Stepsecurity API

The StepSecurity API page is an interactive reference for the StepSecurity API endpoints that serve Azure DevOps. Use it to explore available endpoints, read request and response schemas, and try calls against your own organization.

To reach this page: open the sidebar and go to Settings > StepSecurity API.

Authenticate with your organization API keys. For how to create and rotate those keys, see StepSecurity API (Org Access). For keys that apply across every organization in your tenant, see StepSecurity API (Tenant Access).

The API reference

The reference is rendered from the API's OpenAPI 3.0 specification and shows the current specification version at the top of the page.

Element	What it does
Download OpenAPI Spec	Downloads the specification, for generating clients or importing into an API tool
Servers	Selects the server calls are issued against. The production server is https://agent.api.stepsecurity.io/v1
Authorize	Supplies your API key to the reference, so you can issue authenticated test calls from the page

Endpoints are grouped by function. Select any endpoint to expand it and see its parameters, request body, response schemas, and example values.

Making an authenticated call

1. Select the server you want to call under Servers.
2. Select Authorize and supply your organization API key.
3. Expand the endpoint you want to call.
4. Fill in the path and query parameters. Endpoints scoped to a tenant take a {customer} path parameter.
5. Issue the call and review the response.

Calls issued from this page run against the selected server, so a call to the production server acts on real data. Take particular care with POST, PUT, PATCH, and DELETE endpoints.

Endpoint groups

Group	Covers
Authentication & Access	Discovering which Azure DevOps organizations your credentials can reach
Organization Management	Listing and creating Azure DevOps organizations for a tenant, and listing the resources under them
Project Management	Azure DevOps project operations

The page is generated from the live specification, so the groups and endpoints it shows are always current. Treat the page itself as the source of truth for the exact endpoint list, and download the specification when you need a fixed version to build against.