Account Options

API Overview

This document is for:
Invicti Enterprise On-Demand, Invicti Enterprise On-Premises

Invicti Enterprise API lets client applications view and manipulate scan tasks, view issues, create scan agents, and many more.

To understand how the APIs work, it is highly recommended that you familiarize yourself with the Invicti workflow for scanning web applications. For further information, see Web Application Security Scanning Flow.

The API documentation is built with the OpenAPI (formerly Swagger) specification. To see all endpoints and parameters, see Invicti Enterprise API Documentation.

Base URL

The base URL is

The path and query parameters depend on the endpoint of your request. For example, the scan list is reachable with the following API call


When you make any calls to the API, you need to provide your User ID and API Token. You can find your user ID and authentication token on your account page. Authentication to the API occurs via HTTP Basic Access Authentication.

The following is an example using the authentication token through cURL:


You can access your user ID and API token in your account details.

How to access Your API credentials
  1. Log in to Invicti Enterprise.
  1. Select [Your Name] (top right of the window) > API Settings.
  2. In the Current Password field, enter your current password.

Using the Single Sign-On? If so, Invicti displays the API Settings page without asking any password.

  1. Select Submit to view your User ID and Token.
How to reset the API token
  1. Log in to Invicti Enterprise.
  2. Select [Your Name] (top right of window) > API Settings.
  3. In the Current Password field, enter your password and select Submit.

Using the Single Sign-On? If so, Invicti displays the API Settings page without asking any password.

  1. Select Reset API Token.
  1. From the Reset API Token dialog, select Reset API Token to confirm.

Quick Start Guide

For this quick start guide, we make an API call to /api/1.0/account/me to get details about the user.

Before you can start using the API, you need the following:

  • An Invicti account
  • Your User ID and Token
  • Make sure you have curl installed on your machine.

How to get your information via an API call

Build your API call

Your API call must have the following components:

  • The base URL:
  • An Authentication: User ID and Token.
  • A request.

Make the API call

curl -u "User ID:Token"
  1. Copy the curl example.
  2. Open your favorite text editor.
  3. Paste the curl example into the text editor.
  4. Get your User ID and Token. For further information, see Authentication
  5. In the curl example, replace the User ID and Token with your credentials. 
  6. Copy the API call that has your authentication information.
  7. Open a command prompt window.
  8. Into the command prompt, paste the API call.
  9. Press Enter.


Invicti supports the following methods in API calls:

GET This method is for retrieving information.

POST This method is for creating new resources, updating the status, or deleting.

Rate Limits

There is a throttling limit for API endpoints. All endpoints share the same rate limit, except for the allissues endpoint.

The following table shows the rate limits:

Throttle Limits Minute Limit Hourly Limit Daily Limit
All endpoints 200 7000 18000
allissues 10 600 14400

Tips and Troubleshooting

Invicti does not support the partial API calls. To update any object, for example, a scan profile object, do the following:

  1. Make a GET request for the scan profile you want to update.
  2. Update parameters.
  3. Make a POST request to update the scan profile with new parameters.

Status Codes and Errors

Code Description Explanation
200 OK Success.
201 Created The request succeeded, and a new resource was created.
400 BadRequest The server could not understand the request because of the invalid syntax.
401 Unauthorized The access is denied.
403 Forbidden The client does not have access rights to the content; that is, it is unauthorized.
404 NotFound The server cannot find the requested resource.
429 Too Many Requests The user has sent too many requests in a given amount of time (“rate limiting“).
500 Internal Server Error The server has encountered a situation it does not know how to handle.

Invicti Help Center

Our Support team is ready to provide you with technical help.

Go to Help Center This will redirect you to the ticketing system.