [ "{{baseUrl}}" ], "path": [ "v2", "integrations", ":id", "sync" ], "variable": [ { "key": "id", "value": "", "description": "Integration connection UUID" } ] } } } ] }, { "name": "V2 Observations", "description": "Current API version — use this for new integrations.", "item": [ { "name": "Push maturity observations from your own tooling", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Observations are recorded at the ATTESTED tier and tagged API_PUSH. Upserts on a natural key, so re-pushing the same externalId updates one row rather than accumulating.", "body": { "mode": "raw", "raw": "{\n \"items\": [\n {\n \"externalId\": \"\",\n \"observationType\": \"CSPM_CONTROL_STATE\",\n \"metric\": {}\n }\n ]\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/observations", "host": [ "{{baseUrl}}" ], "path": [ "v2", "observations" ] } } } ] }, { "name": "V2 Partner", "description": "Current API version — use this for new integrations.", "item": [ { "name": "List the client workspaces this practice owns", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Active vCISO client workspaces whose parent is the key's organization, in id order, one page at a time (keyset): pass the previous page's `nextCursor` as `after`; `nextCursor` is null on the last page.", "url": { "raw": "{{baseUrl}}/v2/partner/clients?after=&limit=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "partner", "clients" ], "query": [ { "key": "after", "value": "", "description": "The `nextCursor` of the previous page", "disabled": true }, { "key": "limit", "value": "", "description": "Page size, 1 to 200 (default 200)", "disabled": true } ] } } }, { "name": "A client's control assessments (effective status)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "One row per assessed control: status after the stale-evidence downgrade, `degraded` when that downgrade applied, and lastEvaluatedAt. At most 1000 rows; filter with `framework`.", "url": { "raw": "{{baseUrl}}/v2/partner/clients/:clientId/controls?framework=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "partner", "clients", ":clientId", "controls" ], "query": [ { "key": "framework", "value": "", "description": "Framework slug, e.g. soc2", "disabled": true } ], "variable": [ { "key": "clientId", "value": "", "description": "A client workspace id from GET /v2/partner/clients" } ] } } }, { "name": "A client's latest posture score and signals", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": { "raw": "{{baseUrl}}/v2/partner/clients/:clientId/posture", "host": [ "{{baseUrl}}" ], "path": [ "v2", "partner", "clients", ":clientId", "posture" ], "variable": [ { "key": "clientId", "value": "", "description": "A client workspace id from GET /v2/partner/clients" } ] } } }, { "name": "A client's proof receipts: ids, digests and verify commands", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Newest first, at most 200. Never the receipt payload or evidence: verify a receipt with the `verifyCommand`, which fetches it from the issuing deployment.", "url": { "raw": "{{baseUrl}}/v2/partner/clients/:clientId/receipts", "host": [ "{{baseUrl}}" ], "path": [ "v2", "partner", "clients", ":clientId", "receipts" ], "variable": [ { "key": "clientId", "value": "", "description": "A client workspace id from GET /v2/partner/clients" } ] } } }, { "name": "A client's open remediation tasks", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Tasks not CLOSED, earliest due date first, with an `overdue` flag. At most 200.", "url": { "raw": "{{baseUrl}}/v2/partner/clients/:clientId/remediation", "host": [ "{{baseUrl}}" ], "path": [ "v2", "partner", "clients", ":clientId", "remediation" ], "variable": [ { "key": "clientId", "value": "", "description": "A client workspace id from GET /v2/partner/clients" } ] } } } ] }, { "name": "V2 Policies", "description": "Current API version — use this for new integrations.", "item": [ { "name": "List policies", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Paginated, newest-stable ordering. Read-only; requires the `policies:read` key permission.", "url": { "raw": "{{baseUrl}}/v2/policies?status=&category=&limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "policies" ], "query": [ { "key": "status", "value": "", "disabled": true }, { "key": "category", "value": "", "disabled": true }, { "key": "limit", "value": "", "description": "Max results (default 50, maximum 500; a larger value is clamped, a non-numeric value is a 400)", "disabled": true }, { "key": "offset", "value": "", "description": "Rows to skip", "disabled": true } ] } } }, { "name": "Get one policy by id", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Requires the `policies:read` key permission.", "url": { "raw": "{{baseUrl}}/v2/policies/:id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "policies", ":id" ], "variable": [ { "key": "id", "value": "", "description": "Policy UUID" } ] } } } ] }, { "name": "V2 Posture", "description": "Current API version — use this for new integrations.", "item": [ { "name": "Get posture score history", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns daily posture score snapshots over the specified time window. Identical to v1.", "url": { "raw": "{{baseUrl}}/v2/posture/history?days=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "posture", "history" ], "query": [ { "key": "days", "value": "", "description": "Number of days of history (default: 30)", "disabled": true } ] } } }, { "name": "Get latest posture score", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns the most recent posture score snapshot with all signal values. Identical to v1.", "url": { "raw": "{{baseUrl}}/v2/posture/latest", "host": [ "{{baseUrl}}" ], "path": [ "v2", "posture", "latest" ] } } }, { "name": "Get detailed signal breakdown", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns each posture signal with its raw value, normalized score, weight, and weighted contribution. Identical to v1.", "url": { "raw": "{{baseUrl}}/v2/posture/signals", "host": [ "{{baseUrl}}" ], "path": [ "v2", "posture", "signals" ] } } } ] }, { "name": "V2 Reports", "description": "Current API version — use this for new integrations.", "item": [ { "name": "List generated reports", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": { "raw": "{{baseUrl}}/v2/reports?limit=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "reports" ], "query": [ { "key": "limit", "value": "", "disabled": true } ] } } }, { "name": "Generate a report from a template or ad-hoc sections", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"templateId\": \"tmpl-uuid-001\",\n \"name\": \"Q3 Board Pack\",\n \"sections\": [\n \"posture\",\n \"compliance\",\n \"risks\"\n ],\n \"format\": \"PDF\",\n \"includeRoadmap\": true,\n \"dateFrom\": \"2026-06-01\",\n \"dateTo\": \"2026-08-31\",\n \"brandAs\": \"self\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/reports/generate", "host": [ "{{baseUrl}}" ], "path": [ "v2", "reports", "generate" ] } } }, { "name": "Get a generated report status and content", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Always 200 while the report exists. `status` is one of PENDING | PROCESSING | COMPLETE | FAILED; `content` is the assembled report JSON once `ready` is true and null before that (not a rendered PDF binary — use the dashboard download for that). Poll every `retryAfterSeconds` seconds until `terminal` is true.", "url": { "raw": "{{baseUrl}}/v2/reports/:id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "reports", ":id" ], "variable": [ { "key": "id", "value": "", "description": "Generated report UUID" } ] } } } ] }, { "name": "V2 Risks", "description": "Current API version — use this for new integrations.", "item": [ { "name": "List risks with optional filtering", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns risks sorted by risk score (descending). Identical to v1.", "url": { "raw": "{{baseUrl}}/v2/risks?status=&category=&minScore=&limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "risks" ], "query": [ { "key": "status", "value": "", "disabled": true }, { "key": "category", "value": "", "disabled": true }, { "key": "minScore", "value": "", "disabled": true }, { "key": "limit", "value": "", "description": "Max results (default: 50, maximum: 500; a larger value is clamped to 500, a non-numeric value is