canonical: https://jentic.com/apis/cobalt.io/cobalt

# Cobalt Pentest API

This page describes a curated, agent-optimized Jentic OpenAPI specification for Cobalt Pentest API, scoped to nine read operations and kept validated and agent-ready. Cobalt also publishes its own, broader OpenAPI document for the v2 API, cited in the FAQ below. The API exposes the Cobalt penetration testing as a service (PTaaS) platform - organisations, pentests, in-scope assets, findings, and audit events - through a small set of read endpoints. Authentication uses a personal API token sent as a Bearer credential, with an additional X-Org-Token header to scope requests to a specific organisation.

## For AI agents

Read Cobalt PTaaS data - pentests, findings, assets, and events - to feed dashboards, ticketing, and security review automation.

## Scope

Does not run pentests, file new findings, or deliver remediation tickets directly - use for reading Cobalt PTaaS pentests, findings, assets, and events only.

## Capabilities

- List the organisations a token has access to via GET /orgs
- Enumerate pentests and inspect their state via GET /pentests and GET `/pentests/{pentestId}`
- Pull in-scope assets via GET /assets and GET `/assets/{assetId}`
- Retrieve findings discovered by Cobalt pentesters via GET /findings and GET `/findings/{findingId}`
- Stream audit and lifecycle events from GET /events for SIEM and reporting workflows

## Use cases

### Findings to Ticket Sync

Mirror Cobalt findings into Jira, Linear, or GitHub Issues so engineering teams triage pentest output in their normal workflow. GET /findings lists findings with severity and status, and GET `/findings/{findingId}` returns the full detail including evidence and remediation guidance. Useful for keeping a single source of truth in the engineering tracker without engineers logging into Cobalt.

Example prompt: Call GET /findings filtered to open and severity high, then for each finding call GET `/findings/{findingId}` and create a matching Jira issue.

### Pentest Status Dashboard

Build a real-time dashboard of in-flight and recently completed pentests for security leadership. GET /pentests lists pentests with state and timing, GET `/pentests/{pentestId}` returns the test plan, and GET /events surfaces lifecycle transitions such as test started, paused, or completed. The combination supports KPI tracking such as findings per pentest and time-to-remediate.

Example prompt: Call GET /pentests filtered to state=in_progress and return the title, start date, and number of high-severity findings for each.

### Asset Coverage Audit

Confirm that every production asset is covered by at least one active pentest. GET /assets lists the assets currently registered in Cobalt, and an automation can diff that list against an external CMDB or cloud inventory to flag gaps. Useful for compliance audits that require evidence of testing coverage.

Example prompt: Call GET /assets and compare the returned asset list against a CMDB export, returning any asset missing from Cobalt.

### AI Agent Security Triage via Jentic

An AI security copilot uses Jentic to pull Cobalt findings and summarise risk for the on-call engineer. The agent searches for 'list pentest findings', loads the schema, and executes the call without ever holding the personal API token. Jentic adds the X-Org-Token header at execution time and tracks the call for SOC observability.

Example prompt: Use Jentic to search for 'list Cobalt findings', load the GET /findings schema, and return a summary of all critical findings opened in the last week.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/orgs` | List organisations |
| GET | `/pentests` | List pentests |
| GET | `/pentests/{pentestId}` | Get pentest details |
| GET | `/findings` | List findings |
| GET | `/findings/{findingId}` | Get finding details |
| GET | `/assets` | List in-scope assets |
| GET | `/events` | List lifecycle events |

## Key resources

- **Organisations** — List the Cobalt organisations a token can access
- **Pentests** — Enumerate and inspect penetration tests
- **Assets** — Browse in-scope assets registered for testing
- **Findings** — Read findings with severity, status, and remediation detail
- **Events** — Read lifecycle and audit events from the platform
- **Tokens** — List the personal API tokens issued for an account

## Why Jentic

- **Setup:** Wiring Cobalt by hand means learning its bearer auth plus the required X-Org-Token, targeting api.cobalt.io, and handling paging and retries across its pentest and findings endpoints yourself. Through Jentic you install once, import the Cobalt Pentest API from the API Directory, store the token and org token once, and your agent calls it.
- **Permission scoping:** Cobalt puts the pentest id in the URL path (`/pentests/{pentestId}`), so a rule can pin your agent to one pentest and its findings. Every listed operation is a read, so the agent reports on findings and events and does nothing that changes state.
- **Credential handling:** Your Cobalt personal API token and X-Org-Token are stored once, encrypted, by your own Jentic One instance and added to the request at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list pentest findings' or 'check pentest status', and Jentic returns the matching Cobalt operation with its parameter schema so the agent builds a triage workflow without parsing the docs site.

## Related APIs

- **HackerOne** — HackerOne is a competing crowdsourced security testing platform with a richer findings API.
- **Detectify** — Detectify provides automated external attack surface and web app scanning.
- **Snyk** — Snyk covers code, dependency, and container vulnerability scanning.
- **Tenable Nessus** — Nessus provides infrastructure vulnerability scanning across networks.

## FAQ

### Which OpenAPI specification does this Cobalt Pentest API page describe?

A curated, agent-optimized Jentic specification covering nine read endpoints across Cobalt organisations, pentests, assets, findings, events, and tokens. Cobalt also publishes its own OpenAPI document at https://api.us.cobalt.io/cobalt-api-docs/v2.json, an OpenAPI 3.1.0 file with 49 paths that spans the full v2 surface, including create, update, and delete calls and areas this page does not cover such as DAST scans, webhooks, and integrations. The Jentic variant narrows that surface to the read calls an agent needs for pentest reporting and finding triage, and it is validated and kept agent-ready. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Cobalt Pentest API use?

The API uses HTTP Bearer authentication with a personal API token created at https://app.cobalt.io/settings/api-tokens. Requests must also include an X-Org-Token header for organisation context. Through Jentic both values are stored encrypted in the vault and injected at execution time.

### Can I retrieve pentest findings programmatically with the Cobalt API?

Yes. GET /findings lists findings with severity and status, and GET `/findings/{findingId}` returns the full detail including evidence and remediation guidance. Filter on the list endpoint to narrow by pentest, severity, or state.

### What are the rate limits for the Cobalt Pentest API?

The OpenAPI spec does not declare numeric rate limits. Cobalt applies tenant-specific throttling and surfaces 429 responses on overload, so callers should implement exponential backoff when polling /findings or /events at high frequency.

### How do I sync Cobalt findings into a ticketing system through Jentic?

Search Jentic for 'list Cobalt findings', load the GET /findings schema, and execute filtered to state=open. Then for each finding call GET `/findings/{findingId}` and forward to the ticketing API of your choice. Install the SDK with pip install jentic and call it via the async client.

### Does the Cobalt Pentest API expose write endpoints for managing pentests?

This Jentic specification covers read endpoints only, for organisations, pentests, assets, findings, events, and tokens. Cobalt's own v2 document does define write calls, including creating and updating assets, pentests, findings, and integrations, so work from the vendor document instead if your agent needs to change state in Cobalt.

### Can I limit what my agent is allowed to do with the Cobalt Pentest API?

Yes. Because you run Jentic One yourself, your own rules decide which Cobalt operations and credentials the agent may use, and every Cobalt operation is a read (GET /orgs, /pentests, /findings, /assets, and /events), so the agent can report on pentests and findings but never change state. Since the pentest id sits in the URL path at GET `/pentests/{pentestId}`, you can pin the agent to a single pentest and its related findings. You can also scope it to just listing findings or streaming events while withholding the token from anything else.