CentralCSP REST API
The CentralCSP REST API. Bearer authentication with a workspace API key, cursor pagination, per-endpoint rate limits, and the generated reference.
Last update:
The CentralCSP REST API lets you read and manage your client-side security data from your own code, from browser reports and the script inventory to PCI DSS records and alerting, over plain HTTPS and JSON.
The full, always-current endpoint reference is generated from our OpenAPI specification and lives under Reference in this section's sidebar. It covers every endpoint, request and response schema, and status code. This page is the conceptual material around it.
Authentication
Send a workspace API key as a bearer token on every request:
Authorization: Bearer ccsp_...Requests go to the /v1 base path:
curl -H "Authorization: Bearer ccsp_..." \
https://api.centralcsp.com/v1/workspacesKeys are prefixed ccsp_ and are created from Settings > API keys, which needs the workspace Admin role and a plan that includes API access.
A key acts as the person who created it
There are no per-key scopes. A key carries its creator's current roles and reaches only the workspace it was created in.
That makes the creating account the real permission boundary. A key created by a workspace Admin can reach every website, because Admins can. Create keys from an account with the narrowest access that does the job.
Two more constraints worth designing around:
- Expiry and allowed IPs are set at creation only. Changing either means revoking the key and issuing a new one.
- The secret is shown once. There is no way to recover it.
See API keys.
Pagination
List endpoints use cursor pagination. Pass a limit for the page size; each response carries a nextCursor and a hasMore flag.
To read the next page, send the returned nextCursor back as the cursor query parameter, and keep going until hasMore is false. Endpoints that support search also accept a q parameter.
Rate limits
Limits are applied per endpoint rather than as one global budget, and the API does not return standard rate-limit headers. A limited request answers with 429.
The limits you are most likely to meet:
| Action | Limit |
|---|---|
| Claim a website subdomain | 3 per website per day, 10 per workspace per day |
| Create an API key | 20 per minute per workspace |
| Send a test alert | 1 per channel every 15 seconds, 20 per minute per workspace |
| Rebuild the script inventory | 1 per website every 30 seconds |
Report ingestion is governed by your monthly quota rather than a rate limit. Reaching it stops ingestion workspace-wide until the period resets. See Usage.
Outbound events
The API has no outbound webhook or event-delivery mechanism. Nothing is pushed to a URL you own.
To be notified when something happens, use alerting, which delivers to Slack, Google Chat, Teams, Telegram, email, or a signed webhook of your own. Webhook deliveries carry an HMAC-SHA256 signature so you can verify they came from us. See Channels.
To pull rather than be pushed to, poll the report endpoints on the range you need.
See also
- Get started with the API and MCP.
- The MCP server for AI clients.
- API keys in the platform docs.