a 400)", "disabled": true }, { "key": "offset", "value": "", "description": "Pagination offset", "disabled": true } ] } } }, { "name": "Create a new risk", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Identical to v1.", "body": { "mode": "raw", "raw": "{\n \"title\": \"Unpatched critical vulnerabilities in production\",\n \"description\": \"Multiple CVEs with CVSS > 9.0 remain unpatched\",\n \"category\": \"Vulnerability Management\",\n \"likelihood\": 4,\n \"impact\": 5,\n \"status\": \"OPEN\",\n \"dueDate\": \"2026-06-30\",\n \"notes\": \"Needs urgent remediation\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/risks", "host": [ "{{baseUrl}}" ], "path": [ "v2", "risks" ] } } }, { "name": "Get FAIR loss-exposure summary (ALE + percentiles)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Identical to v1.", "url": { "raw": "{{baseUrl}}/v2/risks/loss-exposure", "host": [ "{{baseUrl}}" ], "path": [ "v2", "risks", "loss-exposure" ] } } }, { "name": "Update a risk", "request": { "method": "PUT", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Identical to v1.", "body": { "mode": "raw", "raw": "{\n \"title\": \"Updated risk title\",\n \"description\": \"Updated description\",\n \"category\": \"Identity & Access\",\n \"likelihood\": 3,\n \"impact\": 4,\n \"status\": \"MITIGATED\",\n \"dueDate\": \"2026-09-30\",\n \"notes\": \"Applied patches, residual risk remains\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/risks/:id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "risks", ":id" ], "variable": [ { "key": "id", "value": "", "description": "Risk UUID" } ] } } }, { "name": "Get linked controls for a risk", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Identical to v1.", "url": { "raw": "{{baseUrl}}/v2/risks/:id/controls", "host": [ "{{baseUrl}}" ], "path": [ "v2", "risks", ":id", "controls" ], "variable": [ { "key": "id", "value": "", "description": "Risk UUID" } ] } } }, { "name": "Get FAIR loss exposure for a single risk", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Identical to v1.", "url": { "raw": "{{baseUrl}}/v2/risks/:id/loss-exposure", "host": [ "{{baseUrl}}" ], "path": [ "v2", "risks", ":id", "loss-exposure" ], "variable": [ { "key": "id", "value": "", "description": "Risk UUID" } ] } } } ] }, { "name": "V2 Vendors", "description": "Current API version — use this for new integrations.", "item": [ { "name": "List vendors", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Paginated, newest-stable ordering. Read-only; requires the `vendors:read` key permission.", "url": { "raw": "{{baseUrl}}/v2/vendors?status=&tier=&criticality=&limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "vendors" ], "query": [ { "key": "status", "value": "", "disabled": true }, { "key": "tier", "value": "", "disabled": true }, { "key": "criticality", "value": "", "disabled": true }, { "key": "limit", "value": "", "description": "Max results (default 50, maximum 500; a larger value is clamped, a non-numeric value is a 400)", "disabled": true }, { "key": "offset", "value": "", "description": "Rows to skip", "disabled": true } ] } } }, { "name": "Get one vendor by id", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Requires the `vendors:read` key permission.", "url": { "raw": "{{baseUrl}}/v2/vendors/:id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "vendors", ":id" ], "variable": [ { "key": "id", "value": "", "description": "Vendor UUID" } ] } } } ] }, { "name": "V2 Webhooks", "description": "Current API version — use this for new integrations.", "item": [ { "name": "List all webhook registrations for the tenant", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": { "raw": "{{baseUrl}}/v2/webhooks", "host": [ "{{baseUrl}}" ], "path": [ "v2", "webhooks" ] } } }, { "name": "Register a new webhook endpoint", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "The HMAC signing secret is returned in plaintext exactly once, in this response.", "body": { "mode": "raw", "raw": "{\n \"url\": \"https://example.com/webhooks/cmdash\",\n \"events\": [\n \"posture.changed\",\n \"risk.created\"\n ]\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/webhooks", "host": [ "{{baseUrl}}" ], "path": [ "v2", "webhooks" ] } } }, { "name": "Update a webhook registration", "request": { "method": "PUT", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "body": { "mode": "raw", "raw": "{\n \"url\": \"https://example.com/webhooks/cmdash\",\n \"events\": [\n \"posture.changed\"\n ],\n \"isActive\": false\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/webhooks/:id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "webhooks", ":id" ], "variable": [ { "key": "id", "value": "", "description": "Webhook registration UUID" } ] } } }, { "name": "Delete a webhook registration", "request": { "method": "DELETE", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": { "raw": "{{baseUrl}}/v2/webhooks/:id", "host": [ "{{baseUrl}}" ], "path": [ "v2", "webhooks", ":id" ], "variable": [ { "key": "id", "value": "", "description": "Webhook registration UUID" } ] } } }, { "name": "Get delivery logs for a webhook", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": { "raw": "{{baseUrl}}/v2/webhooks/:id/logs?limit=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "webhooks", ":id", "logs" ], "query": [ { "key": "limit", "value": "", "disabled": true } ], "variable": [ { "key": "id", "value": "", "description": "Webhook registration UUID" } ] } } }, { "name": "Rotate the webhook HMAC signing secret", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "The previous secret keeps signing deliveries alongside the new one for the overlap window (default 24h, max 168h). The new plaintext secret is returned once here.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/webhooks/:id/rotate-secret?overlapHours=", "host": [ "{{baseUrl}}" ], "path": [ "v2", "webhooks", ":id", "rotate-secret" ], "query": [ { "key": "overlapHours", "value": "", "disabled": true } ], "variable": [ { "key": "id", "value": "", "description": "Webhook registration UUID" } ] } } }, { "name": "Send a single synthetic test event through the real delivery path", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "ROADMAP-V100 I13 — same HMAC signing and transport as a live delivery, but marked `test: true` in the signed body and the `X-CMDash-Test` header so a receiver can never mistake it for a real compliance event. Not queued, sequenced, retried or dead-lettered, and does not affect the circuit breaker — verify a new endpoint before any real event reaches it.", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v2/webhooks/:id/test", "host": [ "{{baseUrl}}" ], "path": [ "v2", "webhooks", ":id", "test" ], "variable": [ { "key": "id", "value": "", "description": "Webhook registration UUID" } ] } } } ] }, { "name": "V1 Compliance (deprecated — sunset Wed, 24 Feb 2027 00:00:00 GMT)", "description": "Deprecated. Every route here has a v2 counterpart at the same sub-path. Sunset: Wed, 24 Feb 2027 00:00:00 GMT.", "item": [ { "name": "List compliance frameworks with progress", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns all compliance frameworks with implementation progress metrics. Supported frameworks include CMMC L2, NIST CSF, ISO 27001, SOC 2, PCI DSS, HIPAA, CIS Controls, GDPR, DORA, and FedRAMP.", "url": { "raw": "{{baseUrl}}/v1/compliance/frameworks", "host": [ "{{baseUrl}}" ], "path": [ "v1", "compliance", "frameworks" ] } } }, { "name": "Get control statuses for a framework", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns all controls for a framework with their current assessment status and notes.", "url": { "raw": "{{baseUrl}}/v1/compliance/frameworks/:slug/controls", "host": [ "{{baseUrl}}" ], "path": [ "v1", "compliance", "frameworks", ":slug", "controls" ], "variable": [ { "key": "slug", "value": "cmmc-l2", "description": "Framework slug (e.g., cmmc-l2, nist-csf, iso-27001)" } ] } } }, { "name": "Get compliance progress across all frameworks", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns aggregated compliance progress for all assessed frameworks, showing the number of controls assessed and implemented per framework.", "url": { "raw": "{{baseUrl}}/v1/compliance/progress", "host": [ "{{baseUrl}}" ], "path": [ "v1", "compliance", "progress" ] } } } ] }, { "name": "V1 