Developer Documentation

Base URL

All API endpoints are served over HTTPS. There is no versioning prefix the path prefix identifies the service.

https://lorikeetsecurity.com/ptaas/api/

All URLs are extensionless. Do not include .php in API calls. For example:

POST  https://lorikeetsecurity.com/ptaas/api/login
POST  https://lorikeetsecurity.com/ptaas/api/createproject
GET   https://lorikeetsecurity.com/ptaas/api/findinginfo?finding_id=42

Authentication

The API uses session-based authentication. You must first log in to obtain a session cookie, then include that cookie in all subsequent requests.

Step 1: Login

curl -c cookies.txt -X POST https://lorikeetsecurity.com/ptaas/api/login \
  -d "[email protected]&password=yourpassword"

On success the server sets a PHPSESSID session cookie. Pass this cookie on all authenticated requests:

curl -b cookies.txt https://lorikeetsecurity.com/ptaas/api/getUserInfo

Session Data Available After Login

{
  "email":      "[email protected]",
  "company_id": 47,
  "user_id":    112,
  "username":   "Jane Smith"
}

Rate Limiting

Rate limits are enforced per IP address. Exceeding a limit returns HTTP 429 Too Many Requests.

Error Handling

All API responses are JSON. Errors return a success: false or status: "error" field alongside a human-readable message.

// Standard error format
{
  "success": false,
  "message": "Unauthorized"
}

// Public endpoint format
{
  "status":  "error",
  "message": "Email is required"
}

Contact Form API

On success, the team is notified via Slack and you receive a confirmation email.

Newsletter Subscribe API

// Success
{ "status": "success", "message": "You're subscribed! Check your inbox for a welcome email." }

// Already subscribed
{ "status": "error", "message": "This email is already subscribed." }

Request a Quote

Projects API

All project operations are scoped to your company_id from the active session.

Assets API

Assets define the targets in scope for a pentest engagement.

Findings API

Query vulnerability findings from your pentest engagements. Sorted by severity (Critical → Info) by default.

Finding Schema

{
  "id":           42,
  "title":        "SQL Injection in /api/search",
  "severity":     "Critical",
  "status":       "Open",
  "category":     "Injection",
  "cwe_id":       "CWE-89",
  "cvss_score":   9.8,
  "description":  "The search parameter is vulnerable to blind SQL injection...",
  "remediation":  "Use parameterized queries or prepared statements...",
  "evidence":     "[request/response proof]",
  "project_id":   7,
  "project_name": "Q1 2026 Web App Assessment",
  "company_id":   47,
  "created_at":   "2026-01-15 14:23:00"
}

ASM Scan API

The Attack Surface Management module continuously monitors your external-facing assets.

Webhooks

Receive real-time HTTP POST notifications when events occur in your account.

Webhook Events

Payload Format

{
  "event":      "finding.created",
  "timestamp":  "2026-03-03T09:00:00+00:00",
  "company_id": 47,
  "data": {
    "id":         42,
    "title":      "SQL Injection in /api/search",
    "severity":   "Critical",
    "status":     "Open",
    "project_id": 7,
    "cwe_id":     "CWE-89"
  }
}

Verifying Signatures

If you set a secret_key, every payload includes an X-PTaaS-Signature header containing an HMAC-SHA256 of the raw request body.

# Python
import hmac, hashlib
def verify(secret, body, header_sig):
    expected = 'sha256=' + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header_sig)

// Node.js
const crypto = require('crypto');
function verify(secret, body, headerSig) {
  const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(body).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(headerSig));
}

Retry Policy

If your endpoint returns a non-2xx response, the webhook retries up to 3 times with exponential backoff (30s, 5m, 30m). After 3 failures the webhook is disabled and you are notified by email.

Slack Integration

Post security alerts to your Slack workspace when findings are discovered or scan jobs complete.

Setup

1. In Slack: Apps → Incoming Webhooks → Add to Slack. Choose a channel and copy the webhook URL.
2. In your portal: Settings → Integrations → Slack paste the URL.

Jira Integration

Auto-create Jira issues when Critical and High findings are reported.

Setup

1. Generate a Jira API token at id.atlassian.com → Security → API tokens.
2. In your portal: Settings → Integrations → Jira.

Microsoft Teams Integration

Send alerts to a Teams channel via an Incoming Webhook connector.

Setup

1. In Teams: channel settings → Integrations → Incoming Webhook → Configure. Copy the URL.
2. In your portal: Settings → Integrations → Microsoft Teams.

Discord Integration

Receive security alerts in a Discord channel.

Setup

1. In Discord: channel settings → Integrations → Create Webhook. Copy the URL.
2. In your portal: Settings → Integrations → Discord.

GitHub Integration

Link repositories to findings. Findings can be auto-converted to GitHub security advisories or issues.

Setup

1. Generate a GitHub PAT with repo and security_events scopes.
2. In your portal: Settings → Integrations → GitHub. Enter your username, PAT, and repo name.

Severity Levels