Nano EASM

API Reference

The Nano EASM REST API lets you manage assets, trigger scans, pull findings, run discovery, manage monitoring alerts, and generate reports — all the things you'd wire into CI/CD, a SOAR, or a SIEM.

Generate an API keyor sign in →

Authentication

All API endpoints require an API key. Send it on every request as the X-API-Key header.

curl -H "X-API-Key: ag_sk_..." https://nanoeasm.com/api/findings

You can also pass the key as a Bearer token if you prefer:

curl -H "Authorization: Bearer ag_sk_..." https://nanoeasm.com/api/findings

Permissions

An API key inherits the role of the user who created it. A viewer's key is read-only; an analyst's key can create assets and trigger scans. Plan limits (asset count, scans per month, etc.) apply exactly as they do in the UI.

What API keys can't do

For safety, account-credential and billing-state actions are not callable with API keys: changing your password, inviting members, changing roles, switching plans, or deleting your organization. These return 403 API_KEY_NOT_ALLOWED.

Errors

Errors are returned as JSON with an error field and the appropriate HTTP status code.

{
  "error": "invalid or expired API key"
}
400Bad request — missing or invalid fields
401Missing or invalid API key
403Permission denied (role or API_KEY_NOT_ALLOWED)
402Plan limit reached
404Resource not found
429Rate-limited
500Internal server error

Pagination

List endpoints accept page (1-indexed) and perPage (max 100). Responses include the total count.

curl -H "X-API-Key: ag_sk_..." "https://nanoeasm.com/api/findings?page=2&perPage=50"
{
  "items": [ ... ],
  "total": 247,
  "page": 2,
  "perPage": 50
}

Assets

Manage the domains, IPs, and cloud resources you monitor. Assets are scoped to your organization and grouped by AssetGroup.

GET/assets

List all assets in your organization.

curl -H "X-API-Key: ag_sk_..." https://nanoeasm.com/api/assets
Sample response →
[
  {
    "id": "42",
    "value": "example.com",
    "type": "domain",
    "groupId": "1",
    "createdAt": "2026-04-12T08:21:33"
  }
]
POST/groups/<group_id>/assets

Add an asset to a group. Subject to plan asset limit.

curl -X POST -H "X-API-Key: ag_sk_..." -H "Content-Type: application/json" \
  -d '{"value":"api.example.com","type":"domain"}' \
  https://nanoeasm.com/api/groups/1/assets
POST/groups/<group_id>/assets/bulk

Bulk-import assets to a group (CSV-style array payload).

curl -X POST -H "X-API-Key: ag_sk_..." -H "Content-Type: application/json" \
  -d '{"assets":[{"value":"a.com","type":"domain"},{"value":"b.com","type":"domain"}]}' \
  https://nanoeasm.com/api/groups/1/assets/bulk
GET/assets/<asset_id>

Fetch a single asset by ID.

curl -H "X-API-Key: ag_sk_..." https://nanoeasm.com/api/assets/42
PATCH/assets/<asset_id>

Update asset attributes (group, tags, criticality).

DELETE/assets/<asset_id>

Remove an asset. Findings tied to it are kept for history.

GET/assets/<asset_id>/risk

Composite risk score and severity breakdown for an asset.

GET/assets/<asset_id>/coverage

Which scan profiles have run against the asset and when.

GET/assets/<asset_id>/health

Reachability + service status snapshot.

GET/assets/<asset_id>/timeline

Event timeline (scans, findings, status changes).

GET/groups/<group_id>/assets

List assets within a specific group.

Scans

Trigger and inspect vulnerability scans. Scans run asynchronously — POST returns immediately with a job ID you can poll.

POST/scan-jobs

Start a scan job for an asset. Profile: quick | standard | deep.

curl -X POST -H "X-API-Key: ag_sk_..." -H "Content-Type: application/json" \
  -d '{"asset_id":42,"profile":"standard"}' \
  https://nanoeasm.com/api/scan-jobs
Sample response →
{
  "id": "917",
  "status": "queued",
  "asset_id": "42",
  "profile": "standard",
  "createdAt": "2026-04-30T11:02:14"
}
GET/scan-jobs

List recent scan jobs (paginated).

curl -H "X-API-Key: ag_sk_..." "https://nanoeasm.com/api/scan-jobs?status=running&limit=20"
POST/scan-jobs/<job_id>/run

Re-run a finished scan job (creates a new job, same config).

DELETE/scan-jobs/<job_id>

Delete a scan job and its findings (irreversible).

