Cobalt Pentest API

Name: Cobalt Pentest API
Brand: Cobalt Pentest API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityVulnerability Managementbearer9 EndpointsREST

For Agents

Read Cobalt PTaaS data - pentests, findings, assets, and events - to feed dashboards, ticketing, and security review automation.

Install Jentic One Beta

Connect the Cobalt Pentest API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Cobalt Pentest API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fcobalt.io%2Fcobalt" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fcobalt.io%2Fcobalt" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Cobalt Pentest API.

List the organisations a token has access to via GET /orgs

Enumerate pentests and inspect their state via GET /pentests and GET /pentests/{pentestId}

Pull in-scope assets via GET /assets and GET /assets/{assetId}

GET STARTED

Start building with Cobalt Pentest API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use Cobalt Pentest API for, with concrete tasks.

★ Findings to Ticket Sync

Mirror Cobalt findings into Jira, Linear, or GitHub Issues so engineering teams triage pentest output in their normal workflow. GET /findings lists findings with severity and status, and GET /findings/{findingId} returns the full detail including evidence and remediation guidance. Useful for keeping a single source of truth in the engineering tracker without engineers logging into Cobalt.

Call GET /findings filtered to open and severity high, then for each finding call GET /findings/{findingId} and create a matching Jira issue.

Pentest Status Dashboard

Build a real-time dashboard of in-flight and recently completed pentests for security leadership. GET /pentests lists pentests with state and timing, GET /pentests/{pentestId} returns the test plan, and GET /events surfaces lifecycle transitions such as test started, paused, or completed. The combination supports KPI tracking such as findings per pentest and time-to-remediate.

Call GET /pentests filtered to state=in_progress and return the title, start date, and number of high-severity findings for each.

Asset Coverage Audit

Confirm that every production asset is covered by at least one active pentest. GET /assets lists the assets currently registered in Cobalt, and an automation can diff that list against an external CMDB or cloud inventory to flag gaps. Useful for compliance audits that require evidence of testing coverage.

Call GET /assets and compare the returned asset list against a CMDB export, returning any asset missing from Cobalt.

AI Agent Security Triage via Jentic

An AI security copilot uses Jentic to pull Cobalt findings and summarise risk for the on-call engineer. The agent searches for 'list pentest findings', loads the schema, and executes the call without ever holding the personal API token. Jentic adds the X-Org-Token header at execution time and tracks the call for SOC observability.

Use Jentic to search for 'list Cobalt findings', load the GET /findings schema, and return a summary of all critical findings opened in the last week.

Key Endpoints

9 endpoints — jentic publishes the only available openapi specification for cobalt pentest api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/orgs

List organisations

GET

/pentests

List pentests

GET

/pentests/{pentestId}

Get pentest details

GET

/findings

List findings

GET

/findings/{findingId}

Get finding details

GET

/assets

List in-scope assets

GET

/events

List lifecycle events

GET

/orgs

List organisations

GET

/pentests

List pentests

GET

/pentests/{pentestId}

Get pentest details

GET

/findings

List findings

GET

/findings/{findingId}

Get finding details

GET

/assets

List in-scope assets

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring Cobalt by hand means learning its bearer auth plus the required X-Org-Token, targeting api.cobalt.io, and handling paging and retries across its pentest and findings endpoints yourself. Through Jentic you install once, import the Cobalt Pentest API from the API Directory, store the token and org token once, and your agent calls it.

Permission scoping

Cobalt puts the pentest id in the URL path (/pentests/{pentestId}), so a rule can pin your agent to one pentest and its findings. Every listed operation is a read, so the agent reports on findings and events and does nothing that changes state.

Credential isolation

Your Cobalt personal API token and X-Org-Token are stored once, encrypted, by your own Jentic One instance and added to the request at execution time. They never enter the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'list pentest findings' or 'check pentest status', and Jentic returns the matching Cobalt operation with its parameter schema so the agent builds a triage workflow without parsing the docs site.

FAQs

Specific to using Cobalt Pentest API through Jentic.

Why is there no official OpenAPI spec for Cobalt Pentest API?

Cobalt does not publish an OpenAPI specification on its developer site. Jentic generates and maintains this spec so that AI agents and developers can call Cobalt Pentest API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the Cobalt Pentest API use?

The API uses HTTP Bearer authentication with a personal API token created at https://app.cobalt.io/settings/api-tokens. Requests must also include an X-Org-Token header for organisation context. Through Jentic both values are stored encrypted in the vault and injected at execution time.

Can I retrieve pentest findings programmatically with the Cobalt API?

Yes. GET /findings lists findings with severity and status, and GET /findings/{findingId} returns the full detail including evidence and remediation guidance. Filter on the list endpoint to narrow by pentest, severity, or state.

What are the rate limits for the Cobalt Pentest API?

The OpenAPI spec does not declare numeric rate limits. Cobalt applies tenant-specific throttling and surfaces 429 responses on overload, so callers should implement exponential backoff when polling /findings or /events at high frequency.

How do I sync Cobalt findings into a ticketing system through Jentic?

Search Jentic for 'list Cobalt findings', load the GET /findings schema, and execute filtered to state=open. Then for each finding call GET /findings/{findingId} and forward to the ticketing API of your choice. Install the SDK with pip install jentic and call it via the async client.

Does the Cobalt Pentest API expose write endpoints for managing pentests?

The current public spec only exposes read endpoints for organisations, pentests, assets, findings, events, and tokens. Pentest creation and scheduling are handled inside the Cobalt UI; the API is focused on reading PTaaS data into other systems.

Can I limit what my agent is allowed to do with the Cobalt Pentest API?

Yes. Because you run Jentic One yourself, your own rules decide which Cobalt operations and credentials the agent may use, and every Cobalt operation is a read (GET /orgs, /pentests, /findings, /assets, and /events), so the agent can report on pentests and findings but never change state. Since the pentest id sits in the URL path at GET /pentests/{pentestId}, you can pin the agent to a single pentest and its related findings. You can also scope it to just listing findings or streaming events while withholding the token from anything else.