Asset API

Asset API

Create and group inventory, read coverage, and retire unused identities.

Assets represent inventory, not automatically active protection. See resource ownership. Asset mutation requires Administrator authority for the full target scope.

Use the shared API contract for authentication, pagination, request headers, idempotency, and error responses.

List assets

GET/organizations/{organization_id}/assets
Scope
assets:read
Auth
Bearer API key

Lists inventory records with kind, name, owner, tags, criticality, and coverage summary. Standard limit and cursor apply. Unknown filters return 422.

Query parameters
kindstringoptional

Return only the selected kind.

one ofservice, device, network
group_idstringoptional

Filter by a visible asset group.

200Result

Returns a data array and pagination.next_cursor. Entries include stable IDs and the resource fields described for this collection.

Create an asset

POST/organizations/{organization_id}/assets
Scope
assets:write
Auth
Bearer API key

Creates inventory only. It does not verify ownership or enroll an executor.

Request body
namestringrequired

Display name; does not change resource identity.

rule1–120 characters
kindstringrequired

Immutable asset category.

one ofservice, device, network
locatorstringrequired

Hostname, address, or device inventory reference appropriate to the kind.

owner_idstringrequired

Existing organization member or team.

tagsstring[]optional

Unique labels; omitted means no tags.

default[]
201Created

The response is similar to the following:

JSON
{
  "data": {
    "id": "ast_web01",
    "kind": "service",
    "name": "Store",
    "coverage": {
      "edge": "not_connected"
    }
  },
  "request_id": "req_asset01"
}

Read an asset

GET/organizations/{organization_id}/assets/{asset_id}
Scope
assets:read
Auth
Bearer API key

Returns ownership, identity observations, coverage freshness, and dependent resource IDs. Unknown coverage is explicit.

200Result

Returns data and request_id.

Update asset metadata

PATCH/organizations/{organization_id}/assets/{asset_id}
Scope
assets:write
Auth
Bearer API key

Updates asset metadata. Requires If-Match; kind and ID cannot change. Omitted fields preserve their values.

Request body
namestringoptional

New display name; null and empty are invalid.

rule1–120 characters
owner_idstringoptional

Replacement organization member or team; null is invalid.

tagsstring[]optional

Replaces the entire list; an empty list removes tags. Tags do not grant access.

200Result

Returns updated data and a new ETag.

Create a group

POST/organizations/{organization_id}/asset-groups
Scope
assets:write
Auth
Bearer API key

Creates an explicit-membership selector. Group selection does not grant user authorization.

Request body
namestringrequired

Display name; does not change resource identity.

rule1–120 characters
asset_idsstring[]required

Existing assets visible to the caller; duplicates reject the request.

rule1–200 unique IDs
201Created

Returns the group ID, membership, and revision. Policy assignment requires a separate publication.

Replace group membership

PATCH/organizations/{organization_id}/asset-groups/{group_id}
Scope
assets:write
Auth
Bearer API key

Replaces group membership. Requires If-Match; the resolved target set must be within the caller's authority. Preview policy effects before submission.

Request body
asset_idsstring[]required

Existing assets visible to the caller; duplicates reject the request.

rule1–200 unique IDs
200Result

Returns the new group revision. Policy reconciliation is observed separately.

Delete an asset

DELETE/organizations/{organization_id}/assets/{asset_id}
Scope
assets:write
Auth
Bearer API key

Deletes an unused asset. Requires If-Match; active service routes, endpoint identities, access applications, or assignments return 409 dependency_exists. Historical references remain governed by retention.

204Removed

No response body.