Everything the console does, the API does too

Getting started

A tenant is created with a region, a name and one administrator. Everything after that is optional until you connect a source: without at least one cloud account, DNS zone or identity provider, discovery has nothing to look at.

• Create the tenant and choose a region. Region cannot be changed later.
• Connect one cloud account with the read-only role template we publish.
• Connect DNS so certificate transparency and passive discovery can be reconciled.
• Connect your identity provider to populate the entitlement graph.
• Label crown-jewel assets. Everything downstream scores against them.

Connecting sources

Each connector category answers a different part of the model. You do not need all of them on day one — cloud, DNS and identity are enough to produce a useful first sweep.

• Cloud & infrastructure. Read-only discovery across accounts, projects and subscriptions.
• SIEM & data pipeline. Stream findings, path changes and asset events where you already look.
• Ticketing & ITSM. Create owned, time-boxed work in the tracker teams already use.
• DevOps & source. Catch exposure before it ships, and attribute it to the change that caused it.
• Identity. Entitlement graphs, federation topology and joiner-mover-leaver signal.
• Alerting & comms. Route the handful of events that need a human, and nothing else.

Every connector is read-only unless you explicitly enable a write scope, and write scopes are granted per action rather than per connector.

Data model

Five object types carry the whole model. Each has a stable identifier that never changes, even if the underlying resource is renamed.

{
  "id": "AST-4118",
  "name": "nfg-invoice-archive",
  "kind": "cloud",
  "stratum": "core",
  "crown_jewel": true,
  "owner": { "team": "Finance Systems", "confirmed": true },
  "first_seen": "2023-02-19"
}

REST API

Cursor pagination on every collection, If-None-Match support on every resource, and filters that mirror the console exactly. If you can express it as a console filter, you can express it as a query parameter.

curl -s https://api.lodemark.com/v1/findings \
  -H "Authorization: Bearer $TOKEN" \
  -G --data-urlencode "severity=critical" \
     --data-urlencode "on_path=true" \
     --data-urlencode "limit=50"

Webhooks

Signed with an HMAC over the raw body and a timestamp. Reject anything older than five minutes, and compare signatures in constant time.

• path.reached_core — a live path now terminates at a crown-jewel asset.
• path.contained — a choke point was applied and the path broke.
• finding.sla_breached — a finding passed its remediation window.
• asset.discovered — a new asset appeared on the surface.
• asset.owner_lost — the confirmed owner left or the team was dissolved.

Rate limits

600 requests per minute per token on read endpoints and 60 on write endpoints. Limits are returned on every response in X-RateLimit-Remaining, and a 429 always includes Retry-After. Bulk export is not rate limited; it is queued.

Export & retention

Every object type exports as newline-delimited JSON or CSV. Exports are generated in your region, expire after 24 hours and are recorded in the audit log. There is no export fee and no proprietary format.

Retention defaults to 36 months for findings and 12 for evidence, configurable downward. On contract end everything is deleted within 30 days of written confirmation.

Cannot find what you need? Ask the team