Integrations
Send Findings to the Tools You Already Run.
Exposure data is most useful where your team already works: in the SIEM that correlates it, the queue that assigns it and the channel that announces it. Everything the Deepinfo Platform holds is also reachable through one REST API, so a tool that isn’t listed can still get the data.
Finding
-
Remote desktop exposedvpn-legacy.acme.example Critical
Exit
-
REST APIone key, one filter syntax goes to SIEM, SOAR
-
ExportsCSV or JSON goes to Vulnerability management
-
Bulk actionsfilter-driven goes to Ticketing & ITSM
-
Notification rulesinstantly to monthly goes to Communication
-
ReportsPDF, on demand or scheduled goes to Communication
Where it lands
How Findings Leave the Platform.
These are part of the platform itself and documented endpoint by endpoint. They are also how you connect a tool that isn’t on the list.
| REST API | Public endpoints across the platform modules, notifications, reports and the Deep Search & Insights dataset, with one apikey header and one filter syntax. API reference |
|---|---|
| Exports | Searches over assets, issues, vulnerabilities, technologies, leaked credentials and lookalike domains have an export twin that returns every matching record as CSV or JSON, without paging. Issue Export |
| Bulk actions | Filter-driven actions, such as approve, ignore, mark resolved, accept risk and tag, applied to all the records a search matches. Search and filters |
| Notification rules | Events from new and reappeared issues to new lookalike domains, emailed to the team members you choose, instantly or hourly to monthly. Notification rules |
| Reports | From the executive summary to issue detail, as PDF, generated on demand or scheduled daily, weekly or monthly. Reports |
From SIEM and SOAR to Cloud and Identity.
SIEM and SOAR to correlate and automate, ticketing and chat to assign and announce, and the vulnerability management, threat intelligence, cloud and identity platforms that act on what the Deepinfo Platform finds.
Confirm each connector first. The API covers the rest.
Before you plan a workflow around one of the integrations above, tell us which tools and versions you run. We confirm how each one connects in your environment and what it carries.
The API exposes the data the connectors carry, so any tool that can make an HTTP request, or read CSV or JSON, can work with Deepinfo findings.
Connect Anything Over REST.
Custom connections usually take one of these shapes: enrichment lookups from tools you already run, scheduled batch pulls into a data warehouse, or triggers in your automation.
This request exports the attack surface issues that match a filter as JSON, ready for a nightly job. The filter body uses the same must, should and must_ syntax as the platform’s search endpoints.
Request
# filter.json holds the filters of an issue search
curl -X POST \
"https://api.deepinfo.com/v1/easm/issues/search:export?format=json" \
-H "apikey: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d @filter.jsonResponse
[
{
"id": "…",
"asset": { "name": "shop.acme.example", "type": "subdomain" },
"state": "newly_detected",
"severity": "Medium",
"type": {
"name": "Potential Vulnerability Detected on PHP",
"category": { "name": "Web Application" }
},
"first_seen_date": "2026-09-21T00:00:00Z",
"last_seen_date": "2026-09-24T00:00:00Z"
},
"…"
]Questions About Integrations
Which of these integrations can we use?
Tell us which tools you run, and we’ll confirm tool by tool how each connects in your environment before you commit. API access follows your plan, which sets the endpoints a key can call.
Our tool isn’t listed. Can we still connect it?
Yes, if it can make an HTTP request or read a file. The REST API, exports and notification rules cover the platform modules, and the API reference documents each endpoint.
Can findings go to a chat channel or a ticket queue?
Notification rules deliver by email. For a chat channel or a ticket queue, pull matching records from the API or an export on a schedule and post them from your side.
Can we control what gets sent?
Yes. Notification rules take conditions such as asset, severity and tags, and exports and bulk actions apply only to the records your filter matches.
Where do we get an API key?
In the platform, under Settings, then Organization Settings, then API Keys. Which endpoints a key can call depends on your plan. See Platform guide: API keys.
How do we keep an API key safe?
Call the API from your own backend and keep the key in a secret store, out of client-side code and public repositories. If a key is exposed, generate a new one, switch your integration to it and delete the old key.
Are there rate limits on the API?
Yes. Your plan sets them, per API key and per endpoint, with a default of one request per second, and each response carries rate-limit headers that show where you stand.
Tell Us Your Stack. We’ll Map the Connections.
On a short call we go through the tools you run, confirm which integrations your plan covers and sketch the API work for anything else.