The Cranium Public REST API provides programmatic read access to your AI inventory. The API is designed for data engineering and security teams integrating Cranium data with data warehouses, IT service management platforms, internal reporting pipelines, and other downstream systems.
Audience
This documentation assumes familiarity with REST APIs, OAuth 2.0 authentication, and JSON. The API is intended for developers and integrators rather than business users. If you are looking to view your AI inventory directly, use the Cranium platform.
Available Endpoints
The v1 API includes four read endpoints:
- Bill of Materials: list and retrieve BOMs across your tenant
- Technology Vulnerabilities: list and retrieve technology vulnerabilities (CVEs) detected in your BOMs
- Arena Models: list models cataloged in the Arena
- Arena Model Vulnerabilities: list model vulnerabilities (attack categories) detected through Arena testing
Endpoints for AI Systems, AI Cards, and CloudSensor findings are planned for future releases.
Regional Base URLs
The Public API is available in three regions. Use the base URL that matches your tenant's region.
If you are not sure which region your tenant is in, contact your Customer Success Manager.
API Conventions
REST and JSON
All endpoints use standard HTTP methods. Request and response bodies are JSON.
Authentication
All requests require a bearer token obtained through OAuth 2.0 client credentials. See the Authentication & Generating Credentials article for details.
Pagination
All list endpoints use cursor-based pagination. See the Pagination & Incremental Sync article for the full pattern, including how to perform full and incremental syncs.
Rate Limits
Requests are subject to per-customer rate limits. See the Rate Limits & Error Handling article for limits, headers, and the 429 response format.
Sorting
Sort order is fixed per endpoint and is not configurable through query parameters.
Read-Only
The v1 API supports read operations only. Write, update, delete, and bulk export operations are not available in this release.
Licensing
The Public API is a licensed feature. To enable the API for your tenant, contact your Customer Success Manager. Once enabled, the API Management section becomes available under Settings, where authorized users can generate credentials.
Getting Started
To begin using the API:
1. Confirm your tenant has the API license enabled. If the API Management section does not appear under Settings, contact your Customer Success Manager.
2. Generate API credentials by following the steps in Authentication & Generating Credentials.
3. Request a bearer token from the token endpoint using your Client ID, Client Secret, and Scope.
4. Make authenticated requests to the endpoints relevant to your use case.