New Year, New API: A New Onapsis API for Custom Workflows & Integrations
While the Onapsis product team has been hard at work modernizing the front-end of The Onapsis Platform, we have also had feedback from our customers that an API experience is just as important. Building on that, Onapsis is pleased to introduce a newly-developed GraphQL-based public API. This new interface paves the way for new and improved third-party integrations, more powerful reporting and custom workflows. With its initial release, support is available for the Assess product. Looking ahead, we’ll be extending the API to have full support across all products within The Onapsis Platform.
A Bit About the API
As mentioned above, the new API is based on GraphQL, a query language for APIs that enables the retrieval of multiple resources within a single request. Additionally, modifying what resources you’re looking to retrieve doesn’t require a complete rewrite of the query, you can edit the parameters as needed to get updated results. Once you’ve created an API Key through the UI, it can be used to retrieve an access token which allows you to query all the information you need.
Initial and Planned Support
The Public API has support for the features within Assess and preliminary support for Comply. Data presented within the New UI of the Assess dashboard are also available through the new Public API. We are continuing the active development of the API to extend its functionality fully across Assess, Control, Comply and Defend capabilities within the Onapsis Platform.
Report Customization
Many customers run Assess scans about once a month. Ideally, the frequency of this should be increased, even as often as once per day. A monthly scan might confirm that changes were pushed out to patch for a vulnerability, but would not catch if that change were reverted prior to the subsequent scan, rolling back a security patch in the process. Running scans daily would capture this in a report, however, it requires someone to review the daily reports which can be time-consuming to pick out what, if anything, has changed from one day to the next.
Leveraging the new API, we can create custom filtered queries that will look at the daily Assess scan results, and report back if changes have been made to specific fields since the last report. For example, you may opt to report back on critical issues only. This removes a daily manual review process and presents relevant data in a digestible format, enabling the adoption of a more secure process.
Workflows
Once fully developed, the Public API offers more than flexible reports. Organizations can leverage the API to build custom workflows, integrating them with in-house applications to create custom, unified views. For example, an MSSP could develop a view that displays the patching status of each of their customers for an efficient multi-tenant view, saving time over individually checking each system for the status of a security patch or other information of interest.
Integrations
The new GraphQL-based Public API is much more robust than our previous API. It allows the retrieval of more data points, greater flexibility, and an easier path to more third-party integrations. We won’t go into full detail here, but be on the lookout for upcoming announcements and additional blog posts on both new and improved integrations into ticketing systems, SIEM tools and more! Additionally, system integrators and MSSPs can leverage the API to integrate The Onapsis Platform into their custom service offerings supporting vulnerability management, security operations centers and others.