Gate (deprecated — sunset Wed, 24 Feb 2027 00:00:00 GMT)", "description": "Deprecated. Every route here has a v2 counterpart at the same sub-path. Sunset: Wed, 24 Feb 2027 00:00:00 GMT.", "item": [ { "name": "Evaluate the posture-as-code CI gate", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Runs three checks against the tenant's own data — score-drop (a MaturitySnapshot rollup fell more than the threshold since its previous snapshot), control-regression (a control moved backward in status within the lookback window), and expired-exception (an ACTIVE exception is past its expiresAt) — and returns pass/fail plus one cited reason per failure. Every body field is optional and overrides the tenant's saved policy (Settings > Posture Gate) for this call only.", "body": { "mode": "raw", "raw": "{\n \"scoreDropThreshold\": 5,\n \"blockOnControlRegression\": true,\n \"controlRegressionWindowDays\": 30,\n \"blockOnExpiredException\": true,\n \"modelSlug\": \"cmmc-l2\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/gate/evaluate", "host": [ "{{baseUrl}}" ], "path": [ "v1", "gate", "evaluate" ] } } }, { "name": "Get the effective posture-gate policy (defaults if never configured)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "url": { "raw": "{{baseUrl}}/v1/gate/policy", "host": [ "{{baseUrl}}" ], "path": [ "v1", "gate", "policy" ] } } } ] }, { "name": "V1 Integrations (deprecated — sunset Wed, 24 Feb 2027 00:00:00 GMT)", "description": "Deprecated. Every route here has a v2 counterpart at the same sub-path. Sunset: Wed, 24 Feb 2027 00:00:00 GMT.", "item": [ { "name": "List connected integrations", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns all integration connections for the organization with their sync status. Supported providers include Microsoft Defender, CrowdStrike, Tenable, Splunk, and 13 more.", "url": { "raw": "{{baseUrl}}/v1/integrations", "host": [ "{{baseUrl}}" ], "path": [ "v1", "integrations" ] } } }, { "name": "Get integration sync status and health", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns the integration connection details along with the last 5 sync log entries, including timing data and error messages.", "url": { "raw": "{{baseUrl}}/v1/integrations/:id/health", "host": [ "{{baseUrl}}" ], "path": [ "v1", "integrations", ":id", "health" ], "variable": [ { "key": "id", "value": "", "description": "Integration connection UUID" } ] } } } ] }, { "name": "V1 Posture (deprecated — sunset Wed, 24 Feb 2027 00:00:00 GMT)", "description": "Deprecated. Every route here has a v2 counterpart at the same sub-path. Sunset: Wed, 24 Feb 2027 00:00:00 GMT.", "item": [ { "name": "Get posture score history", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns daily posture score snapshots over the specified time window. Useful for trend analysis and board reporting.", "url": { "raw": "{{baseUrl}}/v1/posture/history?days=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "posture", "history" ], "query": [ { "key": "days", "value": "", "description": "Number of days of history (default: 30)", "disabled": true } ] } } }, { "name": "Get latest posture score", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns the most recent posture score snapshot with all signal values. The score is computed from 5 signals: Mean Time to Patch, MFA Coverage, Open Critical Vulnerabilities, Incident Frequency, and Policy Compliance.", "url": { "raw": "{{baseUrl}}/v1/posture/latest", "host": [ "{{baseUrl}}" ], "path": [ "v1", "posture", "latest" ] } } }, { "name": "Get detailed signal breakdown", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns each posture signal with its raw value, normalized score, weight, and weighted contribution to the overall posture score.", "url": { "raw": "{{baseUrl}}/v1/posture/signals", "host": [ "{{baseUrl}}" ], "path": [ "v1", "posture", "signals" ] } } } ] }, { "name": "V1 Risks (deprecated — sunset Wed, 24 Feb 2027 00:00:00 GMT)", "description": "Deprecated. Every route here has a v2 counterpart at the same sub-path. Sunset: Wed, 24 Feb 2027 00:00:00 GMT.", "item": [ { "name": "List risks with optional