REST API + OpenAPI

What it is

A single, audited HTTP API that the dashboard, Slack app, and any customer-built tooling all talk to. Every list, every detail page, every action is a REST endpoint with the same auth + scope + audit rules as the UI.

What it produces

• OpenAPI 3.x spec at /api/openapi.json on every Umbra install. Generated from the route table; always in sync.
• Per-request auth via session cookie (browser) or bearer token (programmatic / Slack / agent).
• Same scope checks as the UI. A token bound to a viewer can’t trigger a write; a member can’t change billing.

What to use it for

• CI/CD integration: kick off scans on deploy, alert on new findings
• SIEM ingestion: stream findings to Splunk / Datadog / Sentinel
• Custom dashboards: pull from /api/stats and /api/findings into Grafana
• Migration / export: workspace export script that hits every list endpoint and writes JSON

Why it matters

Tools that only have a UI become a bottleneck. Customers automate around them. Customers eventually leave them. An API-first product puts the customer in control of how they integrate.

Why it’s valuable

• One contract, three callers. The dashboard, the Slack app, and customer scripts all use the same endpoints. If something works in the UI, it works in the API.
• OpenAPI generated from routes. No “API docs out of date” surprises: the spec ships with every binary.
• Scope-locked by design. Every endpoint goes through requireUser / requireOrgRole / requireSuperadmin. No “secret backend route” with weaker auth.

How to use it

# Authenticate (session-cookie flow)
curl -c cookies.txt -X POST https://app.umbrascope.com/api/login \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","password":"..."}'

# Fetch findings
curl -b cookies.txt 'https://app.umbrascope.com/api/findings?severity=critical'

# Get the OpenAPI spec
curl https://app.umbrascope.com/api/openapi.json | jq '.paths | keys'

The full spec includes every endpoint listed on this site’s features page: discover, exploit, agents, notifications, billing, all of it.