For enterprise security programs, the challenge was never running offensive security testing against your applications and networks. It's whether the process and results were manageable at scale and could actually drive faster remediation across every business unit and engineering team in the organization.
The Cobalt API helps enterprise security programs automate work across our platform. It gives teams direct, programmatic access to pentests, findings, DAST scans, secure code reviews, and more — so security data flows into the systems where work actually gets done, without manual exports or spreadsheet hand-offs.
Ensuring enterprise security results get to the proper teams
Large organizations are running security testing across hundreds of assets, managed by different teams, in different business units, on different release schedules. Coordinating offensive security testing programs from a single platform is hard enough. Getting asset information into the testing platform, and then getting findings into the hands of the right engineers, tracked in the right tools, remediated and verified before the next release? That's nearly impossible.
Cobalt offers native integrations into supported systems including Jira, ServiceNow, GitHub, Azure DevOps, Asana, and more, through Integration Builder, a no-code solution for building custom API-based workflows without writing or hosting scripts. But large companies have complex, multi-system workflows, and the Cobalt API gives them the flexibility to seamlessly embed Cobalt into those DevSecOps workflows, with efficiency gains across all offensive security testing initiatives.
The Cobalt Platform was built to solve security challenges. The API is how it connects to everything else
The Cobalt Offensive Security Platform helps enterprises move beyond point-in-time testing to a continuous offensive security program. Enhanced by AI-driven capabilities, proven methodologies, and deep security expertise, it lets you launch a pentest in hours, get real-time findings, communicate directly with testers, and push vulnerabilities straight into your remediation workflows, through one platform.
For enterprise programs specifically, that means centralized control across business units, internal teams, and external vendors. A unified view of your global security posture and program schedule, benchmarked against the largest offensive security dataset in the industry. Real-time findings pushed directly to the developers who need to act on them, through the tools they already use at DevOps speed.
The API extends all of that beyond the platform itself. It's how security programs build Cobalt into the workflows they've already invested in, rather than asking every team to adopt another tool.
What the API makes possible
The Cobalt API offers full read and write access across the platform. That means security teams aren't just pulling data out—they're managing the security testing lifecycle programmatically. Customers using the Cobalt API can create pentest briefs for submission, retrieve and filter findings, retest findings, update remediation state, link findings to external tickets, trigger and schedule DAST scans, access reports, and more. Webhooks can be configured to deliver real-time notifications for every major event—a new finding, a pentest going live, a state change, a comment—so your systems respond the moment something happens rather than waiting for a scheduled sync.
Enterprise access controls are built in: SCIM, SAML/SSO, and regional data residency for US and EU customers. Getting started takes one personal API token and one organization token. The goal is for Cobalt to fit into the workflows you already have, not the other way around.
Putting it into practice
Here's what a few of the most common API workflows look like in code.
Creating a pentest from your own systems means teams can trigger a new engagement directly from an internal tool, a CI/CD pipeline, or a security orchestration workflow. Simply use the API to specify the asset, scope, dates, and collaboration channel, and the pentest brief will be created in Cobalt. Your team needs to log in to kick off the test, and Cobalt handles review and scheduling from there.
curl https://api.us.cobalt.io/pentests \
--request POST \
--header 'Authorization: Bearer YOUR_API_TOKEN' \
--header 'X-Org-Token: YOUR_ORG_TOKEN' \
--header 'Content-Type: application/vnd.cobalt.v2+json' \
--data '{
"asset_id": "as_TCopTvR3DZassjnKyyo3o9",
"title": "Q3 Web Application Pentest",
"description": "Full coverage test of the checkout flow and API endpoints",
"technology_stack": "React frontend, Node.js API, PostgreSQL",
"coverage": "standard",
"start_date": "2024-08-01",
"end_date": "2024-08-15",
"methodology": "web",
"collaboration_channel": "slack"
}'
Track the engagement through every lifecycle state via GET /pentests/{pentestId}, or subscribe to webhooks to get notified automatically as testing progresses.
Pulling findings into Jira or ServiceNow is where most enterprise programs see the biggest efficiency gain. Rather than checking the platform manually, teams use the API to pull findings filtered by state, open the corresponding ticket in their ticketing system of choice, and register the link back in Cobalt so both systems stay synchronized.
# Pull findings that need remediation
curl 'https://api.us.cobalt.io/findings?state=need_fix' \
--header 'Authorization: Bearer YOUR_API_TOKEN' \
--header 'X-Org-Token: YOUR_ORG_TOKEN'
# Link the Jira ticket back to the Cobalt finding
curl https://api.us.cobalt.io/external_ticket_references \
--request POST \
--header 'Authorization: Bearer YOUR_API_TOKEN' \
--header 'X-Org-Token: YOUR_ORG_TOKEN' \
--header 'Content-Type: application/vnd.cobalt.v2+json' \
--data '{
"ticketing_system": "jira",
"external_id": "SEC-4821",
"external_url": "https://yourorg.atlassian.net/browse/SEC-4821",
"title": "SQL Injection in /api/login endpoint",
"finding_id": "vl_3xP2RCWWUajc3oRXmbQ4j9"
}'
Use "ticketing_system": "servicenow" for ServiceNow. Once linked, the ticket reference surfaces on the finding in Cobalt, giving pentesters and engineers a shared view without switching systems. Comments from Jira or ServiceNow can be synced back to the finding with full author and source attribution, keeping the audit trail intact in both places.
Closing the loop after a fix is shipped is where a lot of programs lose time. Engineers fix vulnerabilities, but updating finding state back in Cobalt and getting a retest scheduled often falls through the cracks. The API makes it a single call from the deployment pipeline.
# Check valid state transitions first
curl 'https://api.us.cobalt.io/findings/YOUR_FINDING_ID/possible_states' \
--header 'Authorization: Bearer YOUR_API_TOKEN' \
--header 'X-Org-Token: YOUR_ORG_TOKEN'
# Mark as ready for retest
curl https://api.us.cobalt.io/findings/YOUR_FINDING_ID \
--request PATCH \
--header 'Authorization: Bearer YOUR_API_TOKEN' \
--header 'X-Org-Token: YOUR_ORG_TOKEN' \
--header 'Content-Type: application/vnd.cobalt.v2+json' \
--data '{ "state": "check_fix" }'
Finding states map cleanly to the Cobalt platform UI: need_fix (Pending Fix), check_fix (Ready for Retest), valid_fix (Fixed), wont_fix (Accepted Risk). Every state change pushes to any linked Jira or ServiceNow ticket when webhooks are configured.
For teams building more sophisticated bi-directional API integrations, the External Ticket References search endpoint lets you verify whether a Cobalt finding already has a linked ticket before creating a new one, preventing duplicates across high-volume programs managing findings at scale.
curl https://api.us.cobalt.io/external_ticket_references/search \
--request POST \
--header 'Authorization: Bearer YOUR_API_TOKEN' \
--header 'X-Org-Token: YOUR_ORG_TOKEN' \
--header 'Content-Type: application/vnd.cobalt.v2+json' \
--data '{
"findings": [{"id": "vl_3xP2RCWWUajc3oRXmbQ4j9"}],
"ticketing_system": "jira"
}'
Start building with the Cobalt API
The Cobalt API is available to all customers. Full documentation, code examples in Shell, Ruby, Node.js, PHP, and Python, and an interactive API client are available at developer.cobalt.io. If you're ready to embed Cobalt into your security workflows—or evaluating whether the API fits your enterprise environment—our team is available to walk through your specific use case.
View API documentation
Talk to an expert
Questions about the API or building custom integrations? Reach us at integrations@cobalt.io.