​
API Overview

The Golem AI REST API gives you programmatic access to apps, audits, findings, reports, and the CVE catalog. All endpoints return JSON.

​
Base URL

​
Authentication

Every request must include a Bearer token:
Generate a key from Profile in the dashboard. Keys look like golem_sk_... and are shown only once at creation. See Profile & API Keys.

​
Response envelope

Every response follows the same shape:
On failure, success is false and error.message explains what went wrong. Typical status codes: 400 for invalid input, 401 for missing or invalid credentials, 404 for resources outside your account, 429 when rate-limited.

​
Core resources

​
Rate limits

Sensitive endpoints are rate-limited (see Limits). Back off exponentially on 429 responses.

​
Conventions

  • Lists are paginated with page and limit query parameters (default limit 20, max 100)
  • Domains are normalized automatically — https://www.acme.example.com/ becomes acme.example.com
  • Targets outside the app’s verified domain scope are rejected
  • Deleting anything is a soft delete; history is preserved