Secureframe Public API

REST API providing programmatic access to Secureframe controls, frameworks, framework requirements, tests, evidence, policies, tasks, risks, personnel, devices, cloud resources, repositories, third-party risk vendors, knowledge base answers, trust center requests, and the SSP and POA&M records used in CMMC and FedRAMP assessments. 76 paths, 112 operations, 41 resource tags. Resource-oriented and JSON:API-shaped, with Lucene-syntax search, page/per_page pagination and include/relationships compound documents. Authenticated with an API key and secret sent as a single space-separated Authorization header; permissions are inherited from the RBAC role of the user the key belongs to.

Documentation Provider Profile APIs.io OpenAPI GitHub

Secureframe Public API is one of 2 APIs that Secureframe publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include GRC, Compliance, REST, CMMC, and Audit. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, an API reference, authentication docs, and rate-limit docs.

This API exposes 112 operations across 76 paths, organized into 41 resource areas, and defines 40 schemas. It is described by OpenAPI 3.0.0, at version 2023-10-18.

Requests are made against 2 base URLs: https://api.secureframe.com, https://api-uk.secureframe.com.

112 operations 76 paths 40 schemas 8 DELETE63 GET20 POST21 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification

OpenAPI 3.0.0

API Version

2023-10-18

Base URL

https://api.secureframe.com

Authentication

API Key

Resource Areas

Authentication & Security 1

Secureframe Public API declares 1 security scheme for authenticating requests. An API key is passed in the header as Authorization (header_authorization).

Paths & Operations 112

Across 76 paths, the API surfaces 112 operations — 8 DELETE, 63 GET, 20 POST, 21 PUT. They span 41 resource areas, including Cloud Resource Framework Asset Scope, Cloud Resource, Comment, Control, Framework Requirement, Framework, Risk, SSP Duty Role, and 33 more. Each is listed below with its method, path, parameters, and response codes.

Cloud Resource Framework Asset Scope 2

This document describes the API for reading and creating Framework Asset Scopes. A Framework Asset Scope defines the scope of an asset (e.g., a Cloud Resource) within a Framework.…

GET

/cloud_resources/{cloud_resource_id}/framework_asset_scopes

List Framework Asset Scopes

cloudResourcesCompanyFrameworkAssetScopesIndex 5 params → default403401400

POST

/cloud_resources/{cloud_resource_id}/framework_asset_scopes

Create Framework Asset Scope

cloudResourcesCompanyFrameworkAssetScopesCreate 4 params → default404403401400

Cloud Resource 3

This document describes the API for reading and updating Cloud Resources.

GET

/cloud_resources

List Cloud Resources

cloudResourcesIndex 6 params → default403401400

GET

/cloud_resources/{id}

Get a Cloud Resource

cloudResourcesShow 3 params → default404403401400

PUT

/cloud_resources/{id}

Update a Cloud Resource

cloudResourcesUpdate 4 params → default404403401400

Comment 5

This document describes the API for reading, creating, updating, and deleting Comments.

GET

/comments

List Comments

commentsIndex 6 params → default403401400

POST

/comments

Create a Comment

commentsCreate 4 params → default403401400

GET

/comments/{id}

Get a Comment

commentsShow 3 params → default404403401400

PUT

/comments/{id}

Update a Comment

commentsUpdate 2 params → default404403401400

DELETE

/comments/{id}

Delete a Comment

commentsDestroy 1 param → default404403401400

Control 2

This document describes the API for reading Controls.

GET

/controls

List Controls

companyControlV2sIndex 6 params → default403401400

GET

/controls/{id}

Get a Control

companyControlV2sShow 3 params → default404403401400

Framework Requirement 2

This document describes the API for reading Framework Requirements.

GET

/framework_requirements

List Framework Requirements

companyFrameworkRequirementsIndex 6 params → default403401400

GET

/framework_requirements/{id}

Get a Framework Requirement

companyFrameworkRequirementsShow 3 params → default404403401400

Framework 2

This document describes the API for reading Frameworks.

GET

/frameworks

List Frameworks

companyFrameworksIndex 4 params → default403401400

GET

/frameworks/{id}

Get a Framework

companyFrameworksShow 1 param → default404403401400

Risk 2

This document describes the API for reading Risks.

