Getting started

The FortWatch API gives your own scripts and tools the same data you see in the dashboard: your assets, scans, issues, reports and audit log. It is a REST API that speaks JSON over HTTPS, at:

text

https://api.fortwatch.ai

1. Create an API key

In FortWatch, open Settings → API access → API keys (open it) and choose Create key. Only owners and admins can create keys, and only with two-factor authentication turned on: you confirm with a code from your authenticator app.

Give the key a name (the tool that will use it), the access it needs per area (no access, read, or read & write) and how long it lives (30 days, 90 days or 1 year). The key is shown once: copy it into your password manager or your CI's secret store.

2. Make a request

Send the key as a bearer token in the Authorization header:

bash

export FORTWATCH_API_KEY="fwk_…"
curl https://api.fortwatch.ai/app/assets \
  -H "Authorization: Bearer $FORTWATCH_API_KEY"

The answer is a JSON array of your assets. The response headers say how many there are (X-Total-Count) and how much of your request budget is left (RateLimit-Remaining).

3. Go further

Authentication: what a key can and cannot do, and how to rotate one.
OAuth apps: when another product connects to FortWatch, or a tool wants a client ID and secret.
Limits and paging: request budgets and how lists are paged.
Errors: the shape of an error and every code.
API reference: every endpoint, with examples in curl, Node.js, Python and Go.