Findings API
List confirmed findings, severity, evidence status, affected asset, remediation state, and compliance mappings.
API and workflow
Launch workflow should meet customers where they already work.
Pentoma's minimum API and webhook surface is focused on status, findings, exports, and developer handoff. The goal is workflow credibility without overbuilding a full developer platform before launch.
Minimum launch surface
The first workflow features should serve reports and remediation.
Pentoma does not need every enterprise API on day one. It does need reliable exports, clear status, webhook events, and GitHub-ready remediation context for Pentoma Code.
Report export API
Export executive, engineering, and compliance-ready reports as HTML, PDF, JSON, or CSV.
Assessment status API
Expose queued, running, validating, paused, cancelled, delivered, and retest lifecycle states.
Signed webhooks
Send HMAC-signed events for assessment.started, finding.confirmed, report.ready, assessment.paused, and assessment.cancelled.
Pentoma Code PR comments
Deliver line-level finding context into GitHub pull requests so remediation happens where engineers already work.
Webhook events
Small event set, high operational value.
Webhooks are designed to integrate with compliance automation platforms like Drata and other GRC tooling your team uses, alongside Slack, Jira, GitHub, internal dashboards, or CI release checks.
assessment.started
An authorized assessment has begun running against the agreed scope.
finding.confirmed
A finding has passed reviewer validation and is ready for customer action.
report.ready
The customer-facing report package is ready for export or secure sharing.
assessment.paused
An active assessment has been paused — by customer request, scope change, or operator stop path.
assessment.cancelled
An assessment has been cancelled before completion and will not produce a report.
API objects
Expose the objects customers need to act.
The launch API should prioritize assessment and finding records over broad configuration APIs.
Assessments: scope, status, timestamps, products, and severity counts.
Findings: title, severity, evidence, remediation, mappings, and retest state.
Reports: HTML/PDF export status and structured JSON/CSV handoff.
Assets: verified web targets, connected repositories, and registered AI targets.