API reference #

RiskPilot exposes a Symfony REST API under /api. The React SPA uses this same API. The examples below describe the route families actually present; see the controller code for the complete contract for your version.

Authentication #

Method	Road	Usage
POST	`/api/auth/login`	login, MFA if required
POST	`/api/auth/refresh`	rotation of the refresh token
POST	`/api/auth/logout`	revocation of session
POST	`/api/auth/forgot-password`	recovery request
POST	`/api/auth/reset-password`	new password
GET/PUT	`/api/me`	read or edit profile
GET/DELETE	`/api/me/sessions`	consult or revoke

Private routes use Authorization: Bearer <JWT>. The refresh token remains in an HttpOnly cookie and should not be copied to JavaScript storage.

Inventory and risks #

/api/scopes
/api/assets

-/api/threats -/api/vulnerabilities -/api/security-controls

/api/risks
/api/risk-matrix
/api/risk-governance/policies
/api/risk-governance/{acceptances,campaigns,recommendations,portfolio}

Inventory/risk creations and changes typically require ROLE_RISK_MANAGER. Each linked identifier is searched in the tenant.

Actions and notifications #

/api/actions manages the list and the lifecycle. /api/actions/{id}/comments handles comments. /api/notifications and /api/notifications/{id}/read expose notifications. The private calendar uses /api/me/calendar and /api/calendar/{token}.ics.

Compliance and assurance #

/api/frameworks and requirements;
/api/compliance-assessments and results;
/api/statements-of-applicability ;
/api/control-tests ;
/api/requirement-mappings ;
/api/audit-management.

An approved SoA cannot be modified; The review endpoint creates a new version.

Other registers #

/api/third-parties, /api/resilience, /api/regulatory-records, /api/executive-governance and /api/isms-documents cover third parties, incidents/continuity, regulations, management and documents respectively.

The public supplier and document portals use dedicated opaque tokens; they do not provide access to the tenant's private APIs.

Exports and health #

/api/exports/risks.csv, /api/exports/actions.csv, and /api/exports/compliance/{id}.csv produce tenant-scoped CSVs. /api/health is used for availability checks. /api/metrics is a technical route to be protected according to the exposure architecture.

Versioned integrations #

/api/v1/integrations manages configurations, keys and webhooks. /api/v1/service/status checks a service key and returns only its organization and scopes.

Errors and security #

400: invalid entry or business rule;
401: authentication missing or expired;
403: insufficient role;
404: resource absent or hidden because it is off-tenant;
409: State conflict when workflow requires it.

Do not conclude that an identifier exists in another tenant from a 404. Clients should handle JWT expiration, rotation, and revocation without blindly replaying a mutation.

Versioned indicators #

GET|POST /api/v1/indicators: list and create KPI/KRI definitions;
GET /api/v1/indicators/{id}/values?limit=100: read reverse-chronological history;
POST /api/v1/indicators/{id}/values: record a measurement and idempotency key;
POST /api/v1/indicators/{id}/values/batch: import up to 1,000 measurements with row-level errors;
GET /api/v1/indicators/{id}/values/export: export the series as chronological CSV.

Endpoints enforce the signed-in user’s organization. Never reuse an idempotency key for another measurement of the same indicator.

Governed workspaces, reports and AI #

New API families are detailed in Operations, Decision, Experiments, Analyses, Annual reports and AI copilot. All use the current JWT, resolve the organization server-side and ignore attempts to choose another tenant in a payload.

Errors use {"code":"STABLE_CODE","message":"Explanation"} when the controller supplies a message. Important codes include VALIDATION_ERROR (422), NOT_FOUND (404), INVALID_TRANSITION or INVALID_APPROVAL (422), IMMUTABLE_RECORD (409), UNSUPPORTED_FORMAT (400), IMPORT_CONFLICT (409) and AI_CONNECTION_FAILED (502).

EBIOS RM and RBAC matrix #

See EBIOS RM workshops for /api/v1/ebios routes and Roles and permissions for /api/settings/rbac. EBIOS controllers evaluate fine-grained ebios.read, ebios.update and ebios.validate permissions, then verify method, tenant, order and author-validator separation. The RBAC API requires admin.roles, returns the effective catalogue and replaces the complete organization matrix.

Governed AI conversations #

The AI copilot guide details /api/copilot and /api/compliance-results/{id}/copilot. These authenticated routes require consent, limit questions and history, share a 20-call-per-user-per-hour quota and perform no automatic write. Always preview compliance context before transmission.