filtering", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns risks sorted by risk score (descending). Supports filtering by status, category, and minimum risk score. Results are paginated.", "url": { "raw": "{{baseUrl}}/v1/risks?status=&category=&minScore=&limit=&offset=", "host": [ "{{baseUrl}}" ], "path": [ "v1", "risks" ], "query": [ { "key": "status", "value": "", "disabled": true }, { "key": "category", "value": "", "disabled": true }, { "key": "minScore", "value": "", "disabled": true }, { "key": "limit", "value": "", "description": "Max results (default: 50, maximum: 500; a larger value is clamped to 500, a non-numeric value is a 400)", "disabled": true }, { "key": "offset", "value": "", "description": "Pagination offset", "disabled": true } ] } } }, { "name": "Create a new risk", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Creates a new risk entry. A unique risk ID (RSK-001, RSK-002, etc.) is auto-generated. Risk score is computed as likelihood × impact.", "body": { "mode": "raw", "raw": "{\n \"title\": \"Unpatched critical vulnerabilities in production\",\n \"description\": \"Multiple CVEs with CVSS > 9.0 remain unpatched\",\n \"category\": \"Vulnerability Management\",\n \"likelihood\": 4,\n \"impact\": 5,\n \"status\": \"OPEN\",\n \"dueDate\": \"2026-06-30\",\n \"notes\": \"Needs urgent remediation\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/risks", "host": [ "{{baseUrl}}" ], "path": [ "v1", "risks" ] } } }, { "name": "Get FAIR loss-exposure summary (ALE + percentiles)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns the tenant's aggregate FAIR-quantified loss exposure: total annualized loss expectancy (median/P50) plus the P10 (low) and P90 (high) bounds, and a per-risk breakdown sorted by ALE descending. Figures come directly from the Monte Carlo FAIR engine — nothing is estimated or fabricated here. Risks that have never been FAIR-quantified are simply excluded from the breakdown; if the tenant has no FAIR data at all, totals are 0 and `risks` is an empty array.", "url": { "raw": "{{baseUrl}}/v1/risks/loss-exposure", "host": [ "{{baseUrl}}" ], "path": [ "v1", "risks", "loss-exposure" ] } } }, { "name": "Update a risk", "request": { "method": "PUT", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Updates an existing risk. If likelihood or impact changes, risk score is recalculated automatically.", "body": { "mode": "raw", "raw": "{\n \"title\": \"Updated risk title\",\n \"description\": \"Updated description\",\n \"category\": \"Identity & Access\",\n \"likelihood\": 3,\n \"impact\": 4,\n \"status\": \"MITIGATED\",\n \"dueDate\": \"2026-09-30\",\n \"notes\": \"Applied patches, residual risk remains\"\n}", "options": { "raw": { "language": "json" } } }, "url": { "raw": "{{baseUrl}}/v1/risks/:id", "host": [ "{{baseUrl}}" ], "path": [ "v1", "risks", ":id" ], "variable": [ { "key": "id", "value": "", "description": "Risk UUID" } ] } } }, { "name": "Get linked controls for a risk", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns compliance controls linked to a specific risk, including framework information.", "url": { "raw": "{{baseUrl}}/v1/risks/:id/controls", "host": [ "{{baseUrl}}" ], "path": [ "v1", "risks", ":id", "controls" ], "variable": [ { "key": "id", "value": "", "description": "Risk UUID" } ] } } }, { "name": "Get FAIR loss exposure for a single risk", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}", "type": "text" }, { "key": "Content-Type", "value": "application/json", "type": "text" } ], "description": "Returns the latest FAIR quantification (ALE + P10/P90) for one risk. If the risk has never been FAIR-quantified, `available` is false and every numeric field is null — no figure is ever fabricated.", "url": { "raw": "{{baseUrl}}/v1/risks/:id/loss-exposure", "host": [ "{{baseUrl}}" ], "path": [ "v1", "risks", ":id", "loss-exposure" ], "variable": [ { "key": "id", "value": "", "description": "Risk UUID" } ] } } } ] } ], "variable": [ { "key": "baseUrl", "value": "https://app.cmdash.net/api", "type": "string" }, { "key": "apiKey", "value": "", "type": "string" } ], "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{apiKey}}", "type": "string" } ] } }