Elastio API overview
The Elastio API gives you access to the Elastio platform from code. Hunt looks for ransomware, malware, and corrupted files in live, replicated, and backup data. Pursuit investigates copies of your systems for evidence of compromise. The API returns what both find, the incidents they raise, and the evidence that proves which recovery point is clean. You work with all of it over HTTPS using JSON.
Base URL
Section titled “Base URL”Every request goes to your own tenant:
https://{tenant}.app.elastio.com{tenant} is the subdomain you use to sign in to the Elastio console. If you sign in at https://acme.app.elastio.com, your base URL is https://acme.app.elastio.com. The examples on this site use acme.
Authentication
Section titled “Authentication”Send a personal access token (PAT) in the Authorization header of every request:
Authorization: Bearer <token>Tenant admins issue tokens in the Elastio console or with POST /gateway/shared-services/v1/personal-access-tokens. A token can have universal access or be limited to scope categories (inventory, security, protection, reporting, integrations, admin), each with read or write access. See Authentication for the details.
How the API is organized
Section titled “How the API is organized”The API is a REST API served by a single gateway on your tenant. Paths start with the service that handles them, followed by a version:
| Path prefix | What it serves |
|---|---|
/gateway/api/… |
Core platform: assets, search, hunts and hunt results, Hunt findings, findings, violations, incidents, jobs, data classification, Pursuit |
/gateway/shared-services/… |
Policies and schedules, deployments, hunt rules, personal access tokens, the resilience program, recovery verdicts and evidence, database monitoring, vault, licenses, tenant settings |
/gateway/integration/… |
Alerts, webhooks, Slack, Splunk, VirusTotal, Wiz |
/gateway/ingestion/… |
GuardDuty and cloud configuration checks |
/gateway/reporting/… |
Reports, report schedules, EQL |
/rbac/api/… |
Users, user groups, roles, account groups, audit logs |
A handful of operations sit outside these prefixes (for example POST /gateway/scans/v1/threat-hunt). The endpoint index lists every operation.
Requests and responses are JSON unless an operation says otherwise (a few return PDFs, and YARA ruleset uploads use multipart/form-data). See Requests and responses.
API areas
Section titled “API areas”The published API has 502 operations in 64 resources, grouped into the areas below.
| Area | Resources | Operations |
|---|---|---|
| Platform | System, Tenant Settings, Licenses, Plan, Billing, Early Access, AI Provider Credentials | 16 |
| Identity & Access | Users, User Groups, Roles, Account Groups, Personal Access Tokens, Audit Logs | 42 |
| Inventory & Deployments | Deployments, Assets, Search, Inventory, Asset Accounts, Tags, Azure Subscriptions, GCP Projects, IBM, OVA Accounts, Vault, Database Monitoring, Data | 116 |
| Backups & Recovery Points | Backup | 2 |
| Hunts & Investigations | Hunts, Hunt Results, Hunt Rules, Custom Hunts, Pursuit, Pursuit Investigations, Hunt Findings, Ransomware Summary, Data Classification | 78 |
| Findings & Response | Incidents, Findings, Violations, Issues, Cloud Configuration, Compliance, DRS | 49 |
| Policies & Jobs | Policies, Policy Schedules, Policy Membership, System Policies, System Events, Jobs | 70 |
| Recovery & Evidence | Resilience Program, Recovery Verdict, Recovery Analytics, Evidence, Security Metrics | 27 |
| Reporting | Reports, Report Schedules, EQL | 35 |
| Alerts & Integrations | Alerts, Webhooks, Slack, Splunk, VirusTotal, Wiz, GuardDuty | 67 |
The OpenAPI document
Section titled “The OpenAPI document”The whole API is described by one OpenAPI 3 document at /openapi/elastio-api.json. Use it to generate clients, import the API into Postman or Insomnia, or validate your own requests. The API reference and the endpoint index are generated from the same file.
Next steps
Section titled “Next steps”- Quickstart: make your first authenticated calls.
- Pagination and Errors: handle lists and failures correctly.
- Guides: task-focused walkthroughs, from listing assets to working incidents.