Kabeen Public API
A REST API to read and manage your workspace's IT asset inventory from your own tools and scripts
The Kabeen Public API is a REST API for integrations that need to read or manage a workspace's IT asset inventory — applications, servers, networks, routers, workstations, data objects, contracts, organization structure, people, announcements, and audit history. It is designed for external tools: CMDB syncs, custom dashboards, ITSM bridges, reporting pipelines, and internal automation scripts that need programmatic access to the same data an admin sees in the Kabeen product.
This is version 1.0.0, the first public release of the API.
Base URL and versioning
https://app.kabeen.io/public/v1Replace app.kabeen.io with your own host if you self-host Kabeen. The v1 path segment is the API version: breaking changes will ship under a new version prefix rather than mutating v1 in place.
All request and response bodies are JSON. All endpoints read and write over a single workspace — the one the API key is bound to. There is no way to address another workspace with the same key.
Authentication
Every request is authenticated with a workspace-scoped API key, sent as either Authorization: Bearer kbn_live_... or X-Api-Key: kbn_live_.... The workspace is bound to the key itself — it is never passed in the path or the request body.
Keys carry a set of permission scopes (e.g. applications:read, contracts:add), and every endpoint documents the exact scope it requires. Call GET /public/v1/me to introspect a key: it returns the workspace the key belongs to, the key's own metadata, and the scopes it grants.
See Authentication for the full guide, including how keys are issued, rotated, and revoked.
Resource areas
The API is organized into the following resource areas, across roughly 200 operations:
| Area | Description | Primary scope(s) |
|---|---|---|
| Introspection | Describe the presented API key: workspace, metadata, granted scopes. | any valid key |
| Applications | Application inventory, rich detail, and sub-resources (usage, flows, technologies, contracts, comments, owners, tags, teams, lifecycle, documents, custom fields, experience metrics, functional capacities). | applications:read / :add / :edit / :delete / :comment |
| Servers | Manual and agent-reported infrastructure servers, with owners, tags, interfaces, metrics, and linked applications. | infrastructure:read / :add / :edit / :delete |
| Networks | Networks and their connected routers. | infrastructure:read / :add / :edit / :delete |
| Routers | Network devices — router, firewall, switch, access point. | infrastructure:read / :add / :edit / :delete |
| Workstations & software | Agent-reported workstations, installed programs, software inventory, and agent deployment status. | infrastructure:read, agents:read |
| Data | Data objects (information assets) and their application links. | data:read / :add / :edit / :delete |
| Catalog | Global application catalog search and auto-discovered applications. | applications:read |
| Contracts | Application contracts, flattened across the workspace. | contracts:read / :add / :edit / :delete |
| Taxonomy | Application categories and tags. | categories:*, tags:* |
| Organization | Organization tree and teams (business units). | organisation:read / :add / :edit / :delete |
| People | Tracked end-users (with experience metrics) and workspace members. | users:read, members:read |
| Workspace | The workspace (tenant) the key is bound to. | tenant:read / :edit |
| Announcements | Workspace announcements. | announces:read / :add / :edit / :delete |
| Audit log | Workspace audit events, cursor-paginated. | audit_log:read |
| Dashboards, insights & diagrams | Aggregated dashboards (finance, usage, operations, architecture, technology, workstations), health insights, and architecture diagrams. | *_dashboard:read, *_diagram:read, applications:read |
The complete list of endpoints, with their inputs and outputs, is in the Endpoint reference.
Conventions
- JSON everywhere — every request and response body is JSON (
application/json). - UUIDs and dates as strings — resource ids are UUID strings; dates and timestamps are ISO-8601 strings.
- Offset pagination — list endpoints accept
limit(1–200, default 50) andoffset(default 0) and return an envelope of{ "data": [...], "pagination": { "limit", "offset", "total" } }. The audit log is the one exception, using cursor-based paging. See Pagination and errors. - Uniform errors — every 4xx/5xx response body has the same shape:
{ "code", "message", "status" }. - Audited — every public API call is written to the workspace audit log, with the API key as the actor.
- No webhooks — the API is polling-only in this release; there is no event/webhook mechanism. The audit log is the closest thing to a change feed — see Pagination and errors for polling guidance.
Public API or MCP server?
Both surfaces expose the workspace's map. Choose based on the consumer:
- The Public API (this section) is for deterministic, programmatic integrations — scripts, syncs, pipelines. It authenticates with an API key acting as a service identity.
- The MCP server is for AI assistants and agents. It authenticates through OAuth as a human member and inherits that member's permissions.
Next steps
- Quickstart — make your first authenticated call in five minutes.
- Authentication — API keys, scopes, and
/me. - Endpoint reference — every endpoint with its inputs and outputs.