Download OpenAPI specification:
Programmatic access to your cloud security detection coverage data.
The A13E Public API enables you to integrate detection coverage data into your security workflows, dashboards, and automation pipelines. Use it to:
All requests require an API key passed in the X-API-Key header:
curl -H "X-API-Key: dcv_live_xxxxxxxxxx" \
https://api.a13e.com/api/v1/public/accounts/{id}/coverage
API keys begin with dcv_live_.
Requests are rate-limited based on your subscription tier:
| Tier | Rate Limit | Price |
|---|---|---|
| Individual | 1,000 requests/hour | £29/mo |
| Pro | 10,000 requests/hour | £250/mo |
| Enterprise | 100,000 requests/hour | Custom |
Note: API access requires a paid subscription. Free tier users will receive a
403 Forbiddenresponse.
Rate limit headers are included in all responses:
| Header | Description |
|---|---|
X-RateLimit-Limit |
Maximum requests per hour |
X-RateLimit-Remaining |
Requests remaining in current window |
X-RateLimit-Reset |
Unix timestamp when limit resets |
When rate limited, you'll receive a 429 Too Many Requests response. Use exponential backoff when retrying.
The API uses standard HTTP status codes:
| Code | Meaning |
|---|---|
200 |
Success |
400 |
Bad request (invalid parameters) |
401 |
Unauthorised (invalid or missing API key) |
403 |
Forbidden (insufficient permissions) |
404 |
Resource not found |
409 |
Conflict (e.g., scan already running) |
429 |
Rate limit exceeded |
500 |
Internal server error |
Error responses include a JSON body with details:
{
"detail": "Cloud account not found"
}
import requests
API_KEY = "dcv_live_xxxxxxxxxx"
BASE_URL = "https://api.a13e.com/api/v1/public"
headers = {"X-API-Key": API_KEY}
# Get coverage for an account
response = requests.get(
f"{BASE_URL}/accounts/{account_id}/coverage",
headers=headers
)
coverage = response.json()
print(f"Coverage: {coverage['coverage_percent']:.1f}%")
const API_KEY = 'dcv_live_xxxxxxxxxx';
const BASE_URL = 'https://api.a13e.com/api/v1/public';
const response = await fetch(
`${BASE_URL}/accounts/${accountId}/coverage`,
{ headers: { 'X-API-Key': API_KEY } }
);
const coverage = await response.json();
console.log(`Coverage: ${coverage.coverage_percent.toFixed(1)}%`);
# Get coverage summary
curl -H "X-API-Key: dcv_live_xxx" \
"https://api.a13e.com/api/v1/public/accounts/{account_id}/coverage"
# Trigger a scan
curl -X POST -H "X-API-Key: dcv_live_xxx" \
-H "Content-Type: application/json" \
-d '{"regions": ["eu-west-2"]}' \
"https://api.a13e.com/api/v1/public/accounts/{account_id}/scans"
Coverage metrics and gap analysis for cloud accounts. Get overall coverage percentages, per-technique breakdown, and prioritised gaps with remediation guidance.
Get coverage summary for a cloud account.
Returns the latest coverage snapshot including total techniques, covered techniques, and coverage percentage.
| cloud_account_id required | string <uuid> (Cloud Account Id) |
{- "cloud_account_id": "string",
- "cloud_account_name": "string",
- "total_techniques": 0,
- "covered_techniques": 0,
- "coverage_percent": 0,
- "average_confidence": 0,
- "last_scan_at": "string",
- "created_at": "string"
}Get per-technique coverage details.
Returns coverage status for each MITRE ATT&CK technique with filtering options by tactic or status.
| cloud_account_id required | string <uuid> (Cloud Account Id) |
Tactic (string) or Tactic (null) (Tactic) Filter by tactic ID | |
Status (string) or Status (null) (Status) Filter by status: covered, partial, uncovered | |
| limit | integer (Limit) [ 1 .. 500 ] Default: 100 |
| offset | integer (Offset) >= 0 Default: 0 |
{- "cloud_account_id": "string",
- "techniques": [
- {
- "technique_id": "string",
- "technique_name": "string",
- "tactic_id": "string",
- "tactic_name": "string",
- "detection_count": 0,
- "max_confidence": 0,
- "status": "string"
}
], - "total": 0
}Get coverage gaps for a cloud account.
Returns uncovered techniques prioritised by importance.
| cloud_account_id required | string <uuid> (Cloud Account Id) |
Priority (string) or Priority (null) (Priority) Filter by priority: critical, high, medium, low | |
| limit | integer (Limit) [ 1 .. 200 ] Default: 50 |
| offset | integer (Offset) >= 0 Default: 0 |
{- "cloud_account_id": "string",
- "gaps": [
- {
- "technique_id": "string",
- "technique_name": "string",
- "tactic_id": "string",
- "tactic_name": "string",
- "priority": "string",
- "has_template": true
}
], - "total": 0
}List detections for a cloud account.
