Cobalt Pentest API
Agent-ready OpenAPI document · curated by JenticSecurityVulnerability Managementbearer9 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Read Cobalt PTaaS data - pentests, findings, assets, and events - to feed dashboards, ticketing, and security review automation.
Use for: List all open Cobalt pentests for my organisation, Retrieve high-severity findings from a specific pentest, Get details for finding id abc-123, List assets currently in scope for my pentest
Not supported: Does not run pentests, file new findings, or deliver remediation tickets directly - use for reading Cobalt PTaaS pentests, findings, assets, and events only.
This page describes a curated, agent-optimized Jentic OpenAPI specification for Cobalt Pentest API, scoped to nine read operations and kept validated and agent-ready. Cobalt also publishes its own, broader OpenAPI document for the v2 API, cited in the FAQ below. The API exposes the Cobalt penetration testing as a service (PTaaS) platform - organisations, pentests, in-scope assets, findings, and audit events - through a small set of read endpoints. Authentication uses a personal API token sent as a Bearer credential, with an additional X-Org-Token header to scope requests to a specific organisation.
Install Jentic One Beta
Connect the Cobalt Pentest API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Cobalt Pentest API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fcobalt.io%2Fcobalt" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fcobalt.io%2Fcobalt" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Cobalt Pentest API.
List the organisations a token has access to via GET /orgs
Enumerate pentests and inspect their state via GET /pentests and GET /pentests/{pentestId}
Pull in-scope assets via GET /assets and GET /assets/{assetId}
Retrieve findings discovered by Cobalt pentesters via GET /findings and GET /findings/{findingId}
Stream audit and lifecycle events from GET /events for SIEM and reporting workflows
Use Cases
Patterns agents use Cobalt Pentest API for, with concrete tasks.
★ Findings to Ticket Sync
Mirror Cobalt findings into Jira, Linear, or GitHub Issues so engineering teams triage pentest output in their normal workflow. GET /findings lists findings with severity and status, and GET /findings/{findingId} returns the full detail including evidence and remediation guidance. Useful for keeping a single source of truth in the engineering tracker without engineers logging into Cobalt.
Call GET /findings filtered to open and severity high, then for each finding call GET /findings/{findingId} and create a matching Jira issue.
Pentest Status Dashboard
Build a real-time dashboard of in-flight and recently completed pentests for security leadership. GET /pentests lists pentests with state and timing, GET /pentests/{pentestId} returns the test plan, and GET /events surfaces lifecycle transitions such as test started, paused, or completed. The combination supports KPI tracking such as findings per pentest and time-to-remediate.
Call GET /pentests filtered to state=in_progress and return the title, start date, and number of high-severity findings for each.
Asset Coverage Audit
Confirm that every production asset is covered by at least one active pentest. GET /assets lists the assets currently registered in Cobalt, and an automation can diff that list against an external CMDB or cloud inventory to flag gaps. Useful for compliance audits that require evidence of testing coverage.
Call GET /assets and compare the returned asset list against a CMDB export, returning any asset missing from Cobalt.
AI Agent Security Triage via Jentic
An AI security copilot uses Jentic to pull Cobalt findings and summarise risk for the on-call engineer. The agent searches for 'list pentest findings', loads the schema, and executes the call without ever holding the personal API token. Jentic adds the X-Org-Token header at execution time and tracks the call for SOC observability.
Use Jentic to search for 'list Cobalt findings', load the GET /findings schema, and return a summary of all critical findings opened in the last week.
Key Endpoints
9 endpoints — this page describes a curated, agent-optimized jentic openapi specification for cobalt pentest api, scoped to nine read operations and kept validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/orgs
List organisations
GET
/pentests
List pentests
GET
/pentests/{pentestId}
Get pentest details
GET
/findings
List findings
GET
/findings/{findingId}
Get finding details
GET
/assets
List in-scope assets
GET
/events
List lifecycle events
GET
/orgs
List organisations
GET
/pentests
List pentests
GET
/pentests/{pentestId}
Get pentest details
GET
/findings
List findings
GET
/findings/{findingId}
Get finding details
GET
/assets
List in-scope assets
GET
/events
List lifecycle events
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring Cobalt by hand means learning its bearer auth plus the required X-Org-Token, targeting api.cobalt.io, and handling paging and retries across its pentest and findings endpoints yourself. Through Jentic you install once, import the Cobalt Pentest API from the API Directory, store the token and org token once, and your agent calls it.
Permission scoping
Cobalt puts the pentest id in the URL path (/pentests/{pentestId}), so a rule can pin your agent to one pentest and its findings. Every listed operation is a read, so the agent reports on findings and events and does nothing that changes state.
Credential isolation
Your Cobalt personal API token and X-Org-Token are stored once, encrypted, by your own Jentic One instance and added to the request at execution time. They never enter the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'list pentest findings' or 'check pentest status', and Jentic returns the matching Cobalt operation with its parameter schema so the agent builds a triage workflow without parsing the docs site.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Cobalt Pentest API through Jentic.
Which OpenAPI specification does this Cobalt Pentest API page describe?
A curated, agent-optimized Jentic specification covering nine read endpoints across Cobalt organisations, pentests, assets, findings, events, and tokens. Cobalt also publishes its own OpenAPI document at https://api.us.cobalt.io/cobalt-api-docs/v2.json, an OpenAPI 3.1.0 file with 49 paths that spans the full v2 surface, including create, update, and delete calls and areas this page does not cover such as DAST scans, webhooks, and integrations. The Jentic variant narrows that surface to the read calls an agent needs for pentest reporting and finding triage, and it is validated and kept agent-ready. Get started with Jentic One, the self-hosted execution layer.
What authentication does the Cobalt Pentest API use?
The API uses HTTP Bearer authentication with a personal API token created at https://app.cobalt.io/settings/api-tokens. Requests must also include an X-Org-Token header for organisation context. Through Jentic both values are stored encrypted in the vault and injected at execution time.
Can I retrieve pentest findings programmatically with the Cobalt API?
Yes. GET /findings lists findings with severity and status, and GET /findings/{findingId} returns the full detail including evidence and remediation guidance. Filter on the list endpoint to narrow by pentest, severity, or state.
What are the rate limits for the Cobalt Pentest API?
The OpenAPI spec does not declare numeric rate limits. Cobalt applies tenant-specific throttling and surfaces 429 responses on overload, so callers should implement exponential backoff when polling /findings or /events at high frequency.
How do I sync Cobalt findings into a ticketing system through Jentic?
Search Jentic for 'list Cobalt findings', load the GET /findings schema, and execute filtered to state=open. Then for each finding call GET /findings/{findingId} and forward to the ticketing API of your choice. Install the SDK with pip install jentic and call it via the async client.
Does the Cobalt Pentest API expose write endpoints for managing pentests?
This Jentic specification covers read endpoints only, for organisations, pentests, assets, findings, events, and tokens. Cobalt's own v2 document does define write calls, including creating and updating assets, pentests, findings, and integrations, so work from the vendor document instead if your agent needs to change state in Cobalt.
Can I limit what my agent is allowed to do with the Cobalt Pentest API?
Yes. Because you run Jentic One yourself, your own rules decide which Cobalt operations and credentials the agent may use, and every Cobalt operation is a read (GET /orgs, /pentests, /findings, /assets, and /events), so the agent can report on pentests and findings but never change state. Since the pentest id sits in the URL path at GET /pentests/{pentestId}, you can pin the agent to a single pentest and its related findings. You can also scope it to just listing findings or streaming events while withholding the token from anything else.
GET STARTED