AWS SecurityHub
Browse all Amazonaws APIsAgent-ready OpenAPI document · curated by JenticSecurityThreat DetectionapiKey61 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Aggregate, query, and triage AWS security findings across accounts and standards. Agents can import findings, update workflow status, run insights, and manage Security Hub members.
Use for: I need to import a finding from a third-party scanner into Security Hub, Mark a Security Hub finding as resolved, List all critical-severity findings in the last 24 hours, Enable the CIS AWS Foundations Benchmark standard
Not supported: Does not generate threat findings, run vulnerability scans, or perform forensic investigation - use to aggregate and triage findings produced by GuardDuty, Inspector, Macie, and third-party products only.
Jentic publishes the only available OpenAPI specification for AWS SecurityHub, keeping it validated and agent-ready. AWS Security Hub aggregates, normalises, and prioritises security findings from AWS services such as GuardDuty, Inspector, and Macie, plus integrated third-party products. Agents can ingest findings through BatchImportFindings, update finding status with BatchUpdateFindings, enable security standards like CIS and PCI DSS, run automated insights, and manage member accounts in a multi-account organisation. The API exposes 61 operations covering findings, controls, standards, insights, action targets, and finding aggregators.
Install Jentic One Beta
Connect the AWS SecurityHub to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AWS SecurityHub, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Famazonaws.com%2Faws-securityhub" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Famazonaws.com%2Faws-securityhub" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with AWS SecurityHub API.
Import findings from third-party products into Security Hub via BatchImportFindings
Update finding workflow status, severity, and notes with BatchUpdateFindings
Enable and disable security standards such as CIS, PCI DSS, and AWS FSBP
Query active findings with GetFindings using filters on severity, resource, and compliance status
Run and inspect Security Hub Insights to surface grouped findings by attribute
Manage Security Hub member accounts with CreateMembers, InviteMembers, and DisassociateMembers
Use Cases
Patterns agents use AWS SecurityHub API for, with concrete tasks.
★ Centralised Multi-Account Findings Triage
Security teams use Security Hub as the single pane of glass for findings across many AWS accounts. The administrator account invites member accounts, enables standards centrally, and queries findings filtered by severity and resource. BatchUpdateFindings is used to set workflow status (NEW, NOTIFIED, SUPPRESSED, RESOLVED) so that triage state is consistent across the organisation.
Call GetFindings with a filter for SeverityLabel = CRITICAL and WorkflowStatus = NEW, then BatchUpdateFindings to set Workflow.Status = NOTIFIED for the matching finding IDs.
Automated Compliance Posture Reporting
Compliance teams enable standards (CIS, PCI DSS, NIST 800-53, AWS Foundational Security Best Practices) and use Security Hub controls to track which checks pass or fail. Agents can list enabled standards, fetch control statuses, and generate periodic reports without scraping the console.
Call BatchEnableStandards for the CIS AWS Foundations Benchmark ARN, then BatchGetSecurityControls to retrieve the failed-control list for the current account.
Third-Party Finding Ingestion
Vendors and in-house scanners that produce ASFF-compliant findings push them to Security Hub via BatchImportFindings, giving operators a unified queue. CreateActionTarget defines custom actions that EventBridge rules can use to route specific findings to ticketing or chat systems.
BatchImportFindings with a single ASFF document for an EC2 instance vulnerability, then CreateActionTarget named 'send-to-pagerduty' for routing high-severity findings.
AI Agent Security Triage via Jentic
AI agents using Jentic can investigate Security Hub findings on demand: pulling open critical findings, enriching them with resource context, and updating workflow status as triage proceeds. Through Jentic, the agent searches by intent, loads operation schemas, and executes calls without needing the AWS SDK or SigV4 signing logic.
Search Jentic for 'list security hub findings filtered by severity', execute GetFindings with SeverityLabel = HIGH, then BatchUpdateFindings to add a Note for each finding with the agent's triage decision.
