API Reference

Maintained by: Aether365 Team Audience: Developers and DevOps engineers Scope: Aether365 REST API overview, base URL, and response format

The Aether365 API allows you to programmatically access scan data, trigger scans, manage tenants, and drive AI Pilot - generating, reviewing and applying automated remediation, reading identity-risk signals, and hardening policies.

Endpoint groups

Area	What it covers
Scans	Trigger and list compliance scans
Results	Read individual scan findings
Attack Surface	Read EAS results, manage targets, verify domains
AI Pilot	Generate, review and apply automated remediation plans
Threat Alerts	Identity-risk signals and one-click user containment
Policies	Read policy posture and harden allow-listed policies
Tenants	Read and update tenant profile
Connections	Manage connected Microsoft 365 tenants
Scheduled Scans	Automate recurring scans

Base URL

https://api.aether365.io

All endpoints are relative to this base URL.

Authentication

The unified API at api.aether365.io uses API key authentication. Include your API key in the Authorization header of every request:

Authorization: Bearer ak_live_...

API keys are created in the Aether365 dashboard under Settings > API Keys and require a plan that includes API access. JWT session tokens issued for the web application are not accepted on this host. See Authentication for details.

Response Format

All API responses use a consistent JSON structure.

Success Response

{
  "success": true,
  "data": {}
}

For paginated list endpoints:

{
  "success": true,
  "data": [],
  "meta": {
    "total": 142,
    "page": 1,
    "limit": 20
  }
}

Some list endpoints - for example scan results - return the complete array in data without a meta object.

For action endpoints (trigger, delete):

{
  "success": true,
  "data": null
}

Error Response

{
  "success": false,
  "error": {
    "code": "ERROR_CODE",
    "message": "Human-readable description",
    "details": {}
  }
}

HTTP Status Codes

Code	Meaning
200	Success
201	Resource created
400	Invalid request - missing or malformed parameters
401	Authentication required or token invalid
403	Access denied - tenant isolation violation
404	Resource not found
409	Conflict - for example, a scan is already running
429	Daily or plan quota exceeded, or throttled
500	Internal server error

Error Codes

Code	Description
AUTH_MISSING_TOKEN	Authorization header not present
AUTH_INVALID_TOKEN	API key could not be verified
AUTH_INVALID_METHOD	Wrong credential type for this host
AUTH_INSUFFICIENT_SCOPE	Plan does not include API access
TENANT_NOT_FOUND	Tenant does not exist
TENANT_NOT_CONNECTED	Microsoft consent not completed
NOT_FOUND	Resource (route, connection, key, ...) does not exist
CONFLICT	Duplicate resource - e.g. inviting an existing member
SCAN_NOT_FOUND	Scan ID does not exist
SCAN_ALREADY_RUNNING	A scan is already in progress for this tenant
SCAN_PLAN_LIMIT_REACHED	Plan scan window reached (the scan window for your plan) or the plan's scheduled-scan limit hit; the response message names the specific limit
PLAN_LIMIT_REACHED	A plan quota (for example team members) is reached
VALIDATION_ERROR	Request body or query parameters are invalid
INTERNAL_ERROR	Unexpected server error

Rate Limits

Requests are throttled at the API gateway (on the order of 100 requests per second, with burst capacity of 500). Exceeding the throttle returns 429 Too Many Requests with an empty body and no Retry-After header - retry with exponential backoff. Separately, some actions are quota-limited per plan (for example the daily scan cap); those return 429 with the standard error envelope and an explanatory error code.