Returns paginated list of discovered security detections with optional filtering by type, status, or region.
| cloud_account_id required | string <uuid> (Cloud Account Id) |
Detection Type (string) or Detection Type (null) (Detection Type) Filter by detection type | |
Status (string) or Status (null) (Status) Filter by status | |
Region (string) or Region (null) (Region) Filter by region | |
| page | integer (Page) >= 1 Default: 1 |
| page_size | integer (Page Size) [ 1 .. 200 ] Default: 50 |
{- "cloud_account_id": "string",
- "detections": [
- {
- "id": "string",
- "name": "string",
- "detection_type": "string",
- "status": "string",
- "region": "string",
- "is_managed": true,
- "mapping_count": 0,
- "discovered_at": "string"
}
], - "total": 0,
- "page": 0,
- "page_size": 0
}Get detection details.
Returns full details of a specific detection including mapped MITRE ATT&CK techniques.
| detection_id required | string <uuid> (Detection Id) |
{- "id": "string",
- "name": "string",
- "detection_type": "string",
- "status": "string",
- "source_arn": "string",
- "region": "string",
- "description": "string",
- "is_managed": true,
- "mapping_count": 0,
- "mapped_techniques": [
- "string"
], - "discovered_at": "string",
- "updated_at": "string"
}Trigger a new scan for a cloud account.
Creates a new scan job that will discover security detections in the specified cloud account. Returns immediately with the scan ID - use GET /scans/{id} to check status.
| cloud_account_id required | string <uuid> (Cloud Account Id) |
Array of Regions (strings) or Regions (null) (Regions) |
{- "regions": [
- "string"
]
}{- "id": "string",
- "status": "string",
- "message": "string"
}List scans for a cloud account.
Returns most recent scans with optional status filtering.
| cloud_account_id required | string <uuid> (Cloud Account Id) |
Status (string) or Status (null) (Status) Filter by status | |
| limit | integer (Limit) [ 1 .. 100 ] Default: 20 |
{- "cloud_account_id": "string",
- "scans": [
- {
- "id": "string",
- "status": "string",
- "progress_percent": 0,
- "detections_found": 0,
- "started_at": "string",
- "completed_at": "string",
- "created_at": "string"
}
], - "total": 0
}Get scan details and status.
Returns full details of a specific scan including progress and results.
| scan_id required | string <uuid> (Scan Id) |
{- "id": "string",
- "cloud_account_id": "string",
- "status": "string",
- "progress_percent": 0,
- "current_step": "string",
- "regions": [
- "string"
], - "detections_found": 0,
- "detections_new": 0,
- "detections_updated": 0,
- "detections_removed": 0,
- "errors": [
- { }
], - "started_at": "string",
- "completed_at": "string",
- "created_at": "string"
}Discovered security detections in your cloud accounts. List detections by account with filtering, and get detailed information including MITRE ATT&CK technique mappings.
List detections for a cloud account.
Returns paginated list of discovered security detections with optional filtering by type, status, or region.
| cloud_account_id required | string <uuid> (Cloud Account Id) |
Detection Type (string) or Detection Type (null) (Detection Type) Filter by detection type | |
Status (string) or Status (null) (Status) Filter by status | |
Region (string) or Region (null) (Region) Filter by region | |
| page | integer (Page) >= 1 Default: 1 |
| page_size | integer (Page Size) [ 1 .. 200 ] Default: 50 |
{- "cloud_account_id": "string",
- "detections": [
- {
- "id": "string",
- "name": "string",
- "detection_type": "string",
- "status": "string",
- "region": "string",
- "is_managed": true,
- "mapping_count": 0,
- "discovered_at": "string"
}
], - "total": 0,
- "page": 0,
- "page_size": 0
}Get detection details.
Returns full details of a specific detection including mapped MITRE ATT&CK techniques.
| detection_id required | string <uuid> (Detection Id) |
{- "id": "string",
- "name": "string",
- "detection_type": "string",
- "status": "string",
- "source_arn": "string",
- "region": "string",
- "description": "string",
- "is_managed": true,
- "mapping_count": 0,
- "mapped_techniques": [
- "string"
], - "discovered_at": "string",
- "updated_at": "string"
}Detection discovery scans. Trigger new scans to discover security detections, monitor scan progress, and retrieve scan results.
Trigger a new scan for a cloud account.
Creates a new scan job that will discover security detections in the specified cloud account. Returns immediately with the scan ID - use GET /scans/{id} to check status.
| cloud_account_id required | string <uuid> (Cloud Account Id) |
Array of Regions (strings) or Regions (null) (Regions) |
{- "regions": [
- "string"
]
}{- "id": "string",
- "status": "string",
- "message": "string"
}List scans for a cloud account.
Returns most recent scans with optional status filtering.
| cloud_account_id required | string <uuid> (Cloud Account Id) |
Status (string) or Status (null) (Status) Filter by status | |
| limit | integer (Limit) [ 1 .. 100 ] Default: 20 |
{- "cloud_account_id": "string",
- "scans": [
- {
- "id": "string",
- "status": "string",
- "progress_percent": 0,
- "detections_found": 0,
- "started_at": "string",
- "completed_at": "string",
- "created_at": "string"
}
], - "total": 0
}Get scan details and status.
Returns full details of a specific scan including progress and results.
| scan_id required | string <uuid> (Scan Id) |
{- "id": "string",
- "cloud_account_id": "string",
- "status": "string",
- "progress_percent": 0,
- "current_step": "string",
- "regions": [
- "string"
], - "detections_found": 0,
- "detections_new": 0,
- "detections_updated": 0,
- "detections_removed": 0,
- "errors": [
- { }
], - "started_at": "string",
- "completed_at": "string",
- "created_at": "string"
}