HawkEye API

Create a token in Console settings, select the narrowest scopes your automation needs, and choose an expiration. Use the secret as a bearer credential on every request.

curl --request GET \
  --url https://your-hawkeye-host/api/v1/reports/board \
  --header 'Authorization: Bearer hke_live_YOUR_TOKEN' \
  --output hawkeye-board-report.pdf

Send the token in the standard HTTP authorization header. An explicit HawkEye bearer token takes precedence over a browser session.

Authorization: Bearer hke_live_YOUR_TOKEN

A token cannot receive permissions its creator does not hold. Current API endpoints use the following scopes.

Other console permissions can be assigned for forward compatibility, but they do not currently grant additional public API endpoints.

Upsert source objects and relationships into the authenticated tenant's evidence graph. The tenant is always resolved from the credential and is never accepted from the payload.

curl --request POST \
  --url https://your-hawkeye-host/api/v1/ingest/evidence \
  --header 'Authorization: Bearer hke_live_YOUR_TOKEN' \
  --header 'Content-Type: application/json' \
  --data @evidence.json

{
  "source": {
    "provider": "internal-asm",
    "observedAt": "2026-04-15T10:30:00Z",
    "cursor": "scan-1842"
  },
  "assets": [{
    "externalId": "asset:payments-api",
    "name": "Payments API",
    "kind": "application",
    "exposure": "public",
    "criticality": 5,
    "sensitivity": "payment-data",
    "businessUnit": "Commerce",
    "owner": "platform-security",
    "isCrownJewel": true,
    "metadata": { "region": "us-east-1" }
  }],
  "identities": [],
  "findings": [],
  "controls": [],
  "relationships": []
}

Evidence objects

Response

HTTP/1.1 200 OK
{
  "status": "ingested",
  "source": "internal-asm",
  "observedAt": "2026-04-15T10:30:00Z",
  "objectsUpserted": 1,
  "relationshipsUpserted": 0
}

Request bodies are limited to 5 MB. A valid batch can contain up to 5,000 assets, identities, or controls; 10,000 findings; and 20,000 relationships.

Generate the current tenant's exposure board report as a PDF. The response is private and must not be cached.

curl --request GET \
  --url https://your-hawkeye-host/api/v1/reports/board \
  --header 'Authorization: Bearer hke_live_YOUR_TOKEN' \
  --output hawkeye-board-report.pdf