Fetch Data

API
Description

POST /api/fetchSlackWebhooks

Fetch the configured Slack webhooks that can be used for sending notifications.

POST /api/fetchAuthMechanismData

Retrieve authentication mechanism details (e.g., headers, tokens) configured for testing APIs.

POST /api/fetchTestingRunResults

Fetch the results of executed test runs, including issues found and their severity.

POST /api/fetchActiveTestRunsStatus

Retrieve the current status of active or in-progress test runs.

POST /api/fetchTestRoles

Fetch test roles and their associated permissions or configurations for API testing.

POST /api/fetchMiniTestingServiceNames

Get the names of mini-testing services available for distributed/parallel test execution.

POST /api/retrieveAllCollectionTests

Retrieve all available tests mapped to each API collection.

POST /api/convertSamleDataToBurpRequest

Convert an Akto HTTP sample message to a raw Burp Suite-compatible HTTP request string.

POST /api/downloadBurpPluginJar

Record a Burp plugin JAR download event and update the last downloaded timestamp for the user.

POST /api/fetchBurpPluginDownloadLink

Return the static download URL for the latest Akto Burp extension JAR.

POST /api/fetchBurpCredentials

Find or create a Burp-type API token for the current account for use with the Burp extension.

POST /api/fetchBurpPluginInfo

Return the last boot-up timestamp and version of the Akto Burp extension.

POST /api/fetchRecordedFlowOutput

Poll for the result of a recorded login flow execution and retrieve the extracted auth token when complete.

POST /api/fetchRecordedLoginScreenshots

Retrieve base64-encoded PNG screenshots captured during the last login flow execution for a test role.

/api/fetchSlackWebhooks

post
Header parameters
x-api-keystringRequired

You can get this from Settings > Integrations > Akto APls > Generate token

Example: API_KEY
Body
objectOptional
Responses
chevron-right
200

description

application/json
post
/api/fetchSlackWebhooks
200

description

/api/fetchAuthMechanismData

post
Header parameters
x-api-keystringRequired

You can get this from Settings > Integrations > Akto APls > Generate token

Example: API_KEY
Body
objectOptional
Responses
chevron-right
200

description

application/json
post
/api/fetchAuthMechanismData
200

description

/api/fetchTestingRunResults

post
Header parameters
x-api-keystringRequired

You can get this from Settings > Integrations > Akto APls > Generate token

Example: API_KEY
Body
queryModestringRequiredExample: VULNERABLE
sortKeystringRequiredExample: severity
sortOrderinteger · int32RequiredExample: -1
limitinteger · int32RequiredExample: 150
testingRunResultSummaryHexIdstringRequiredExample: 68b841d282b95e966633967e
skipinteger · int32RequiredExample: 0
queryValuestringRequired
Responses
chevron-right
200

description

application/json
post
/api/fetchTestingRunResults
200

description

/api/fetchActiveTestRunsStatus

post
Header parameters
x-api-keystringRequired

You can get this from Settings > Integrations > Akto APls > Generate token

Example: API_KEY
Body
objectOptional
Responses
chevron-right
200

description

application/json
post
/api/fetchActiveTestRunsStatus
200

description

/api/fetchTestRoles

post
Header parameters
x-api-keystringRequired

You can get this from Settings > Integrations > Akto APls > Generate token

Example: API_KEY
Body
objectOptional
Responses
chevron-right
200

description

application/json
Responseobject

AKTO_ERROR while building schema

post
/api/fetchTestRoles
200

description

/api/fetchMiniTestingServiceNames

post
Header parameters
x-api-keystringRequired

You can get this from Settings > Integrations > Akto APls > Generate token

Example: API_KEY
Body
objectOptional
Responses
chevron-right
200

description

application/json
post
/api/fetchMiniTestingServiceNames
200

description

/api/retrieveAllCollectionTests

post
Header parameters
x-api-keystringRequired

You can get this from Settings > Integrations > Akto APls > Generate token

Example: API_KEY
Body
searchStringstringRequired
sortKeystringRequiredExample: scheduleTimestamp
sortOrderinteger · int32RequiredExample: -1
limitinteger · int32RequiredExample: 50
skipinteger · int32RequiredExample: 0
endTimestampinteger · int32RequiredExample: 1788528065
testingRunTypestringRequiredExample: ONE_TIME
startTimestampinteger · int32RequiredExample: 0
Responses
chevron-right
200

description

application/json
post
/api/retrieveAllCollectionTests
200

description

Convert sample data to a Burp Suite request

post

Converts a single Akto HTTP sample message (a JSON string encoding the full request + response) into a raw HTTP request string compatible with Burp Suite. The returned string uses the URL path (not the full absolute URL) and omits the Content-Length header.

Note: the endpoint name contains a typo (Samle) which is preserved for backwards compatibility.