GET/scan-jobs/<job_id>/findings

Findings produced by a specific scan job.

curl -H "X-API-Key: ag_sk_..." https://nanoeasm.com/api/scan-jobs/917/findings

Findings

Read and triage vulnerability findings. Each finding has a status (open, acknowledged, resolved, ignored) and a severity (info, low, medium, high, critical).

GET/findings

List findings. Filter with severity, status, asset_id, since, q.

curl -H "X-API-Key: ag_sk_..." "https://nanoeasm.com/api/findings?severity=critical&status=open&since=2026-04-01"
Sample response →
{
  "items": [
    {
      "id": "5510",
      "templateId": "tls.expired-cert",
      "severity": "high",
      "status": "open",
      "assetId": "42",
      "createdAt": "2026-04-29T17:08:21"
    }
  ],
  "total": 47,
  "page": 1,
  "perPage": 50
}
GET/findings/<finding_id>

Full detail for a single finding incl. evidence + remediation.

PATCH/findings/<finding_id>

Update a finding's status, notes, or assignee.

curl -X PATCH -H "X-API-Key: ag_sk_..." -H "Content-Type: application/json" \
  -d '{"status":"resolved","notes":"Patched in PR #1234"}' \
  https://nanoeasm.com/api/findings/5510
POST/findings/bulk-status

Set status on multiple findings in one request.

curl -X POST -H "X-API-Key: ag_sk_..." -H "Content-Type: application/json" \
  -d '{"ids":[5510,5511,5512],"status":"acknowledged"}' \
  https://nanoeasm.com/api/findings/bulk-status
GET/findings/export

CSV export of findings matching the filter query.

curl -H "X-API-Key: ag_sk_..." "https://nanoeasm.com/api/findings/export?severity=high" -o findings.csv

Discovery

Run subdomain and asset discovery against root domains. Discovery jobs surface unknown subdomains, IPs, and services that you can promote into your asset inventory.

POST/discovery/run

Launch a discovery job against one or more domains.

curl -X POST -H "X-API-Key: ag_sk_..." -H "Content-Type: application/json" \
  -d '{"domains":["example.com"],"deep":false}' \
  https://nanoeasm.com/api/discovery/run
GET/discovery/jobs

List discovery jobs (paginated).

GET/discovery/jobs/<job_id>

Job detail incl. discovered subdomains, IPs, and modules used.

POST/discovery/jobs/<job_id>/cancel

Cancel a running discovery job.

POST/discovery/jobs/<job_id>/add-assets

Promote discovered items into your asset inventory (subject to asset limit).

curl -X POST -H "X-API-Key: ag_sk_..." -H "Content-Type: application/json" \
  -d '{"values":["api.example.com","www.example.com"]}' \
  https://nanoeasm.com/api/discovery/jobs/123/add-assets

Monitoring

Continuous monitors watch assets for change events (new ports, cert changes, DNS drift) and emit alerts. Use the alerts endpoints to ack/resolve from your SIEM or SOAR.

GET/monitors

List monitors configured for your organization.

curl -H "X-API-Key: ag_sk_..." https://nanoeasm.com/api/monitors
POST/monitors

Create a monitor for an asset or asset group.

PATCH/monitors/<monitor_id>

Update monitor frequency, scope, or enabled state.

DELETE/monitors/<monitor_id>

Remove a monitor.

GET/monitors/alerts

List alerts. Filter by status, severity, monitor_id.

curl -H "X-API-Key: ag_sk_..." "https://nanoeasm.com/api/monitors/alerts?status=open"
POST/monitors/alerts/<alert_id>/acknowledge

Acknowledge an alert (tracks who/when).

POST/monitors/alerts/<alert_id>/resolve

Mark an alert as resolved.

Reports

Generate and download PDF/Excel reports. Generation is async — the response returns a report ID you can poll until status='ready', then download.

POST/reports/generate

Start report generation. Type: executive | technical.

curl -X POST -H "X-API-Key: ag_sk_..." -H "Content-Type: application/json" \
  -d '{"type":"executive","scope":"org"}' \
  https://nanoeasm.com/api/reports/generate
Sample response →
{
  "id": "204",
  "status": "queued",
  "type": "executive",
  "createdAt": "2026-04-30T12:11:01"
}
GET/reports

List reports (paginated).

GET/reports/<report_id>

Report metadata (status, type, scope).

GET/reports/<report_id>/download

Download the rendered report (PDF or Excel binary).

curl -H "X-API-Key: ag_sk_..." https://nanoeasm.com/api/reports/204/download -o report.pdf
Need something not in this list? The full UI runs on a JWT-only API that mirrors most of the surface — drop us a note via the contact form.