What you can do with the Strike Public API

Last updated: October 19, 2026

The Public API lets your team bring Strike data into the tools it already uses: a SIEM, a ticketing system, an internal dashboard, or a compliance report. That way, your security information lives where your team works, without anyone having to open the platform to copy it.

What it gives you access to

  • Threat Emulations: status, testing configuration, assets in scope, and run history.

  • Assets: type, business relevance, environment, and the Threat Emulations each one belongs to.

  • Vulnerabilities: severity, status, evidence, suggested fix, and the full triage and retest history.

  • Projects: manual testing performed by Strikers, with its methodology, status, dates, and targets.

If you can see it in the platform, you can read it through the API.

What it does not do

  • The API is read-only: nothing can be created, modified, or deleted through it.

  • An asset's credentials are never returned. The API only indicates whether the asset has them or not.

  • Each key works for a single organization, and there is no way to access another organization's data with it.

Vulnerability visibility follows your organization's triage configuration: a finding you cannot see in the platform never appears in an API response.

Two ways to get the data

  • Query it: your systems call the API when they need it, for example with a nightly sync of open vulnerabilities to your ticketing system.

  • Receive it: you subscribe to webhooks and Strike sends an event to your systems the moment something happens. For more details, see How to receive webhook events.

Most teams use both: webhooks to react in the moment and API calls to keep a complete synced copy.

How to get started

  1. Create an API key from Settings → API Keys. For more details, see How to create and manage API keys.

  2. Give it to whoever will build the integration, through your secrets manager.

  3. Ask your CSM for the API reference, which lists all available endpoints, fields, and filters, and share it with that person.

This article explains what the API is for. The reference explains how to call it and is the technical companion for whoever writes the integration.