Detectify API
Agent-ready OpenAPI document · curated by JenticSecurityVulnerability ManagementapiKey9 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Pull external attack surface data from Detectify - discovered IPs, technologies, exposed ports, and breach exposure - and manage AWS connectors used for asset discovery.
Use for: List all IP addresses discovered on our attack surface, Find all exposed ports on monitored assets, Retrieve the technologies fingerprinted on our public domains, Check whether any of our domains appear in breach data
Not supported: Does not handle internal authenticated vulnerability scanning, code-level SAST, or container image scanning - use for external attack surface monitoring only.
Jentic maintains a curated, agent-optimized OpenAPI specification for Detectify API, keeping it validated and agent-ready. Detectify publishes its own OpenAPI document for the V3 API on its developer portal; the Jentic variant is a 9-operation subset of it, covering the attack-surface reads and AWS connector management on this page while leaving out Detectify's monitoring-settings operations. Detectify is an external attack surface management and web vulnerability scanning platform. The API exposes surface monitoring data - discovered IP addresses, fingerprinted technologies, exposed ports, and known breaches - alongside connector management for AWS asset discovery. It is designed for security teams that want to feed continuous attack-surface signals into SOAR pipelines, ticketing systems, or agent workflows.
Install Jentic One Beta
Connect the Detectify API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Detectify API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fdetectify.com%2Fdetectify" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fdetectify.com%2Fdetectify" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Detectify API.
List every IP address Detectify has discovered across your monitored attack surface
Inventory the technologies and software versions fingerprinted on your public-facing assets
Surface every exposed port found during external surface monitoring scans
Retrieve breach exposure records tied to your monitored domains
Provision and revoke AWS connectors that feed cloud assets into Surface Monitoring
Fetch the AWS external ID required to configure cross-account IAM roles for Detectify
Use Cases
Patterns agents use Detectify API for, with concrete tasks.
★ Continuous Attack Surface Inventory
Security teams use the Detectify API to maintain an always-current inventory of internet-facing assets. The /ips and /technologies endpoints expose every IP and software fingerprint Detectify has discovered through Surface Monitoring, letting teams detect shadow IT and unsanctioned cloud deployments. Inventory pulls typically run on a scheduled job and feed asset management or CMDB systems.
Call GET /ips and GET /technologies, then diff the results against yesterday's snapshot to flag newly discovered assets.
Exposed Port Alerting
The /ports endpoint returns every open port found during external scanning, useful for catching accidentally exposed services like databases, admin panels, or staging environments. Pair this with internal change-control data to spot ports that opened without an approved ticket.
Fetch GET /ports daily, compare against an allowlist of approved ports, and post a Slack alert for any non-allowlisted port.
Breach Exposure Monitoring
Use the /breaches endpoint to retrieve credential and data-breach records tied to your monitored domains. Security operations teams pipe this into incident response runbooks to force password resets and notify affected users when breach data first appears.
Poll GET /breaches every 6 hours and create a security incident ticket for each new breach record returned.
AWS Connector Lifecycle Management
The /connectors and /aws-external-id endpoints let you programmatically provision the AWS connectors that Detectify uses to discover cloud assets. This matters for organisations with many AWS accounts where manual connector setup is slow and error-prone.
Get the AWS external ID via GET /aws-external-id, then POST /connectors with the role ARN to register a new AWS account for surface monitoring.
Agent-Driven Security Triage
AI agents can use Detectify through Jentic to pull live attack surface data into triage workflows - listing exposed IPs, checking breach exposure, and reconciling asset inventories without a human curating the output. Through Jentic, the Detectify API key stays in the credential vault and the agent only sees scoped responses.
Search Jentic for 'list discovered IPs from Detectify', load the operation, and execute it with the user's stored credentials to return a deduplicated IP list.
Key Endpoints
9 endpoints — jentic maintains a curated, agent-optimized openapi specification for detectify api, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/ips
List all discovered IP addresses
GET
/technologies
List fingerprinted technologies on monitored assets
GET
/ports
List exposed ports across the surface
GET
/breaches
List breach records tied to monitored domains
GET
/connectors
List configured AWS connectors
POST
/connectors
Create a new AWS connector
DELETE
/connectors/{id}
Remove an AWS connector
GET
/aws-external-id
Fetch the AWS external ID for IAM role configuration
GET
/ips
List all discovered IP addresses
GET
/technologies
List fingerprinted technologies on monitored assets
GET
/ports
List exposed ports across the surface
GET
/breaches
List breach records tied to monitored domains
GET
/connectors
List configured AWS connectors
POST
/connectors
Create a new AWS connector
DELETE
/connectors/{id}
Remove an AWS connector
GET
/aws-external-id
Fetch the AWS external ID for IAM role configuration
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring Detectify by hand means learning its API key header, building the attack-surface calls for IPs, technologies, ports, and breaches, and managing connectors yourself. Through Jentic you install once, import the Detectify API from the API Directory, store the key once, and your agent calls it.
Permission scoping
Most Detectify operations here are read-only attack-surface listings, so you limit the agent to the operations it needs, such as listing discovered IPs or ports, and connector creation or the connector deletion at /connectors/{id} is included only if you add those operations.
Credential isolation
Your Detectify API key is stored once, encrypted, by your own Jentic One instance and injected into the Authorization header at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'list discovered IPs from Detectify' or 'check exposed ports', and Jentic returns the matching Detectify operation with its input schema so the agent calls the right endpoint without browsing Detectify documentation.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Detectify API through Jentic.
Which OpenAPI specification does this Detectify API page describe?
A curated, agent-optimized Jentic specification covering 9 Detectify operations. Detectify also publishes its own OpenAPI document for the V3 API, served as reference documentation with a download link at https://developer.detectify.com/, which covers 17 operations and adds monitoring-settings management for domain and IP assets. The Jentic variant is the 9-operation subset, validated against the live API and shaped for agent tool calling, so it is a deliberate curation rather than a silent substitute. Get started with Jentic One, the self-hosted execution layer.
What authentication does the Detectify API use?
Detectify uses an API key passed in a request header (apiKeyAuth scheme). Through Jentic, the key is stored encrypted in the credential vault and injected at execution time, so the raw key never enters the agent's context.
Can I list every IP address Detectify has discovered with the Detectify API?
Yes - call GET /ips to retrieve every IP address Detectify has discovered through Surface Monitoring. The response includes all monitored assets and can be diffed against prior snapshots to detect newly exposed infrastructure.
What are the rate limits for the Detectify API?
Detectify does not publish rate limits in the OpenAPI spec. Treat the API as conservatively rate-limited and cache responses for asset inventory pulls; surface monitoring data does not change second-to-second.
How do I set up an AWS connector through Jentic?
Search Jentic for 'create AWS connector in Detectify', load the operation, then call GET /aws-external-id to get the external ID, configure the IAM role in AWS, and POST /connectors with the role ARN. The full flow runs through Jentic's search, load, execute pattern.
Can I retrieve breach exposure data for my domains with the Detectify API?
Yes - GET /breaches returns breach records tied to the domains under your monitored attack surface. Poll this endpoint on a schedule and pipe new records into incident response workflows.
Can I limit what my agent is allowed to do with the Detectify API?
Yes. Because Jentic One is self-hosted, your own rules decide which Detectify operations and credentials the agent can use. Most operations here are read-only attack-surface listings, so you can restrict the agent to just the calls it needs, such as GET /ips, GET /ports, GET /technologies, or GET /breaches. Connector changes like POST /connectors or DELETE /connectors/{id} are only available to the agent if you explicitly add those operations.
GET STARTED