GET

/risks

List Risks

companyRisksIndex 6 params → default403401400

GET

/risks/{id}

Get a Risk

companyRisksShow 3 params → default404403401400

SSP Duty Role 4

This document describes the API for reading, creating, and deleting SSP Duty Roles.

GET

/ssp_duty_roles

List SSP Duty Roles

companySspDutyAssignmentMatrixAssignmentsIndex 4 params → default403401400

POST

/ssp_duty_roles

Create an SSP Duty Role

companySspDutyAssignmentMatrixAssignmentsCreate 3 params → default403401400

GET

/ssp_duty_roles/{id}

Get an SSP Duty Role

companySspDutyAssignmentMatrixAssignmentsShow 1 param → default404403401400

DELETE

/ssp_duty_roles/{id}

Delete an SSP Duty Role

companySspDutyAssignmentMatrixAssignmentsDestroy 1 param → 200404403401400

SSP Duty 5

This document describes the API for reading, creating, updating, and deleting SSP Duties.

GET

/ssp_duties

List SSP Duties

companySspDutyAssignmentMatrixDutiesIndex 4 params → default403401400

POST

/ssp_duties

Create an SSP Duty

companySspDutyAssignmentMatrixDutiesCreate 3 params → default403401400

GET

/ssp_duties/{id}

Get an SSP Duty

companySspDutyAssignmentMatrixDutiesShow 1 param → default404403401400

PUT

/ssp_duties/{id}

Update an SSP Duty

companySspDutyAssignmentMatrixDutiesUpdate 3 params → default404403401400

DELETE

/ssp_duties/{id}

Delete an SSP Duty

companySspDutyAssignmentMatrixDutiesDestroy 1 param → 200404403401400

SSP Role 5

This document describes the API for reading, creating, updating, and deleting SSP Roles.

GET

/ssp_roles

List SSP Roles

companySspDutyAssignmentMatrixRolesIndex 4 params → default403401400

POST

/ssp_roles

Create a SSP Role

companySspDutyAssignmentMatrixRolesCreate 3 params → default403401400

GET

/ssp_roles/{id}

Get a SSP Role

companySspDutyAssignmentMatrixRolesShow 1 param → default404403401400

PUT

/ssp_roles/{id}

Update a SSP Role

companySspDutyAssignmentMatrixRolesUpdate 3 params → default404403401400

DELETE

/ssp_roles/{id}

Delete a SSP Role

companySspDutyAssignmentMatrixRolesDestroy 1 param → 200404403401400

SSP Policy 5

This document describes the API for reading, creating, updating, and deleting SSP Policies.

GET

/ssp_policies

List SSP Policies

companySspPoliciesIndex 4 params → default403401400

POST

/ssp_policies

Create an SSP Policy

companySspPoliciesCreate 5 params → default403401400

GET

/ssp_policies/{id}

Get an SSP Policy

companySspPoliciesShow 1 param → default404403401400

PUT

/ssp_policies/{id}

Update an SSP Policy

companySspPoliciesUpdate 5 params → default404403401400

DELETE

/ssp_policies/{id}

Delete an SSP Policy

companySspPoliciesDestroy 1 param → default404403401400

SSP Report Assessment Objective 3

This document describes the API for reading and updating SSP Report Assessment Objectives.

GET

/ssp_report_assessment_objectives

List SSP Report Assessment Objectives

companySspReportAssessmentObjectivesIndex 4 params → default403401400

GET

/ssp_report_assessment_objectives/{id}

Get an SSP Report Assessment Objective

companySspReportAssessmentObjectivesShow 1 param → default404403401400

PUT

/ssp_report_assessment_objectives/{id}

Update an SSP Report Assessment Objective

companySspReportAssessmentObjectivesUpdate 3 params → default404403401400

SSP Report Section Block 3

This document describes the API for reading and updating SSP Report Section Blocks.

GET

/ssp_report_section_blocks

List SSP Report Section Blocks

companySspReportSectionBlocksIndex 4 params → default403401400

GET

/ssp_report_section_blocks/{id}

Get an SSP Report Section Block

companySspReportSectionBlocksShow 1 param → default404403401400

PUT

/ssp_report_section_blocks/{id}

Update an SSP Report Section Block

companySspReportSectionBlocksUpdate 2 params → default404403401400

SSP Report Section 3

This document describes the API for reading and updating SSP Report Sections.

