# Integrations URL: https://www.deepinfo.com/integrations/ ## Send Findings to the Tools You Already Run. Exposure data is most useful where your team already works: in the SIEM that correlates it, the queue that assigns it and the channel that announces it. Everything the Deepinfo Platform holds is also reachable through one REST API, so a tool that isn’t listed can still get the data. [Talk to us about integrations](https://www.deepinfo.com/contact/) [API reference](https://docs.deepinfo.com/reference/) ### How Findings Leave the Platform. These are part of the platform itself and documented endpoint by endpoint. They are also how you connect a tool that isn’t on the list. - **REST API**: Public endpoints across the platform modules, notifications, reports and the Deep Search & Insights dataset, with one `apikey` header and one filter syntax. [API reference](https://docs.deepinfo.com/reference/) - **Exports**: Searches over assets, issues, vulnerabilities, technologies, leaked credentials and lookalike domains have an export twin that returns every matching record as CSV or JSON, without paging. [Issue Export](https://docs.deepinfo.com/reference/easm/issue-export/) - **Bulk actions**: Filter-driven actions, such as approve, ignore, mark resolved, accept risk and tag, applied to all the records a search matches. [Search and filters](https://docs.deepinfo.com/getting-started/search-and-filters/) - **Notification rules**: Events from new and reappeared issues to new lookalike domains, emailed to the team members you choose, instantly or hourly to monthly. [Notification rules](https://docs.deepinfo.com/reference/platform/notification-rule-create/) - **Reports**: From the executive summary to issue detail, as PDF, generated on demand or scheduled daily, weekly or monthly. [Reports](https://docs.deepinfo.com/reference/platform/report-create/) ### From SIEM and SOAR to Cloud and Identity. SIEM and SOAR to correlate and automate, ticketing and chat to assign and announce, and the vulnerability management, threat intelligence, cloud and identity platforms that act on what the Deepinfo Platform finds. Splunk · SIEM Microsoft Sentinel · SIEM IBM QRadar · SIEM Elastic Security · SIEM Sumo Logic · SIEM Cortex XSOAR · SOAR Splunk SOAR · SOAR Tines · SOAR Jira · Ticketing & ITSM ServiceNow · Ticketing & ITSM PagerDuty · Ticketing & ITSM Opsgenie · Ticketing & ITSM Slack · Communication Microsoft Teams · Communication Tenable · Vulnerability management Qualys · Vulnerability management Rapid7 InsightVM · Vulnerability management Anomali · Threat intelligence ThreatConnect · Threat intelligence MISP · Threat intelligence AWS · Cloud platforms Azure · Cloud platforms Google Cloud · Cloud platforms Okta · Identity Microsoft Entra · Identity Auth0 · Identity Confirm each connector first. *The API covers the rest.* Before you plan a workflow around one of the integrations above, tell us which tools and versions you run. We confirm how each one connects in your environment and what it carries. The API exposes the data the connectors carry, so any tool that can make an HTTP request, or read CSV or JSON, can work with Deepinfo findings. ### Connect Anything Over REST. Custom connections usually take one of these shapes: enrichment lookups from tools you already run, scheduled batch pulls into a data warehouse, or triggers in your automation. This request exports the attack surface issues that match a filter as JSON, ready for a nightly job. The filter body uses the same `must`, `should` and `must_not` syntax as the platform’s search endpoints. [Browse the APIs](https://www.deepinfo.com/data-api/apis/) · [Filter syntax](https://docs.deepinfo.com/getting-started/search-and-filters/) Request Export issues ```bash # filter.json holds the filters of an issue search curl -X POST \ "https://api.deepinfo.com/v1/easm/issues/search:export?format=json" \ -H "apikey: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d @filter.json ``` Response 200 OK · application/json ```json [ { "id": "…", "asset": { "name": "shop.acme.example", "type": "subdomain" }, "state": "newly_detected", "severity": "Medium", "type": { "name": "Potential Vulnerability Detected on PHP", "category": { "name": "Web Application" } }, "first_seen_date": "2026-09-21T00:00:00Z", "last_seen_date": "2026-09-24T00:00:00Z" }, "…" ] ``` ### Questions About Integrations **Which of these integrations can we use?** Tell us which tools you run, and we’ll confirm tool by tool how each connects in your environment before you commit. API access follows your plan, which sets the endpoints a key can call. **Our tool isn’t listed. Can we still connect it?** Yes, if it can make an HTTP request or read a file. The REST API, exports and notification rules cover the platform modules, and the [API reference](https://docs.deepinfo.com/reference/) documents each endpoint. **Can findings go to a chat channel or a ticket queue?** Notification rules deliver by email. For a chat channel or a ticket queue, pull matching records from the API or an export on a schedule and post them from your side. **Can we control what gets sent?** Yes. Notification rules take conditions such as asset, severity and tags, and exports and bulk actions apply only to the records your filter matches. **Where do we get an API key?** In the platform, under Settings, then Organization Settings, then API Keys. Which endpoints a key can call depends on your plan. See [Platform guide: API keys](https://docs.deepinfo.com/guide/settings/api-keys/). **How do we keep an API key safe?** Call the API from your own backend and keep the key in a secret store, out of client-side code and public repositories. If a key is exposed, generate a new one, switch your integration to it and delete the old key. **Are there rate limits on the API?** Yes. Your plan sets them, per API key and per endpoint, with a default of one request per second, and each response carries rate-limit headers that show where you stand. ### Tell Us Your Stack. We’ll Map the Connections. On a short call we go through the tools you run, confirm which integrations your plan covers and sketch the API work for anything else. [Map your stack with us](https://www.deepinfo.com/contact/) [Request demo](https://www.deepinfo.com/request-demo/)