Hashiro API

The baseline API serves providers and clients on the same production instance:

https://api.hashiro.ai/api/

All paths in this reference are relative to that base. For example, /users/me means https://api.hashiro.ai/api/users/me.

Authenticate

Use your user API token in the X-HASHIRO-TOKEN header:

curl --fail-with-body \
  -H "X-HASHIRO-TOKEN: $HASHIRO_TOKEN" \
  https://api.hashiro.ai/api/users/me

Set HASHIRO_TOKEN in your environment to a token generated in My Account in the console. See Authentication.

Provider and client scope

Caller	Authorized data
Provider	Own organization and explicitly linked clients, where the route allows provider access
Client	Own organization, including published results from provider-managed engagements

Role, license, project membership, and project ownership are checked independently. A linked client identifier does not grant unrestricted access. Clients cannot edit provider-owned project configuration through baseline project-write routes. Client-managed projects allow their authorized owners to manage their own assessment data.

Reference

• Projects and scope.
• Assets, URLs, and services.
• Findings and review.
• Organizations and users.

Requests and responses

Send Content-Type: application/json for JSON requests. File endpoints use their documented format, which can be multipart or JSON image data.

Response shapes vary by endpoint. A list can be a JSON array, a detail response an object, and a write response a status message or identifier. There is no universal data wrapper.

Typical errors contain error or message. Always check the HTTP status before parsing success data.

Status	Meaning
400	Invalid parameters or body
401	Authentication required or invalid
403	Insufficient permission, license, or organization access
404	Resource not found or not visible to this caller
409	Conflict, including an outdated candidate review version
429	Rate limit reached
5xx	Server or upstream failure

Pagination

Core list endpoints use page and pageSize, not limit. Pages start at 1. Defaults differ: project metrics use 10 items, while assets and findings use 100. Server limits may cap larger requests. Do not assume every list includes a total count or shared metadata shape.

curl --fail-with-body -H "X-HASHIRO-TOKEN: $HASHIRO_TOKEN" \
  'https://api.hashiro.ai/api/scans/?project=my-project&page=1&pageSize=100'

Fetch subsequent pages until the endpoint returns no more records. Project-scoped paths use the project's identifier, not its display name.

Rate limits and retries

Sign-in, OTP, password recovery, and AI-assisted actions have specific rate limits. On 429, respect a retry header when present or back off before retrying. Avoid blindly retrying writes because they can create duplicates or repeat paid AI actions.