GET

/ssp_report_sections

List SSP Report Sections

companySspReportSectionsIndex 4 params → default403401400

GET

/ssp_report_sections/{id}

Get an SSP Report Section

companySspReportSectionsShow 1 param → default404403401400

PUT

/ssp_report_sections/{id}

Update an SSP Report Section

companySspReportSectionsUpdate 3 params → default404403401400

SSP Report 3

This document describes the API for reading and creating SSP Reports.

GET

/ssp_reports

List SSP Reports

companySspReportsIndex 6 params → default403401400

POST

/ssp_reports

Create an SSP Report

companySspReportsCreate 2 params → default403401400

GET

/ssp_reports/{id}

Get an SSP Report

companySspReportsShow 3 params → default404403401400

SSP Vendor 5

This document describes the API for reading, creating, updating, and deleting SSP Vendors.

GET

/ssp_vendors

List SSP Vendors

companySspVendorsIndex 4 params → default403401400

POST

/ssp_vendors

Create an SSP Vendor

companySspVendorsCreate 6 params → default403401400

GET

/ssp_vendors/{id}

Get an SSP Vendor

companySspVendorsShow 1 param → default404403401400

PUT

/ssp_vendors/{id}

Update an SSP Vendor

companySspVendorsUpdate 6 params → default404403401400

DELETE

/ssp_vendors/{id}

Delete an SSP Vendor

companySspVendorsDestroy 1 param → 200404403401400

Test Evidence 1

This document describes the API for creating Evidence for a Test.

POST

/tests/{test_id}/evidences

Create Test Evidence

companyTestsEvidencesCreate 3 params body → default404403401400

Test Export 1

This document describes the API for creating a Test Export for a Test.

POST

/tests/{test_id}/exports

Create a Test Export

companyTestsTestExportsCreate 3 params → default404403401400

Test 4

This document describes the API for reading, creating, and updating Tests.

GET

/tests

List Tests

companyTestsIndex 6 params → default403401400

POST

/tests

Create a Test

companyTestsCreate 9 params → default404403401400

GET

/tests/{id}

Get a Test

companyTestsShow 3 params → default404403401400

PUT

/tests/{id}

Update a Test

companyTestsUpdate 9 params → default404403401400

User Account 3

This document describes the API for reading and linking User Accounts.

GET

/user_accounts

List User Accounts

companyUserVendorsIndex 6 params → default403401400

GET

/user_accounts/{id}

Get a User Account

companyUserVendorsShow 3 params → default404403401400

PUT

/user_accounts/{id}/link

Link a User Account

companyUserVendorsLink 2 params → default404403401400

User Evidence 1

This document describes the API for creating Evidence for a User.

POST

/users/{user_id}/evidences

Create User Evidence

companyUsersEvidencesCreate 4 params body → default404403401400

User 3

This document describes the API for reading and updating Users.

GET

/users

List Users

companyUsersIndex 6 params → default403401400

GET

/users/{id}

Get a User

companyUsersShow 3 params → default404403401400

PUT

/users/{id}

Update a User

companyUsersUpdate 6 params → default404403401400

Integration Connection 3

This document describes the API for reading and archiving Integration Connections.

GET

/integration_connections

List Integration Connections

companyVendorConnectionsIndex 6 params → default403401400

GET

/integration_connections/{id}

Get an Integration Connection

companyVendorConnectionsShow 3 params → default404403401400

PUT

/integration_connections/{id}/archive

Archive an Integration Connection

companyVendorConnectionsArchive 1 param → default404403401400

Vendor 3

This document describes the API for reading and archiving Vendors.

GET

/vendors

List Vendors

companyVendorsIndex 4 params → default403401400

GET

/vendors/{id}

Get a Vendor

companyVendorsShow 1 param → default404403401400

PUT

/vendors/{id}/archive

Archive a Vendor

companyVendorsArchive 2 params → default404403401400

Custom Integration 1

This document describes the API for publishing data to a custom integration.

POST

/custom_connections/{id}/data

Publish data

customConnectionsResourceDataCreate 1 param body → 202400401403404

Device Framework Asset Scope 2

This document describes the API for reading and creating Framework Asset Scopes. A Framework Asset Scope defines the scope of an asset (e.g., a Device) within a Framework. Framewo…

GET

/devices/{device_id}/framework_asset_scopes

List Framework Asset Scopes

devicesCompanyFrameworkAssetScopesIndex 5 params → default403401400

POST

/devices/{device_id}/framework_asset_scopes

Create Framework Asset Scope

devicesCompanyFrameworkAssetScopesCreate 4 params → default404403401400

Device 2

This document describes the API for reading Devices.

