‹ API overview

Planned API reference preview

This page previews planned endpoint shapes for the Who Sees What and Lynceon REST API. API access is in development for Enterprise and Lynceon, but it is not included in the product today because customer-facing token issuance is not available yet. See the API overview for the current availability note, planned authentication model, tiers, and error model.

The examples below use placeholder URLs and tokens to show the intended shape once the API ships.

Planned endpoints except /health require Authorization: Bearer <your-token>.

Planned Who Sees What endpoints

List templates

GET /v1/whoseeswhat/templates

When shipped, returns the audit templates available to run.

curl -s https://<your-endpoint>/v1/whoseeswhat/templates \
  -H 'authorization: Bearer <your-token>'

[
  { "templateId": "permission-audit", "name": "Permission Audit", "description": "...", "category": "access" }
]

Get a template

GET /v1/whoseeswhat/templates/:templateId

When shipped, returns one template and its parameter contract.

Run a template

POST /v1/whoseeswhat/templates/:templateId/runs

When shipped, runs an audit template against a Salesforce org. This is expected to be a metered operation.

curl -s -X POST https://<your-endpoint>/v1/whoseeswhat/templates/permission-audit/runs \
  -H 'authorization: Bearer <your-token>' -H 'content-type: application/json' \
  -d '{"orgId":"org_42"}'

{ "runId": "run_...", "templateId": "permission-audit", "orgId": "org_42", "status": "complete", "startedAt": "..." }

Get a report

GET /v1/whoseeswhat/reports/:runId

When shipped, returns the findings report for a completed run (severity counts and findings).

Export a report

GET /v1/whoseeswhat/reports/:runId/export?format=pdf|csv|json

When shipped, returns a download descriptor (content type, filename, URL). format defaults to pdf.

curl -s 'https://<your-endpoint>/v1/whoseeswhat/reports/run_7/export?format=csv' \
  -H 'authorization: Bearer <your-token>'

{ "runId": "run_7", "format": "csv", "contentType": "text/csv", "filename": "report-run_7.csv", "url": "https://..." }

Planned Lynceon endpoints

These are expected to require a Lynceon token. A Who Sees What only token is expected to get 403.

Run a code-security scan

POST /v1/lynceon/code-scans

Body: orgId (string, required), scope (apex | dependencies | all, default all). Metered.

List compliance frameworks

GET /v1/lynceon/compliance/frameworks

When shipped, returns the frameworks an evidence pack can be produced for (for example SOC 2, HIPAA, GDPR).

Export a compliance evidence pack

GET /v1/lynceon/compliance/:framework/runs/:runId/export?format=pdf|csv|json

When shipped, returns a download descriptor for the evidence pack.

Create a monitoring schedule

POST /v1/lynceon/monitors

Body: orgId (string, required), templateId (string, required), cadence (weekly | monthly, required), recipients (string array, optional). When shipped, creates a continuous-monitoring schedule.

Notes

• Who Sees What scoping is expected to be enforced by the backend, so an agent never exceeds the human caller’s own access.
• Every call is expected to be audited; every call that reaches the backend is expected to be metered.
• Reads are intended to be read-only; running a template, running a scan, and creating a monitor are expected to be writes.