API and webhooks for custom integrations

When to use the API

The 29 native integrations cover the most common enterprise security and productivity tools. For anything else, the Radius360 API is the path forward. Good fits for custom integrations:

• Internal tools your team built that produce security-relevant data
• Specialized vendors not yet in our native catalog
• Data lakes or warehouses where your consolidated security signals already live
• Custom GRC workflows that push evidence on a cadence your team controls

If a commonly-requested source is not natively supported, email support@radius360.co first. Native integration builds are prioritized by customer demand.

Authentication

The API uses API keys scoped to a specific tenant. Generate keys from Settings, API Keys.

• Keys are shown once at creation time. If you lose a key, rotate rather than retrieve.
• Keys have configurable scopes (read-only, read-write, write-only) and can be limited to specific resource types (risks, evidence, policies, etc.).
• Keys can be revoked instantly. Revocation takes effect within 60 seconds globally.
• Send the key as Authorization: Bearer $API_KEY on every request.

Core resources

The API exposes the same first-class objects you work with in the UI. Resources you can read, create, update, or delete depending on your key's scope:

• Risks: query the register, create new risks, update scoring or status
• Policies: list, fetch, and create policies; promote drafts to active
• Evidence: query the Evidence Vault, push external artifacts with control tags
• Frameworks and controls: read the activated framework set and control satisfaction status
• Incidents: query, open, and update incident records
• Tenant metadata: read posture score and basic tenant state
• Webhook subscriptions: manage outbound webhook endpoints

The current OpenAPI spec with exact endpoint paths, request shapes, and response payloads is the source of truth. Email support@radius360.co for the latest spec; a public API portal is planned.

Pushing evidence via API

The most common custom-integration pattern: push an evidence artifact.

1. 1
   Build the artifact in your code. At minimum: a title, a source reference, the content (usually a file or structured JSON), and one or more control tags identifying which framework controls the evidence satisfies.
2. 2
   POST to /evidence with the artifact in the request body. The response includes the new artifact ID and confirms the control tags were applied.
3. 3
   The artifact appears in the Evidence Vault immediately, tagged with source "Custom API" and the name you provided.
4. 4
   Every framework assessment that includes one of the tagged controls updates its completion percentage automatically.

Webhooks out of Radius360

Subscribe to events so your systems can react in real time. Events cover the lifecycles of the major resources: risks (created, updated, mitigated), policies (published, archived), incidents (opened, contained, resolved), integrations (sync failures), framework completion milestones, and report exports.

Configure subscriptions from Settings, Webhooks in the app, or via the API. Radius360 signs every webhook payload (HMAC) so your receiver can verify authenticity using a shared secret.

Webhooks into Radius360

For sources that support outbound webhooks (your CI/CD pipeline, a ticketing system, a custom monitor), you can deliver events into Radius360 rather than polling us.

Create an inbound webhook endpoint from Settings, Inbound Webhooks. Radius360 gives you a unique URL that accepts POSTs with a specific shape; we parse the payload and route it to the right downstream action (creating a risk, adding evidence, opening an incident, etc.). Inbound webhooks are available on Business and Enterprise.

Rate limits

The API enforces per-key rate limits. Business plans get a sensible default; Enterprise contracts can negotiate higher quotas. Exceeding the limit returns a 429 response with a Retry-After header that your client should respect.

Outbound webhooks do not count against your inbound API rate limit. Inbound webhooks (events you push into Radius360) have a separate quota that scales with your plan.

For exact current limits, see Settings, API Keys in-app, which shows your remaining quota and reset window in real time.

Related reading: Sync cadence and rate limits (native integrations), Billing and plan features.