Cobalt Pentest API

Name: Cobalt Pentest API API
Brand: Cobalt Pentest API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityVulnerability Managementbearer9 EndpointsREST

For Agents

Read Cobalt PTaaS data — pentests, findings, assets, and events — to feed dashboards, ticketing, and security review automation.

Quickstart

Get started with Cobalt Pentest API in minutes using your preferred integration method.

# Add to your MCP client config (Claude Desktop, Cursor, Windsurf)
{
  "jentic": {
    "url": "https://api.jentic.com/mcp",
    "auth": "oauth"
  }
}

# Then ask your agent:
"list Cobalt pentest findings"

# → Jentic returns the GET /events tool with parameter schema, agent executes.

Capabilities

What an agent can do with Cobalt Pentest API API.

List the organisations a token has access to via GET /orgs

Enumerate pentests and inspect their state via GET /pentests and GET /pentests/{pentestId}

Pull in-scope assets via GET /assets and GET /assets/{assetId}

Retrieve findings discovered by Cobalt pentesters via GET /findings and GET /findings/{findingId}

GET STARTED

Start building with Cobalt Pentest API API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for Cobalt Pentest API, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for Cobalt Pentest API, keeping it validated and agent-ready. The API exposes the Cobalt penetration testing as a service (PTaaS) platform — organisations, pentests, in-scope assets, findings, and audit events — through a small set of read endpoints. Authentication uses a personal API token sent as a Bearer credential, with an additional X-Org-Token header to scope requests to a specific organisation.

Use Cases

Patterns agents use Cobalt Pentest API API for, with concrete tasks.

★ Findings to Ticket Sync

Mirror Cobalt findings into Jira, Linear, or GitHub Issues so engineering teams triage pentest output in their normal workflow. GET /findings lists findings with severity and status, and GET /findings/{findingId} returns the full detail including evidence and remediation guidance. Useful for keeping a single source of truth in the engineering tracker without engineers logging into Cobalt.

Call GET /findings filtered to open and severity high, then for each finding call GET /findings/{findingId} and create a matching Jira issue.

Pentest Status Dashboard

Build a real-time dashboard of in-flight and recently completed pentests for security leadership. GET /pentests lists pentests with state and timing, GET /pentests/{pentestId} returns the test plan, and GET /events surfaces lifecycle transitions such as test started, paused, or completed. The combination supports KPI tracking such as findings per pentest and time-to-remediate.

Call GET /pentests filtered to state=in_progress and return the title, start date, and number of high-severity findings for each.

Asset Coverage Audit

Confirm that every production asset is covered by at least one active pentest. GET /assets lists the assets currently registered in Cobalt, and an automation can diff that list against an external CMDB or cloud inventory to flag gaps. Useful for compliance audits that require evidence of testing coverage.

Call GET /assets and compare the returned asset list against a CMDB export, returning any asset missing from Cobalt.

AI Agent Security Triage via Jentic

An AI security copilot uses Jentic to pull Cobalt findings and summarise risk for the on-call engineer. The agent searches for 'list pentest findings', loads the schema, and executes the call without ever holding the personal API token. Jentic adds the X-Org-Token header at execution time and tracks the call for SOC observability.

Use Jentic to search for 'list Cobalt findings', load the GET /findings schema, and return a summary of all critical findings opened in the last week.

Key Endpoints

9 endpoints — jentic publishes the only available openapi specification for cobalt pentest api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/orgs

List organisations

GET

/pentests

List pentests

GET

/pentests/{pentestId}

Get pentest details

GET

/findings

List findings

GET

/findings/{findingId}

Get finding details

GET

/assets

List in-scope assets

GET

/events

List lifecycle events

GET

/orgs

List organisations

GET

/pentests

List pentests

GET

/pentests/{pentestId}

Get pentest details

GET

/findings

List findings

GET

/findings/{findingId}

Get finding details

GET

/assets

List in-scope assets

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

The personal API token and X-Org-Token are stored encrypted in the Jentic vault. Agents call Cobalt operations without ever receiving either value — Jentic adds the Authorization Bearer header and the X-Org-Token at execution time.

Intent-based discovery

Agents search by intent (e.g. 'list pentest findings' or 'check pentest status') and Jentic returns the matching Cobalt operation with its parameter schema, so the agent can build a triage workflow without parsing the docs site.

Time to first call

Direct Cobalt integration: half a day to wire up token storage, the X-Org-Token convention, and the read endpoints. Through Jentic: under one hour — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

HackerOne

HackerOne is a competing crowdsourced security testing platform with a richer findings API.

Choose HackerOne when the workflow runs an open or private bug bounty; choose Cobalt for time-boxed PTaaS engagements.

Alternative

Detectify

Detectify provides automated external attack surface and web app scanning.

Choose Detectify for continuous automated scanning; use Cobalt for human-led pentest engagements.

Complementary

Snyk

Snyk covers code, dependency, and container vulnerability scanning.

Use Snyk for shift-left dev-time scanning and Cobalt for adversarial human pentests on the same assets.

Complementary

Tenable Nessus

Nessus provides infrastructure vulnerability scanning across networks.

Use Nessus for infrastructure-level CVE scanning and Cobalt for human-driven application pentests.

FAQs

Specific to using Cobalt Pentest API API through Jentic.

Why is there no official OpenAPI spec for Cobalt Pentest API?

Cobalt does not publish an OpenAPI specification on its developer site. Jentic generates and maintains this spec so that AI agents and developers can call Cobalt Pentest API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Cobalt Pentest API use?

The API uses HTTP Bearer authentication with a personal API token created at https://app.cobalt.io/settings/api-tokens. Requests must also include an X-Org-Token header for organisation context. Through Jentic both values are stored encrypted in the vault and injected at execution time.

Can I retrieve pentest findings programmatically with the Cobalt API?

Yes. GET /findings lists findings with severity and status, and GET /findings/{findingId} returns the full detail including evidence and remediation guidance. Filter on the list endpoint to narrow by pentest, severity, or state.

What are the rate limits for the Cobalt Pentest API?

The OpenAPI spec does not declare numeric rate limits. Cobalt applies tenant-specific throttling and surfaces 429 responses on overload, so callers should implement exponential backoff when polling /findings or /events at high frequency.

How do I sync Cobalt findings into a ticketing system through Jentic?

Search Jentic for 'list Cobalt findings', load the GET /findings schema, and execute filtered to state=open. Then for each finding call GET /findings/{findingId} and forward to the ticketing API of your choice. Install the SDK with pip install jentic and call it via the async client.

Does the Cobalt Pentest API expose write endpoints for managing pentests?

The current public spec only exposes read endpoints for organisations, pentests, assets, findings, events, and tokens. Pentest creation and scheduling are handled inside the Cobalt UI; the API is focused on reading PTaaS data into other systems.