Coro API

Name: Coro API API
Brand: Coro API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityThreat Detectionbearer12 EndpointsREST

For Agents

Inspect Coro-managed devices, retrieve and update detected threats, and manage protection policies for an organisation. Bearer-token authentication with 12 endpoints under /v1.

Quickstart

Get started with Coro API in minutes using your preferred integration method.

# Add to your MCP client config (Claude Desktop, Cursor, Windsurf)
{
  "jentic": {
    "url": "https://api.jentic.com/mcp",
    "auth": "oauth"
  }
}

# Then ask your agent:
"list Coro security threats"

# → Jentic returns the GET /events tool with parameter schema, agent executes.

Capabilities

What an agent can do with Coro API API.

List managed devices and inspect a single device by ID for OS, posture, and protection status

Retrieve detected threats across the tenant and update an individual threat's status to triage incidents

Create, update, and delete protection policies that govern endpoint behaviour

Fetch a specific policy by ID to audit configuration drift before rollout

GET STARTED

Start building with Coro API API

Explore with Jentic

View OpenAPI Document

Use for: Get the list of devices currently managed by Coro, Find all open threats detected on a specific endpoint, I want to update the status of a Coro threat after triage, List all protection policies configured for my Coro tenant

Not supported: Does not handle network firewalling, SIEM event storage, or vulnerability scanning — use for endpoint protection policy and threat management only.

Jentic publishes the only available OpenAPI document for Coro API, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for Coro API, keeping it validated and agent-ready. The Coro API exposes the Coro cybersecurity platform for programmatic management of endpoint devices, security threats, and protection policies across an organisation. Through 12 endpoints under api.coro.net/v1, it covers device inventory lookups, threat triage and status updates, policy lifecycle management, and user listings. It is designed for security operations teams that want to automate triage, enforce policy from CI, or feed Coro signals into SOAR and SIEM workflows.

Use Cases

Patterns agents use Coro API API for, with concrete tasks.

★ Automated Threat Triage

Pull the open threat queue from Coro, enrich each entry with device context from the devices endpoint, and update the threat status once the agent or analyst has decided on a disposition. This compresses the manual SOC loop of opening the console, reading the threat, checking the device, and clicking through status changes.

List all threats with status open from GET /threats, for each call GET /devices/{deviceId} to get device posture, then PATCH /threats/{threatId} with the resolved status.

Policy as Code for Endpoint Protection

Manage Coro protection policies from a Git workflow by reading current policy state, diffing against the desired state in a repo, and pushing changes through POST, PUT, and DELETE on the policies endpoints. Lets security teams review policy changes in pull requests instead of dashboard clicks.

Read all current policies via GET /policies, compare with the desired YAML in the repo, and call POST /policies, PUT /policies/{policyId}, or DELETE /policies/{policyId} to converge state.

Device Inventory Sync to a CMDB

Periodically pull every device managed by Coro and reconcile the inventory with an internal asset database or CMDB so that ownership, OS, and protection status stay aligned across systems. Useful for compliance reports and audit trails.

Page through GET /devices, fetch per-device detail via GET /devices/{deviceId} when needed, and upsert each record into the target CMDB.

Agent-Driven Incident Response via Jentic

An AI agent loaded with Coro tools through Jentic responds to security alerts by inspecting the affected device, reviewing the threat detail, applying or tightening a policy, and then marking the threat resolved. The agent reasons over policy state rather than memorising endpoints.

Search Jentic for 'manage Coro security threats', load the threats and policies operations, then chain GET /threats/{threatId}, PUT /policies/{policyId}, and PATCH /threats/{threatId} into a single response.

Key Endpoints

12 endpoints — jentic publishes the only available openapi specification for coro api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/devices

List managed devices

GET

/threats

List detected threats

PATCH

/threats/{threatId}

Update threat status

GET

/policies

List protection policies

POST

/policies

Create a protection policy

PUT

/policies/{policyId}

Update a protection policy

DELETE

/policies/{policyId}

Delete a protection policy

GET

/devices

List managed devices

GET

/threats

List detected threats

PATCH

/threats/{threatId}

Update threat status

GET

/policies

List protection policies

POST

/policies

Create a protection policy

PUT

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Coro bearer tokens are stored encrypted in the Jentic vault (MAXsystem). Agents receive a scoped execution handle — the raw bearer token is injected into the Authorization header at call time and never enters the agent's context.

Intent-based discovery

Agents search by intent (e.g., 'list Coro threats' or 'update Coro policy') and Jentic returns the matching operation with its input and response schemas, so the agent can call the right endpoint without reading Coro documentation.

Time to first call

Direct Coro integration: 1-2 days for auth, error handling, and pagination. Through Jentic: under 30 minutes — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

CrowdStrike Falcon API

Cloud-native endpoint protection platform with broader threat intelligence and EDR depth than Coro.

Choose CrowdStrike when the workflow needs deep EDR telemetry, threat hunting, or large-enterprise scale rather than Coro's mid-market posture.

Alternative

Sophos SIEM API

Sophos endpoint and SIEM data feed, focused on event export rather than policy management.

Use Sophos SIEM when the agent needs to ingest endpoint events into a SIEM; use Coro when the agent needs to manage policies and triage threats directly.

Complementary

AbuseIPDB API

IP reputation lookup that enriches Coro threat records with external abuse history.

Pair with Coro when triaging a threat to add external reputation context before deciding on policy action.

FAQs

Specific to using Coro API API through Jentic.

Why is there no official OpenAPI spec for Coro API?

Coro does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Coro API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Coro API use?

The Coro API uses HTTP bearer-token authentication: every request must include an Authorization header of the form Bearer <token>. When called through Jentic, the token is held in the Jentic vault and injected at execution time so it never enters the agent's prompt context.

Can I update the status of a threat with the Coro API?

Yes. The PATCH /threats/{threatId} endpoint updates the status of an individual threat, which lets you mark threats as resolved, acknowledged, or otherwise progressed once triage is complete.

What are the rate limits for the Coro API?

The OpenAPI spec does not declare explicit rate limits, so production callers should treat 429 responses as authoritative and back off using the Retry-After header where present. Coro's developer portal at developers.coro.net is the canonical place to confirm current limits before high-volume use.

How do I list all managed devices through Jentic?

Search Jentic for 'list Coro devices', load the GET /devices operation, then execute it. Jentic returns the operation schema so the agent knows exactly which query parameters and response fields are available without browsing Coro documentation.

Can I manage protection policies programmatically?

Yes. The /policies endpoints support POST to create, GET to list or read by ID, PUT to update, and DELETE to remove a policy, which together cover the full lifecycle for policy-as-code workflows.