GET

/devices

List Devices

devicesIndex 6 params → default403401400

GET

/devices/{id}

Get a Device

devicesShow 3 params → default404403401400

Evidence 2

This document describes the API for reading Evidence.

GET

/evidences

List Evidence

evidencesIndex 4 params → default403401400

GET

/evidences/{id}

Get an Evidence

evidencesShow 1 param → default404403401400

File Upload 1

This document describes the API for staging a direct-to-storage file upload.

POST

/file_uploads

Stage a direct-to-storage File Upload and get an id for attaching the file

fileUploadsCreate 4 params → default403401400

Knowledge Base Answer 4

This document describes the API for reading, creating, updating, and deleting Knowledge Base Answers.

GET

/knowledge_base_answers/{id}

Get a Knowledge Base Answer

knowledgeBaseAnswersShow 1 param → default404403401400

PUT

/knowledge_base_answers/{id}

Update a Knowledge Base Answer

knowledgeBaseAnswersUpdate 4 params → default403401400

DELETE

/knowledge_base_answers/{id}

Delete a Knowledge Base Answer

knowledgeBaseAnswersDestroy 1 param → 200404403401400

POST

/knowledge_base_answers

Create a Knowledge Base Answer

knowledgeBaseAnswersCreate 4 params → default403401400

Knowledge Base Question 4

This document describes the API for reading, creating, updating, and deleting Knowledge Base Questions.

GET

/knowledge_base_questions/{id}

Get a Knowledge Base Question

knowledgeBaseQuestionsShow 3 params → default404403401400

PUT

/knowledge_base_questions/{id}

Update a Knowledge Base Question

knowledgeBaseQuestionsUpdate 5 params → default403401400

DELETE

/knowledge_base_questions/{id}

Delete a Knowledge Base Question

knowledgeBaseQuestionsDestroy 1 param → 200404403401400

POST

/knowledge_base_questions

Create a Knowledge Base Question

knowledgeBaseQuestionsCreate 3 params → default403401400

POA&M Item 5

This document describes the API for reading, creating, updating, and discarding POA&M (Plan of Action & Milestones) items.

GET

/poam_items

List POA&M items

poamItemsIndex 4 params → default403401400

POST

/poam_items

Create a POA&M item

poamItemsCreate 8 params → default403401400

GET

/poam_items/{id}

Get a POA&M item

poamItemsShow 1 param → default404403401400

PUT

/poam_items/{id}

Update a POA&M item

poamItemsUpdate 9 params → default404403401400

PUT

/poam_items/{id}/discard

Discard a POA&M item

poamItemsDiscard 1 param → default404403401400

Policy 2

This document describes the API for reading Policies. Policies are returned in every status, including drafts and archived ones. Filter with ?q=status:published to narrow. Note th…

GET

/policies

List Policies

policiesIndex 6 params → default403401400

GET

/policies/{id}

Get a Policy

policiesShow 3 params → default404403401400

Repository Framework Asset Scope 2

This document describes the API for reading Framework Asset Scopes. A Framework Asset Scope defines the scope of an asset (e.g., a Repository) within a Framework. Framework Asset…

GET

/repositories/{id}/framework_asset_scopes

List Framework Asset Scopes

repositoriesCompanyFrameworkAssetScopesIndex 5 params → default403401400

POST

/repositories/{id}/framework_asset_scopes

Create Framework Asset Scope

repositoriesCompanyFrameworkAssetScopesCreate 4 params → default404403401400

Repository 3

This document describes the API for reading and updating Repositories.

GET

/repositories

List Repositories

repositoriesIndex 6 params → default403401400

GET

/repositories/{id}

Get a Repository

repositoriesShow 3 params → default404403401400

PUT

/repositories/{id}

Update a Repository

repositoriesUpdate 4 params → default404403401400

Security Questionnaire 1

This document describes the API for creating Security Questionnaires.

POST

/security_questionnaires

Create a Security Questionnaire

securityQuestionnairesCreate 4 params body → default404403401400

Task 2

This document describes the API for reading Tasks.

GET

/tasks

List Tasks

tasksIndex 6 params → default403401400

GET

/tasks/{id}

Get a Task

tasksShow 3 params → default404403401400

Test Export Reading 1

This document describes the API for reading a Test Export.

