API Documentation

Programmatic access to the Misconfigured.app findings database. Available on the Enterprise tier. See pricing.

1. Quick start

The API is exposed under https://misconfigured.app/api/v1/ and returns JSON. Every request must include a valid API key in the X-API-Key header.

Subscribe to the Enterprise tier.
Generate a key from your Monitoring tools page. The plaintext key is shown once at creation time; store it securely.
Send it as the X-API-Key header on every request.

curl -H "X-API-Key: $YOUR_KEY" \
  "https://misconfigured.app/api/v1/findings?type=1&pageSize=10"

2. Authentication

All /api/v1/* endpoints require an X-API-Key header bound to an Enterprise account. Session cookies are not accepted on /api/v1/*: keys are the only auth path. Keys are hashed at rest; we cannot show you a key after creation.

A key can be revoked at any time from the Enterprise tools page. Revocation takes effect on the next request.

Treat keys as secrets. Don't commit them to version control, embed them in client-side code, or share them in tickets. If a key is exposed, revoke it and create a new one immediately.

3. Request volume

Contact us to confirm supported request volume for your integration. Website request limits are not a published per-seat API quota. Handle temporary failures with backoff, and honor any 429 responses. For capacity planning, use the contact form.

4. Endpoints

One v1 endpoint is published today; more will be added below as they ship.

GET /api/v1/findings

List indexed findings, with optional filters.

Query parameters

type: integer provider type id (e.g. 1 for AWS S3).
status: integer status (0 open, 1 verified, 2 closed, 3 invalid).
search: free-text search string, max 200 chars.
appId: exact app/source identifier, max 200 chars.
page: 1-indexed page number (default 1).
pageSize: 1 to 100 (default 25).

Example

curl -H "X-API-Key: $YOUR_KEY" \
  "https://misconfigured.app/api/v1/findings?type=1&search=acme&pageSize=5"

Response

{
  "page": 1,
  "pageSize": 5,
  "total": 23,
  "totalPages": 5,
  "findings": [
    {
      "id": 12345,
      "finding": "https://example-bucket.s3.amazonaws.com/",
      "finding_type": 1,
      "finding_loc": "dictionary_scan",
      "app_id": "dictionary_scan",
      "app_ver": "1.0",
      "status": 0,
      "lastupdate": "2026-05-26T10:14:00.000Z"
    }
  ]
}

Hidden finding types (currently AWS Credentials and Private Keys) are excluded from all responses, including this endpoint.

5. Errors

Errors are returned as JSON with a top-level error field and an HTTP status code that reflects the cause.

Status	Meaning
400	Invalid query parameter.
401	Missing or invalid `X-API-Key`.
403	Authenticated, but the account is not on the Enterprise tier.
404	Resource not found.
429	Rate limit exceeded.
5xx	Server error: retry with backoff.

6. Versioning

The current API version is v1. Breaking changes (response field removed, type changed, semantics changed) will ship under /api/v2/ with at least 90 days' notice via email to active Enterprise subscribers. Additive changes (new optional fields, new endpoints) may land on v1 without notice.

Questions, feature requests, or volume needs? Reach out.