# Overview (/en/docs/api-mcp/api)



The CentralCSP REST API lets you read and manage your client-side security data from your own code, from browser reports and the script inventory to PCI DSS records and alerting, over plain HTTPS and JSON.

The full, always-current endpoint reference is generated from our [OpenAPI](https://www.openapis.org/) specification and lives under **Reference** in this section's sidebar. It covers every endpoint, request and response schema, and status code. This page is the conceptual material around it.

## Authentication [#authentication]

Send a workspace API key as a bearer token on every request:

```http
Authorization: Bearer ccsp_...
```

Requests go to the `/v1` base path:

```bash
curl -H "Authorization: Bearer ccsp_..." \
  https://api.centralcsp.com/v1/workspaces
```

Keys are prefixed `ccsp_` and are created from **Settings > API keys**, which needs the workspace **Admin** role and a plan that includes API access.

## A key acts as the person who created it [#a-key-acts-as-the-person-who-created-it]

There are no per-key scopes. A key carries its creator's current roles and reaches only the workspace it was created in.

That makes the creating account the real permission boundary. A key created by a workspace Admin can reach every website, because Admins can. Create keys from an account with the narrowest access that does the job.

Two more constraints worth designing around:

* **Expiry and allowed IPs are set at creation only.** Changing either means revoking the key and issuing a new one.
* **The secret is shown once.** There is no way to recover it.

See [API keys](/en/docs/platform/integrations/api-keys).

## Pagination [#pagination]

List endpoints use cursor pagination. Pass a `limit` for the page size; each response carries a `nextCursor` and a `hasMore` flag.

To read the next page, send the returned `nextCursor` back as the `cursor` query parameter, and keep going until `hasMore` is `false`. Endpoints that support search also accept a `q` parameter.

## Rate limits [#rate-limits]

Limits are applied **per endpoint** rather than as one global budget, and the API does not return standard rate-limit headers. A limited request answers with `429`.

The limits you are most likely to meet:

| Action                       | Limit                                                       |
| ---------------------------- | ----------------------------------------------------------- |
| Claim a website subdomain    | 3 per website per day, 10 per workspace per day             |
| Create an API key            | 20 per minute per workspace                                 |
| Send a test alert            | 1 per channel every 15 seconds, 20 per minute per workspace |
| Rebuild the script inventory | 1 per website every 30 seconds                              |

Report ingestion is governed by your monthly quota rather than a rate limit. Reaching it stops ingestion workspace-wide until the period resets. See [Usage](/en/docs/platform/billing/usage).

## Outbound events [#outbound-events]

The API has no outbound webhook or event-delivery mechanism. Nothing is pushed to a URL you own.

To be notified when something happens, use alerting, which delivers to Slack, Google Chat, Teams, Telegram, email, or a **signed webhook** of your own. Webhook deliveries carry an HMAC-SHA256 signature so you can verify they came from us. See [Channels](/en/docs/platform/features/alerting/channels).

To pull rather than be pushed to, poll the report endpoints on the range you need.

## See also [#see-also]

* [Get started](/en/docs/api-mcp/get-started) with the API and MCP.
* The [MCP server](/en/docs/api-mcp/mcp) for AI clients.
* [API keys](/en/docs/platform/integrations/api-keys) in the platform docs.