GET

/test_exports/{id}

Get a Test Export

testExportsShow 1 param → default404403401400

Third Party Risk Management Vendor 3

This document describes the API for reading and archiving Vendors for companies using the Third Party Risk Management.

GET

/tprm/vendors

List Third Party Risk Management Vendors

tprmVendorRiskDetailsIndex 6 params → default403401400

GET

/tprm/vendors/{id}

Get a Third Party Risk Management Vendor.

tprmVendorRiskDetailsShow 3 params → default404403401400

PUT

/tprm/vendors/{id}/archive

Archive a Third Party Risk Management Vendor.

tprmVendorRiskDetailsArchive 1 param → default404403401400

Trust Center Request 3

This document describes the API for reading and updating Trust Center Requests.\ Note: In order to access this API, you need to have paid features enabled for Trust.

GET

/trust_center_requests

List Trust Center Requests

trustCenterRequestsIndex 6 params → default403401400

GET

/trust_center_requests/{id}

Get a Trust Center Request

trustCenterRequestsShow 3 params → default404403401400

PUT

/trust_center_requests/{id}

Update a Trust Center Request

trustCenterRequestsUpdate 9 params body → default404403401400

User Security Settings 1

This document describes the API for retrieving user security settings for the provided API key's company.

GET

/user_security_settings

Get user security settings

userSecuritySettingsIndex → default403401400

Schemas 40

The contract defines 40 schemas that model the data the API accepts and returns. The most detailed are Test (37 properties), CompanyRisk (27 properties), User (26 properties), Control (23 properties). Each schema is shown below with its type and property counts.

Models_CustomConnections_CreateResourceDataRequest

object

4 properties 3 required

CloudResource

object

10 properties

Comment

object

6 properties

Control

object

23 properties

FrameworkAssetScope

object

10 properties

FrameworkRequirement

object

9 properties

Framework

object

13 properties

CompanyRisk

object

27 properties

SspDutyRole

object

6 properties

SspDuty

object

6 properties

SspRole

object

6 properties

SspPolicy

object

8 properties

SspReportAssessmentObjective

object

8 properties

SspReportSectionBlock

object

8 properties

SspReportSection

object

9 properties

SspReport

object

7 properties

SspVendor

object

10 properties

Test

object

37 properties

User

object

26 properties

UserAccount

object

11 properties

IntegrationConnection

object

5 properties

Vendor

object

22 properties

Device

object

20 properties

Evidence

object

10 properties

FileUpload

object

A File Upload is write-only and single-use: it is returned once, redeemed once, and there is no endpoint to fetch one back.

7 properties

KnowledgeBaseAnswer

object

6 properties

KnowledgeBaseQuestion

object

7 properties

PoamItem

object

12 properties

PolicyDetail

Policy

object

18 properties

Repository

object

9 properties

SecurityQuestionnaire

object

11 properties

Task

object

18 properties

TestExport

object

5 properties

TrustCenterRequest

object

12 properties

TrustCenterResourceRequest

object

3 properties

TrustCenterResource

object

5 properties

UserSecuritySetting

object

6 properties

VendorRiskDetail

object

20 properties

VendorRiskSubassessmentResponse

object

5 properties

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

Other APIs Secureframe publishes across the network.

Secureframe MCP Server

AE Profile APIs.io

#GRC#Compliance#REST#CMMC#Audit

← Back to S APIs

Call it yourself

curl for this page

Search the network for this

curl "https://api.apievangelist.com/v1/search?q=public-api&limit=10"

Everything under a tag

curl "https://api.apievangelist.com/v1/tags/public-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Where this information came from

This is an independent, third-party profile of Secureframe Public API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.

Discovery

Learnings

Guidance

Toolbox

Alignment

API Evangelist LLC

Secureframe Public API

Metadata

Authentication & Security 1

Paths & Operations 112

Schemas 40

Specification

Source

API Details

Provider

Explore more

Work with this as data

MCP tools for apis

Call it yourself

Get an API key

Discovery

Learnings

Guidance

Toolbox

Alignment

API Evangelist LLC

Secureframe Public API

Metadata

Authentication & Security 1

Paths & Operations 112

Schemas 40

Specification

Source

More from Secureframe 1

API Details

Provider

Explore more

Work with this as data

MCP tools for apis

Call it yourself

Get an API key