Documentation
API
Trigger missions, retrieve validated findings and wire Revelion into your own systems.
Resources
What the API exposes
| Resource | Purpose |
|---|---|
| Estates | Create and manage the environments under test, including scope and exclusions. |
| Authorisations | Record and retrieve the authorisation covering an estate. |
| Missions | Trigger an engagement, check its phase, and stop it. |
| Findings | Retrieve validated findings with evidence, severity and remediation. |
| Retests | Re-run a finding after remediation and record the outcome. |
01
Access
Authentication and conventions
- Bearer tokens
- Issued per organisation and scoped to the estates that token may act on.
- JSON throughout
- Requests and responses are JSON. Errors carry a machine-readable code alongside a human message.
- Rate limited
- Limits are returned in response headers so a client can back off before it is throttled.
- Idempotent triggers
- Mission creation accepts an idempotency key, so a retried request does not start a second engagement.
MCP
Agent-to-agent access
Revelion publishes a Model Context Protocol server, so an assistant or agent can query mission state and validated findings directly rather than through a human relaying the answer.
The server card is published at /.well-known/mcp/server-card.json, alongside an API catalogue and an agent skills index, so a capable client can discover the surface without being configured for it in advance.
Build against it.
Request an API key