Skip to main content
The Metlo API provides programmatic access to your API security platform, allowing you to manage endpoints, alerts, data classes, and testing configurations.

​
Base URL

All API endpoints are served from your Metlo instance: 
https://<your-metlo-instance>/api/v1

​
Authentication

All API requests must be authenticated using an API key. See the Authentication page for details on how to obtain and use API keys.

​
Response Format

​
Success Response

Successful requests return HTTP status 200 with the response payload: 
{
  // Response data
}

​
Error Response

Failed requests return appropriate HTTP status codes with error messages: 
"Error message describing what went wrong"

​
HTTP Status Codes

The Metlo API uses standard HTTP status codes:
Status CodeDescription
200Success
400Bad Request - Invalid parameters or validation error
401Unauthorized - Missing or invalid API key
404Not Found - Resource does not exist
409Conflict - Resource already exists
422Unprocessable Entity - Request cannot be processed
500Internal Server Error - Something went wrong on the server

​
Validation Errors

When request parameters fail validation, you’ll receive a 400 status with details: 
{
  "type": "ZOD",
  "message": "field.name: Invalid value",
  "err": {
    // Detailed validation error information
  }
}

​
Pagination

Many list endpoints support pagination using offset and limit parameters:
​
offset
number
default:"0"
Number of items to skip
​
limit
number
default:"10"
Maximum number of items to return

​
Filtering

Most list endpoints support filtering by various criteria. Common filters include:
  • Risk Scores: Filter by security risk level (HIGH, MEDIUM, LOW, NONE)
  • Hosts: Filter by hostname
  • Status: Filter by status (RESOLVED, IGNORED, etc.)
  • Search Query: Text search across relevant fields

​
API Sections

The Metlo API is organized into the following sections:

Endpoints API

Manage and query your API endpoints

Alerts API

View and manage security alerts

Data Classes API

Access data classification information

Testing API

Generate and manage API tests

​
Rate Limiting

Currently, there are no enforced rate limits on the Metlo API. However, we recommend implementing client-side rate limiting to avoid overloading your instance.

​
Need Help?

If you encounter issues or have questions about the API:
  • Check the specific endpoint documentation
  • Review error messages for validation details
  • Contact support with your request details

Build docs developers (and LLMs) love

Get started for freeTalk to us