canonical: https://jentic.com/apis/mindfort.ai/mindfort

# MindFort API

The MindFort API runs AI-driven security assessments against your web apps, APIs, and networks and manages the findings they produce. You register targets with a target_type of `web_app`, `api`, or `network`, attach test credentials with email, authenticator, or SMS second factors, and trigger black-box or white-box assessments in balanced, deep, or ultra mode. Findings can be filtered by severity and status, resolved with a reason such as FIX or FALSE_POSITIVE, retested, commented on, and rolled up into health scores, SLA and remediation metrics, and full or condensed reports. A Discovery feature schedules runs that suggest new targets to accept or dismiss.

## For AI agents

Register targets, trigger MindFort security assessments, triage and retest findings, and pull security metrics and reports.

## Scope

Does not scan source code dependencies, manage cloud configuration, or issue compliance certifications. Use for MindFort security assessments, findings, and reports only.

## Capabilities

- Trigger a black-box or white-box assessment of a target in balanced, deep, or ultra assessment_method
- List findings filtered by severity, status, target_id, or assessment_id and sort them by severity or created_at
- Resolve findings one at a time or in bulk with resolve_reason FIX, WONT_FIX, or FALSE_POSITIVE
- Retest a finding after a fix, optionally with a specific target_credential_id
- Store test credentials for a target and fetch email MFA, authenticator 2FA, or SMS codes during testing
- Generate a full or condensed report for a target and download it
- Track a target's health score, severity history, SLA metrics, and finding aging

## Use cases

### Agent-driven finding triage through Jentic

A coding agent can close the loop between a security finding and a fix. Through Jentic it lists active critical and high findings for a target, reads each finding, ships a fix in the codebase, then calls retest and resolves the finding with resolve_reason FIX once the retest passes. The MindFort API key stays on your own Jentic One instance, and your rules can keep target deletion and credential changes out of the agent's reach.

Example prompt: GET `/v1/findings` with target_id 'tgt_123', severity 'critical', status 'ACTIVE'; for each, GET `/v1/findings/{finding_id}`, apply the fix, POST `/v1/findings/{finding_id}/retest`, then POST `/v1/findings/{finding_id}/status` with status 'RESOLVED' and resolve_reason 'FIX'

### Security testing in release pipelines

Teams can trigger an assessment when a release reaches staging. The trigger operation requires a target_id and accepts assessment_type black-box or white-box, assessment_method balanced, deep, or ultra, and a target_credential_id for authenticated testing. Assessments run asynchronously, so the pipeline polls the assessment and can cancel it if the release is pulled.

Example prompt: POST `/v1/assessments/run` with target_id 'tgt_123', assessment_type 'black-box', assessment_method 'balanced', then poll GET `/v1/assessments/{assessment_id}` until it completes

### Authenticated testing with MFA-protected accounts

Many apps hide their riskiest surface behind login. MindFort stores test credentials per target, with a credential_type, username, password, role, and login_instructions, and exposes operations that fetch email MFA, authenticator 2FA, and SMS codes so assessments can sign in. An email credential can be generated for targets that need a fresh inbox.

Example prompt: POST `/v1/targets/tgt_123/credentials` with credential_name 'qa-admin', credential_type and username for the admin test account, and role 'admin'

### Security posture reporting

Security leads can report on posture without exporting spreadsheets. Metrics operations return current metrics, timeseries, remediation and SLA metrics, finding aging, and severity and category distributions per target_id, and reports can be generated at full or condensed report_detail_level and downloaded.

Example prompt: POST `/v1/reports` with target_id 'tgt_123' and report_detail_level 'condensed', poll GET `/v1/reports/{report_id}`, then GET `/v1/reports/{report_id}/download`

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/v1/assessments/run` | Trigger an assessment |
| GET | `/v1/findings` | List findings |
| POST | `/v1/findings/{finding_id}/status` | Update finding status |
| POST | `/v1/findings/{finding_id}/retest` | Retest a finding |
| POST | `/v1/targets` | Create a target |
| POST | `/v1/reports` | Create a report |
| GET | `/v1/targets/{target_id}/health-score` | Get target health score |

## Key resources

- **Targets** — Register web apps, APIs, and networks to test, with health scores
- **Target credentials** — Test accounts and MFA, 2FA, and SMS code retrieval
- **Assessments** — Trigger, list, read, and cancel security assessments
- **Findings** — List, read, resolve, retest, re-rate, and comment on findings
- **Metrics** — Severity, remediation, SLA, aging, and timeseries metrics
- **Reports** — Create and download full or condensed reports
- **Discovery** — Schedule runs and accept or dismiss suggested targets

## AI readiness

This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.

