mirror of
https://github.com/j3ssie/osmedeus.git
synced 2026-09-07 10:17:46 +02:00
j3ssie
f5840272c5
Major features: - Add run registry for tracking active runs with PID management - Add API-based run cancellation with process termination - Add event trigger input vars syntax for multi-variable extraction - Add filter_functions with utility function support in triggers - Add event envelope injection for full event context in workflows - Add write coordinator for batched database operations API improvements: - Add logout endpoint and diffs endpoints for assets/vulnerabilities - Add step-results listing endpoint - Update schedule model with target, workspace, params fields - Change run_id to run_uuid across API responses Performance: - Add compiled JS program caching for 60-80% faster loop conditions - Add parallel shard rendering for 20-40% faster workflow startup - Add memory-mapped I/O for large file line counting - Add efficient output buffer combining in runners - Add mtime-based cache invalidation for workflow loader Other changes: - Rename trigger field from trigger to triggers in workflow YAML - Disable pongo2 HTML autoescape for shell command templates - Update JWT expiration default to 1440 minutes (1 day) - Change CORS default to reflect-origin for credentials support - Add source_type field to events (run, eval, api) - Skip copying core Unix tools to external-binaries
Osmedeus API Documentation
Overview
The Osmedeus API provides a RESTful interface for managing security automation workflows, runs, and distributed task execution.
Base URL: http://localhost:8002
Default Port: 8002
Authentication
Most API endpoints require authentication. Two methods are supported:
-
JWT Token: Obtain a token via the login endpoint, then include it in requests using the
Authorization: Bearer <token>header. -
API Key: Use a static API key via the
x-osm-api-keyheader. Configure in~/osmedeus-base/osm-settings.yamlunderserver.auth_api_key.
See Authentication for details.
API Reference
| Category | Description |
|---|---|
| Public Endpoints | Server info, health checks, Swagger docs |
| Authentication | Login and JWT token management |
| Workflows | List, view, and refresh workflows |
| Runs | Create and manage workflow executions |
| File Uploads | Upload target files and workflows |
| Snapshots | Download workspace snapshots |
| Workspaces | List and manage workspaces |
| Assets | View discovered assets |
| Vulnerabilities | View and manage vulnerabilities |
| Event Logs | View execution event logs |
| Step Results | Query step execution results |
| Functions | Execute and list utility functions |
| System Statistics | Get aggregated system stats |
| Settings | Manage server configuration |
| Installation | Install binaries and workflows |
| Schedules | Manage scheduled workflows |
| Distributed Mode | Worker and task management |
| LLM API | Large Language Model API |
| Reference | Error codes, pagination, cron expressions, step types |
Quick Start
# Get server info (no auth required)
curl http://localhost:8002/server-info
# Login and get token
export TOKEN=$(curl -s -X POST http://localhost:8002/osm/api/login \
-H "Content-Type: application/json" \
-d '{"username": "osmedeus", "password": "admin"}' | jq -r '.token')
# List workflows
curl http://localhost:8002/osm/api/workflows \
-H "Authorization: Bearer $TOKEN"
# Start a scan
curl -X POST http://localhost:8002/osm/api/runs \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"flow": "subdomain-enum", "target": "example.com"}'