Skip to content
PentestPad DocsPentestPad DocsDocs

API Reference

The PentestPad API is a RESTful API that allows you to programmatically interact with your PentestPad instance. You can manage projects, findings, teams, and perform bulk operations like CSV imports.

Base URL

Section titled “Base URL”
https://your-instance.pentestpad.com/api/v1

Features

Section titled “Features”
  • Full CRUD Operations - Complete create, read, update, delete operations for all resources
  • Team Management - List teams and filter resources by team
  • Project Management - Create, update, clone, and manage project lifecycles
  • Finding Management - Comprehensive vulnerability tracking and management
  • CSV Import - Bulk import findings from CSV files with field mapping
  • Consistent Responses - Standardized JSON responses across all endpoints
  • Error Handling - Detailed error messages and validation feedback

Supported Resources

Section titled “Supported Resources”
Resource Description Operations
Teams Team management and statistics List, View, Stats
Projects Project lifecycle management CRUD, Clone, Status, Restore
Clients Client and contact management CRUD, User management, Invitations
Findings Vulnerability management CRUD, Templates, Bulk operations
Templates Vulnerability and executive summary templates CRUD, CSV Import
CSV Import Bulk data import Import, Field mapping

Getting Started

Section titled “Getting Started”
  1. Generate API Key - Create an API key from your PentestPad dashboard
  2. Choose Base URL - Use your instance’s API endpoint
  3. Set Authentication - Include your API key in request headers
  4. Make Requests - Start with a simple GET request to list projects

Quick Example

Section titled “Quick Example”
Terminal window
curl -H "Authorization: Bearer your_api_key" \
     https://your-instance.pentestpad.com/api/v1/projects

Response Format

Section titled “Response Format”

All API endpoints return JSON responses in a consistent format:

Success Response

Section titled “Success Response”
{
  "success": true,
  "message": "Operation completed successfully",
  "data": {
    // Response data
  }
}

Error Response

Section titled “Error Response”
{
  "success": false,
  "message": "Error description",
  "errors": {
    // Validation errors (if applicable)
  }
}

HTTP Status Codes

Section titled “HTTP Status Codes”
Code Description
200 Success
201 Created
422 Validation Error
403 Forbidden
404 Not Found
500 Internal Server Error

Rate Limiting

Section titled “Rate Limiting”

API requests are rate-limited per API key. The specific limits depend on your instance configuration. Contact your administrator for details.

Need Help?

Section titled “Need Help?”