Using the CybAura API and webhooks

CybAura provides a REST API and webhooks so you can integrate your security programme with your own tools and automation. API access is available on paid plans.

Generating an API key

1. Go to Settings → API Keys.
2. Select Create key, give it a descriptive name, and choose its scopes (least privilege).
3. Copy the key immediately — it's shown only once. Store it in a secrets manager, never in source control.

Authenticating

Send your key as a bearer token:

GET https://app.cybaura.io/api/v1/risks
Authorization: Bearer <YOUR_API_KEY>

All requests are scoped to your tenant automatically. Responses are JSON.

Rate limits

The API is rate limited per key. If you exceed the limit you'll receive an HTTP 429 with a Retry-After header — back off and retry.

Webhooks

Webhooks push events to your endpoint in real time instead of you polling.

1. Go to Settings → Integrations → Webhooks.
2. Add your HTTPS endpoint URL and select the events to subscribe to (for example risk.created, agent.escalation, incident.updated).
3. Save to receive a signing secret.

Verifying webhook signatures

Each delivery includes a signature header generated with your signing secret. Recompute the HMAC over the raw request body and compare — reject any request that doesn't match. This ensures the event genuinely came from CybAura.

Retries

Failed deliveries (non-2xx responses) are retried with exponential backoff. Make your handler idempotent so repeated deliveries are safe.

Where to go next

• Browse the full endpoint reference at app.cybaura.io/api/docs.
• See Common issues and how to resolve them if requests are failing.

Tip: Create a separate API key per integration. If one is compromised, you can revoke it without disrupting the others.