GraphQL API

Alkonos exposes its product API at:

https://api.alkonos.ai/graphql

Create an API key

Organization owners can open MCP & API Keys and select New key.

1. Enter a descriptive name.

2. Select the organization.

3. Choose access:

   • Read only — queries and subscriptions; mutations are rejected.

   • Admin — full read and write access inside the organization.

   • Superadmin — platform-wide access, available only to platform administrators.

4. Create and copy the key immediately.

The raw key is shown once and cannot be recovered. Revoke a key when it is no longer needed; revocation takes effect immediately.

Authenticate

Send the key as a Bearer token:

curl https://api.alkonos.ai/graphql \
  -H "Authorization: Bearer $ALKONOS_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{"query":"query { assetGroups(first: 10) { edges { node { id name status hostCount } } } }"}'

Keys start with ak_. Do not place keys in URLs, source control, logs, or client-side code.

List asset groups

query ListAssetGroups($first: Int = 20, $after: String) {
  assetGroups(first: $first, after: $after) {
    pageInfo {
      hasNextPage
      endCursor
    }
    edges {
      node {
        id
        name
        status
        hostCount
        runNightlyRecon
        vulnerabilitySeverityCounts {
          critical
          high
          medium
          low
          info
        }
      }
    }
  }
}

Connection fields use cursor pagination. Pass pageInfo.endCursor as after while hasNextPage is true.

Create an asset group

mutation CreateAssetGroup($input: CreateAssetGroupInput!) {
  createAssetGroup(input: $input) {
    id
    name
    status
  }
}

Variables:

{
  "input": {
    "name": "Production API",
    "seeds": ["api.example.com", "example.com"]
  }
}

Creating a group with seeds starts recon automatically.

Add a host to a group

mutation AddHostname($input: AddHostnameInput!) {
  addHostnameToGroup(input: $input) {
    id
    groupId
    assetId
    isSeed
  }
}

Variables:

{
  "input": {
    "groupId": "GROUP_UUID",
    "hostname": "admin.example.com",
    "isSeed": true,
    "discover": true
  }
}

Launch a DAST scan

A DAST scan requires a port asset ID. Query a host’s ports or use MCP’s get_host_ports tool first.

mutation CreateDastScan($input: CreateDastScanInput!) {
  createDastScan(input: $input) {
    id
    status
    phase
    createdAt
  }
}

At minimum, pass portId. Optional inputs include scanner selection, rate limit, timeout, credentials, context, documents, and labels; inspect the current schema before building a long-lived integration.

Handle errors

GraphQL can return HTTP 200 with an errors array. Treat a response as successful only when the expected field exists under data and errors is absent.