REST API Reference

1 Authentication

https://app.productsecurityhub.com/api/v1

Every request is authenticated with an API key passed in the X-Api-Key header. Keys are scoped to a tenant — use the key for the tenant that owns the product you are working with.

curl -H "X-Api-Key: <YOUR_API_KEY>" \
  "https://app.productsecurityhub.com/api/v1/Products"

2 Conventions

Response envelope & pagination

List (GET) endpoints return a JSON object with a data array plus paging metadata. Use the pageSize query parameter to control page size.

curl -H "X-Api-Key: <KEY>" \
  "https://app.productsecurityhub.com/api/v1/Products/{productId}/requirements?pageSize=2000"

{
  "data": [ { /* record */ }, { /* record */ } ],
  "pageSize": 2000
  /* ...paging fields... */
}

Single-record GET endpoints (e.g. /requirements/{requirementId}) return the record directly.

Identifiers

Each object carries several identifiers. Knowing which to use for imports is essential.

3 The Import Model

How imports work

• Transport: POST as multipart/form-data with the file under the field name file. CSV (text/csv) is the standard format.
• Response: HTTP 200 immediately with an asynchronous confirmation. The background job processes the file within ~5 minutes, then stages it for review.
• Notification: You receive an in-app notification when the import is ready to review. Expect up to a few minutes from submission to notification.
• Review: Inspect every proposed change on the staging review screen. Approve to commit to production, or Abandon to discard entirely.
• Poll status (optional) with GET /Products/imports.

curl -X POST \
  -H "X-Api-Key: <KEY>" \
  -F "file=@requirements_update.csv;type=text/csv" \
  "https://app.productsecurityhub.com/api/v1/Products/{productId}/requirements/import"

Create vs. update — match keys

An import row updates an existing record when its match key matches an existing record; otherwise it creates a new one.

Common mistakes to avoid

4 Resource Reference

All paths are relative to https://app.productsecurityhub.com/api/v1.

5 Bring-Your-Own-AI Workflow

The API is the substrate for using your own AI tools. Product Security Hub does not run your model — your data and model stay in your environment. The four-step pattern:

6 Versioning & Errors

The API is versioned in the path (/api/v1). For the exact, current column layout of any import, download that resource's import template — it is the authoritative schema.

7 Quick Field Reference

Key fields returned by the most commonly used GET endpoints.