Source: ExportSampleDataAction.generateBurpRequest()

Body
sampleDatastringRequired

Akto HTTP sample message JSON string encoding both the request and response.

Example: {"method":"GET","path":"/api/users","requestHeaders":{"Host":"api.example.com","Authorization":"Bearer [REDACTED_JWT]"},"responseCode":200,"responseBody":"{\"users\":[]}"}
Responses
chevron-right
200

Burp Suite request string returned.

application/json
burpRequeststringOptional

Raw HTTP request in Burp Suite format using the URL path.

Example: GET /api/users HTTP/1.1 Host: api.example.com Authorization: Bearer [REDACTED_JWT]
actionErrorsstring[]Optional
post
/api/convertSamleDataToBurpRequest

Record a Burp plugin JAR download

post

Updates the lastDownloadedAt timestamp for the current user and returns success. Call this endpoint when the user downloads the Akto Burp extension JAR to track adoption metrics. Returns no body fields beyond success.

Source: BurpJarAction.execute()

Body
objectOptional
Responses
chevron-right
200

Download recorded successfully.

No content

post
/api/downloadBurpPluginJar
200

Download recorded successfully.

No content

Get the Burp plugin JAR download URL

post

Returns the static GitHub raw URL for the latest Akto Burp extension JAR (akto-burp-extension repository, master branch).

Source: BurpJarAction.fetchBurpPluginDownloadLink()

Body
objectOptional
Responses
chevron-right
200

Download link returned.

application/json
burpGithubLinkstringOptional

GitHub raw URL for the Akto Burp extension JAR.

Example: https://raw.githubusercontent.com/akto-api-security/akto-burp-extension/master/Akto.jar
actionErrorsstring[]Optional
post
/api/fetchBurpPluginDownloadLink
200

Download link returned.

Fetch or create Burp Suite credentials

post

Finds or creates a BURP-type utility API token for the current account. The host in the response is derived from the HTTP Origin request header sent by the Burp plugin.

Source: BurpJarAction.fetchBurpCredentials()

Body
objectOptional
Responses
chevron-right
200

Burp credentials returned.

application/json
apiTokenstringOptional

BURP-type utility API token for the account.

Example: [REDACTED_API_TOKEN]
hoststringOptional

Host extracted from the Origin HTTP header of the request (used by the Burp plugin to identify the Akto server).

Example: app.example.com
actionErrorsstring[]Optional
post
/api/fetchBurpCredentials
200

Burp credentials returned.

Fetch Burp plugin runtime info

post

Returns the last boot-up timestamp and version string of the Akto Burp extension as recorded by the plugin during its last startup.

Source: BurpJarAction.fetchBurpPluginInfo()

Body
objectOptional
Responses
chevron-right
200

Plugin info returned.

application/json
actionErrorsstring[]Optional
post
/api/fetchBurpPluginInfo
200

Plugin info returned.

Poll for recorded login flow output

post

Polls for the result of a recorded login flow execution. In hybrid mode, pass the testingRunPlaygroundId returned by uploadRecordedFlow. When the flow completes, token contains the extracted auth token JSON (with an all_cookies array). While still running, tokenFetchInProgress is true and token is null.

Source: LoginRecorderAction.fetchRecordedFlowOutput()

Body
testingRunPlaygroundIdstringOptional

ObjectId hex for hybrid mode polling. Omit for standard (non-hybrid) mode.

Example: 60a7b2c3d4e5f6a7b8c9d0e1
Responses
chevron-right
200

Flow output or in-progress indicator.

application/json
tokenstringOptional

Extracted auth token JSON string (contains all_cookies array). null while the flow is still executing.

Example: {"all_cookies":[{"name":"session","value":"[REDACTED_SESSION_TOKEN]"}]}
tokenFetchInProgressbooleanOptional

true while the flow is still executing; false when complete.

Example: false
actionErrorsstring[]Optional
post
/api/fetchRecordedFlowOutput
200

Flow output or in-progress indicator.

Fetch login flow screenshots

post

Returns base64-encoded PNG screenshots captured during the last login flow execution for the given test role.

Source: LoginRecorderAction.fetchRecordedLoginScreenshots()

Body
roleNamestringRequired

Name of the test role whose login screenshots to fetch.

Example: admin
Responses
chevron-right
200

Screenshots returned.

application/json
screenshotsBase64string[]Optional

List of base64-encoded PNG screenshots from the login flow.

Example: ["iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAC0lEQVQI12NgAAIABQ=="]
screenshotsUpdatedAtintegerOptional

Unix epoch when the screenshots were last updated.

Example: 1745280000
actionErrorsstring[]Optional
post
/api/fetchRecordedLoginScreenshots
200

Screenshots returned.

Last updated