The Cyrisma Provisioning and Reporting API enables partners to automate platform onboarding, manage organizations and users, and retrieve scan and risk data for reporting and integration purposes.

The API supports two primary functions:

Provisioning Operations
Automate partner setup, instance creation, user management, MFA configuration, and lifecycle management.

Reporting Operations
Retrieve vulnerability, baseline, and data scan results, along with dashboard-level risk metrics, across Cyrisma cloud instances.

Authentication is token-based and follows OAuth-style access token principles.

Getting Started

Step 1: Obtain API Credentials

API access requires credentials issued by Cyrisma Support:

API Key (Username)

Temporary API Secret (Password)

These credentials are used only to generate access tokens.

Step 2: Reset the Temporary API Secret (Required)

First-time API use must begin by resetting the temporary secret.

Endpoint
POST /partner/login/regen-pass

The new secret is returned once.

Cyrisma stores only a hashed version and cannot recover it.

Store the new secret securely.

Step 3: Authenticate and Obtain an Access Token

Endpoint
POST /partner/login/

Uses application/x-www-form-urlencoded

Returns:

access_token (required for all future requests)

expires_in (typically 600 seconds)

Optional refresh_token

All subsequent API calls must include the access token in the Authorization header.

Provisioning Operations

Provisioning endpoints allow you to manage the organizational hierarchy and users within the Cyrisma platform.

Common Provisioning Endpoints

Instance Hierarchy Notes

Organizations (MSP / MSSP) sit at the top of the hierarchy.

Instances (standard or consulting) exist under organizations.

Users can only be created under organizations, not standard or consulting instances.

Consulting instances can be converted once to managed (standard).

Creating a New Organization or Instance

Endpoint
POST /partner/instances/create

Key parameters include:

instance_type (msp, mssp, or standard)

is_consulting

parent_instance_id

country (determines data residency)

Optional MFA configuration (mfa_type)

Provisioning typically completes within 5 minutes.

MFA Configuration

MFA can be set:

During instance creation, or

Updated later using the MFA endpoint

Supported MFA types:

0 – None

1 – Email

2 – Authenticator (TOTP)

MFA changes apply only to organizations, not standard or consulting instances.

Reporting Operations

Reporting endpoints allow retrieval of scan results and dashboard metrics.

Instance Authentication for Reporting (Required)

Before accessing reporting endpoints, instances must be authenticated.

Endpoint
POST /partner/instances/login/{optional instanceId}

If no instance ID is provided, all available instances are authenticated.

This step must be repeated whenever a new access token is generated.

Reporting Endpoint Structure

Once authenticated, reporting endpoints are accessed using the instance-specific URL:

Available Reporting Endpoints

Scan Data Notes

Internal and external IP scans return:

Vulnerabilities

Open ports

Web application scans return:

Flaws

Each asset may contain:

vulnerabilities

openPorts

flaws

Dashboard Grades

Dashboard endpoints return current and previous grades for:

Overall Risk

Data Scans

Vulnerability Scans

Secure Baseline

Compliance

Grading periods depend on instance configuration (monthly or quarterly).

Security and Best Practices

All API access must use SSL

Rotate API secrets periodically

Store access tokens securely

Re-authenticate instances after token renewal

Limit API access to authorized automation only

Full API Reference

For complete endpoint definitions, request/response schemas, and full cURL examples, refer to:

Cyrisma API Guide v3.3