Key Endpoints
61 endpoints — jentic publishes the only available openapi specification for aws securityhub, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
POST
/findings/import
Import findings into Security Hub (BatchImportFindings)
PATCH
/findings/batchupdate
Update workflow status, severity, and notes on findings
POST
/standards/register
Enable one or more security standards
POST
/standards/deregister
Disable one or more security standards
POST
/securityControls/batchGet
Fetch security control details and status
POST
/insights
Create a Security Hub Insight
POST
/members
Add member accounts to a Security Hub organisation
POST
/actionTargets
Create a custom action target for EventBridge routing
POST
/findings/import
Import findings into Security Hub (BatchImportFindings)
PATCH
/findings/batchupdate
Update workflow status, severity, and notes on findings
POST
/standards/register
Enable one or more security standards
POST
/standards/deregister
Disable one or more security standards
POST
/securityControls/batchGet
Fetch security control details and status
POST
/insights
Create a Security Hub Insight
POST
/members
Add member accounts to a Security Hub organisation
POST
/actionTargets
Create a custom action target for EventBridge routing
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring AWS Security Hub by hand means implementing AWS SigV4 signing, resolving the securityhub regional host, formatting findings in ASFF, and paginating across sixty-one operations with per-operation throttling. Through Jentic you install once, import AWS Security Hub from the API Directory, store your AWS access key and secret once, and your agent calls it.
Permission scoping
Security Hub carries finding identifiers, filters, and standards ARNs in the request body rather than in the URL path, so scope your agent to the operations it needs: for example allow GetFindings and BatchUpdateFindings for triage. You choose the operations it may call, so DisassociateMembers or BatchDisableStandards are not included unless you add them.
Credential isolation
Your AWS access key and secret are stored once, encrypted, by your own Jentic One instance and each request is signed with SigV4 at execution time. They never enter the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'list Security Hub findings filtered by severity' or 'mark a finding as resolved', and Jentic returns the matching operation like GetFindings or BatchUpdateFindings with its input schema so the agent calls it without scanning the full operation surface.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using AWS SecurityHub API through Jentic.
Why is there no official OpenAPI spec for AWS SecurityHub?
AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS SecurityHub via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.
What authentication does the AWS SecurityHub use?
Security Hub uses AWS Signature Version 4 with an access key, secret key, and the relevant IAM permissions (for example, securityhub:BatchImportFindings). Through Jentic, AWS credentials live encrypted in the vault and Jentic signs each call before sending it to the regional Security Hub endpoint.
Can I import third-party security findings into Security Hub?
Yes. BatchImportFindings accepts up to 100 findings per call in AWS Security Finding Format (ASFF). Each finding must include a ProductArn that is registered with Security Hub. Suppressed or resolved findings round-trip through BatchUpdateFindings.
What are the rate limits for the AWS SecurityHub?
AWS publishes per-operation throttling: BatchEnableStandards is 1 request per second (burst 1), GetFindings is 3 per second (burst 6), BatchImportFindings and BatchUpdateFindings are 10 per second (burst 30), UpdateStandardsControl is 1 per second (burst 5), and most other operations are 10 per second (burst 30). Throttled calls return ThrottlingException and should be retried with backoff.
How do I update finding workflow status through Jentic?
Through Jentic, search for 'update security hub finding status', load the BatchUpdateFindings input schema, and execute a PATCH against /findings/batchupdate with FindingIdentifiers and Workflow.Status set to NOTIFIED, SUPPRESSED, or RESOLVED. Jentic handles SigV4 signing for the underlying AWS call.
Is AWS Security Hub free?
Security Hub charges per security check evaluation and per finding ingested, with a 30-day free trial. Pricing depends on region; see https://aws.amazon.com/security-hub/pricing/ for the current rates.
Can I limit what my agent is allowed to do with the AWS Security Hub API?
Yes. Because you run Jentic One yourself, your own rules decide which of the 61 Security Hub operations and which AWS credentials the agent may use. Since Security Hub carries finding identifiers, filters, and standards ARNs in the request body rather than the URL path, you scope by operation: for a triage agent you might allow only GetFindings and BatchUpdateFindings, while operations like DisassociateMembers or BatchDisableStandards stay unavailable unless you add them. The agent can only call the operations you have granted.
GET STARTED