canonical: https://jentic.com/apis/rapid7.com/rapid7

# Rapid7 VM API

Overview This guide documents the Rapid7 VM Application Programming Interface (API) Version 3. This API supports the Representation State Transfer (REST) design pattern. Unless noted otherwise this API accepts and produces the `application/json` media type. This API uses Hypermedia as the Engine of Application State (HATEOAS) and is hypermedia friendly. All API connections must be made to the secu. The API exposes 330 endpoints secured with basic authentication.

## For AI agents

Programmatically resources, console commands. Covers 330 operations with basic authentication.

## Scope

Does not handle payments, communications, or developer tools - use for crm only.

## Capabilities

- Resources
- Console Commands
- Information
- License
- Logs
- Properties

## Use cases

### CRM Operations

Use the Rapid7 VM API to perform crm operations programmatically. The API provides 330 endpoints covering core functionality including resources, console commands, information.

Example prompt: Call GET /api/3 to resources

### Automated Root Management

Automate root operations by combining multiple Rapid7 VM API endpoints. Agents can console commands and then information in a single workflow.

Example prompt: Call POST /api/3/administration/commands to console commands, then verify the result

### AI Agent Integration via Jentic

AI agents discover and call Rapid7 VM API endpoints through Jentic without managing credentials directly. An agent searches for the required operation by intent, receives the matching endpoint schema, and executes the call with Jentic-managed authentication. This eliminates the need to read API documentation or handle basic tokens manually.

Example prompt: Search Jentic for 'resources', load the operation schema, and execute with Jentic-managed credentials

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /api/3 | Resources |
| POST | /api/3/administration/commands | Console Commands |
| GET | /api/3/administration/info | Information |
| POST | /api/3/administration/license | License |
| GET | /api/3/administration/license | License |
| GET | /api/3/administration/logs | Logs |
| GET | /api/3/administration/properties | Properties |
| GET | /api/3/administration/settings | Settings |

## Key resources

- **Root** — Provides access to primary entry point for discovering the available resources in this API.
- **Asset** — Resources and operations for managing assets. Assets can be created under the <a href="#operation/cr
- **Asset Discovery** — Resources for managing and viewing the mechanisms used to automatically discover assets.
- **Asset Group** — Asset Group Tag
- **Credential** — Resources and operations for managing shared credentials.

## Why Jentic

- **Setup:** Wiring the Rapid7 VM API by hand means handling its basic auth, pointing every call at your own host and port, and hand-coding requests across hundreds of administration, asset, and scan endpoints. Through Jentic you install once, import the Rapid7 VM API from the API Directory, store the credential once, and your agent calls it.
- **Permission scoping:** Rapid7 puts resource ids in the URL path across its asset and scan endpoints, so a rule can pin your agent to one resource such as a single asset or scan. You choose the operations it may call, so destructive ones like posting administration commands or updating the license are not included unless you add them.
- **Credential handling:** Your Rapid7 credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list scanned assets' or 'get scan results', and Jentic returns the matching Rapid7 operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Hubspot** — Alternative crm API
- **Salesforce** — Alternative crm API
- **Pipedrive** — Complementary crm API
- **Zoho** — Complementary crm API

## FAQ

### What authentication does the Rapid7 VM API use?

The Rapid7 VM API uses HTTP Basic authentication. Through Jentic, these credentials are stored encrypted in your Jentic One instance and injected at execution time, so raw secrets never enter the agent context.

### Can I resources with the Rapid7 VM API?

Yes. Use the GET /api/3 endpoint. The API returns structured JSON responses that agents can parse and act on directly.

### What are the rate limits for the Rapid7 VM API?

Rate limits are not specified in the OpenAPI spec. Check the vendor documentation for current limits. Through Jentic, rate limiting is handled automatically with retry logic built into the execution layer.

### How do I resources through Jentic?

Install the Jentic SDK with pip install jentic, authenticate through Jentic One, the self-hosted execution layer, then search for 'resources'. Jentic returns the matching Rapid7 VM API operation with its input schema. Load the schema and execute the call - credentials are injected automatically.

### How many endpoints does the Rapid7 VM API have?

The Rapid7 VM API exposes 330 endpoints covering root, asset, asset discovery operations.

### Can I limit what my agent is allowed to do with the Rapid7 VM API?

Yes. Because you run Jentic One yourself, your own rules decide which Rapid7 operations and credentials the agent may use. Rapid7 puts resource ids in the URL path across its asset and scan endpoints, so you can pin the agent to a single asset or scan rather than the whole console. You also choose which operations it may call, so destructive ones like posting administration commands or updating the license stay off limits unless you explicitly add them.