- **Score:** 62 / 100
- **Maturity:** AI-Aware
- **Dimensions:**
  - Foundational Compliance: 99 / 100
  - Developer Experience & Jentic Compatibility: 61 / 100
  - AI-Readiness & Agent Experience: 45 / 100
  - Agent Usability: 93 / 100
  - Security: 60 / 100
  - AI Discoverability: 51 / 100
- **View full report:** https://jentic.com/apis/mindfort.ai/mindfort/scorecard
- **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/
- **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview

### Score it yourself

Every API in the directory is allowlisted, so you can re-score it with no key required.

- **Score your own API:** https://jentic.com/scorecard.md
- **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md

```sh
npx @jentic/api-scorecard-cli score <openapi-url>
```

## Why Jentic

- **Setup:** Wiring MindFort by hand means attaching its bearer key, polling asynchronous assessments, and paging through findings, metrics, and reports. Through Jentic you install once, import MindFort from the API Directory, store the key once, and your agent calls it.
- **Permission scoping:** MindFort puts the target id and finding id in the URL path (`/v1/targets/{target_id}/...`, `/v1/findings/{finding_id}/...`), so a rule can pin your agent to one target or finding and the operations you pick. You choose the operations it may call, so destructive ones like target deletion or reading stored test credentials are not included unless you add them.
- **Credential handling:** Your MindFort API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list critical security findings' or 'retest a vulnerability', and Jentic returns the matching MindFort operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Detectify API** — External attack surface and web app scanning
- **Probely API** — DAST scanning of web apps and APIs
- **Cobalt API** — Pentest as a service with human testers
- **Linear API** — Issue tracking for engineering teams

## FAQ

### What authentication does the MindFort API use?

Per its OpenAPI spec, the MindFort API uses an API key generated from the MindFort dashboard, sent as a bearer token (bearerAuth): `Authorization: Bearer <your-api-key>`. Through Jentic the key is stored encrypted by your own Jentic One instance and injected when the agent calls.

### Can I mark findings as false positives in bulk with the MindFort API?

Yes. POST `/v1/findings/status` takes a list of finding_ids with a status of ACTIVE, RESOLVED, or ARCHIVED and an optional resolve_reason of FIX, WONT_FIX, or FALSE_POSITIVE plus resolve_context. For a single finding use POST `/v1/findings/{finding_id}/status.`

### How do I trigger an assessment through Jentic?

Install Jentic One with `curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh`, import the MindFort API from the directory, and store your API key. Your agent searches 'run a security assessment on a target', gets POST `/v1/assessments/run` with its schema, and sends the required target_id with an assessment_type and assessment_method. To run it on your own infrastructure, install Jentic One from its GitHub repo.

### Can I limit what my agent is allowed to do with the MindFort API?

Yes. For example, allow GET `/v1/findings`, GET `/v1/findings/{finding_id}`, POST `/v1/findings/{finding_id}/retest`, and POST `/v1/findings/{finding_id}/status`, so a fixing agent can read, retest, and resolve findings but cannot launch new assessments, delete targets, or read stored test credentials. Every call it makes is logged.

### Is there a MindFort MCP server?

You don't need an MCP server to give your agent MindFort. Jentic connects it directly from the API Directory: import it, store your credential once, and your agent calls it.

### What are the rate limits for the MindFort API?

The OpenAPI spec does not specify rate limits. Check the MindFort documentation at https://docs.mindfort.ai for current limits.

### What does a secured finding mean in MindFort?

Per the spec, informational probe results are labeled secured, as opposed to vulnerable findings. List findings with exclude_secured or status_filter vulnerable to see only issues that need fixing, or include secured results in a report with include_secured_findings.