Skip to content
Aranisdevelopers
Sign in

Aranis API

Read your workspace's third-party risk, cyber risk and privacy data, and keep an external inventory in sync.

The API is part of the Enterprise plan. A valid key on another plan receives 403 plan_upgrade_required — the credential is fine, the entitlement is not.

Quickstart

Create a key in the Aranis app under Settings → Integrations. The secret is shown once, at creation.

curl
curl https://api.aranis.ai/v1/suppliers?limit=5 \
  -H "Authorization: Bearer $ARANIS_API_KEY"

Or with the TypeScript SDK:

npm
npm install @aranis/api
sync-suppliers.ts
import { AranisClient } from '@aranis/api'

const aranis = new AranisClient({ apiKey: process.env.ARANIS_API_KEY! })

// Walks every page for you — cursors are handled internally.
for await (const supplier of aranis.paginate(
  params => aranis.listSuppliers(params),
  { criticality: 'critical' }
)) {
  console.log(supplier.name, supplier.vendor_profile)
}

Five things to know before you build

It is server-to-server

No response carries a CORS header and no preflight is answered, so the API cannot be called from a browser. Your key belongs on your backend.

The workspace comes from the key

No endpoint accepts an organization id as input, and none returns one. You cannot address another workspace's data, by accident or otherwise.

Redaction is absence

Without pii:read, personal fields are missing from the payload — not null. An absent email means "this key may not see it".

Empty is not an error

An empty collection returns 200 with meta.feature_status explaining why. Never a 404, never a 500.

The fifth: every POST requires an Idempotency-Key. Replaying the same key with the same body returns the original response instead of creating a second record. See Errors & rate limits.

What this API does not expose

Aranis' control catalogue — the control library, its framework crosswalks, CVE and MITRE mappings, and the questionnaire pools — is not reachable through any endpoint, in any version.

Two endpoints name a control: /assessments/{id}/gaps and /action-plans/{id}/items. Both resolve a code and title for the one gap or item at hand. Neither can enumerate, filter or page the catalogue.

Evidence file contents never leave the platform. With evidence:read you receive metadata — file name, MIME type, SHA-256, review status, score — and nothing else.

Where to go next