API Reference# API reference RiskPilot exposes a Symfony REST API under `/api`. The React SPA uses this same API. The examples below describe the route families actually present; see the controller code for the complete contract for your version. ## Authentication | Method | Road | Usage | | --- | --- | --- | | POST | `/api/auth/login` | login, MFA if required | | POST | `/api/auth/refresh` | rotation of the refresh token | | POST | `/api/auth/logout` | revocation of session | | POST | `/api/auth/forgot-password` | recovery request | | POST | `/api/auth/reset-password` | new password | | GET/PUT | `/api/me` | read or edit profile | | GET/DELETE | `/api/me/sessions` | consult or revoke | Private routes use `Authorization: Bearer <JWT>`. The refresh token remains in an HttpOnly cookie and should not be copied to JavaScript storage. ## Inventory and risks - `/api/scopes` - `/api/assets` -`/api/threats` -`/api/vulnerabilities` -`/api/security-controls` - `/api/risks` - `/api/risk-matrix` - `/api/
RiskPilot
Website
FR
GitHub