Using the Openlane API

The GraphQL API is the primary programmatic interface to Openlane: every object you work with in the console (controls, risks, campaigns, vendors, evidence) is available through a single endpoint with a strongly typed schema. A smaller REST API covers authentication flows, account operations, and System for Cross-domain Identity Management (SCIM) provisioning.

Endpoint and Authentication

All GraphQL operations are HTTP POST requests to:

https://api.theopenlane.io/query

Authenticate with a bearer token in the Authorization header. Two token types exist: organization-scoped API tokens for integrations and automation, and user-scoped personal access tokens for personal tooling; Programmatic Access covers creating each and when to use which.

info

Creating tokens requires your organization to have a payment method on file.

curl -H "Authorization: Bearer $OPENLANE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "query { organizations { edges { node { id displayName } } } }"}' \
  https://api.theopenlane.io/query

Exploring the Schema

The schema is large (every object, filter, and mutation in the platform), so the right way to browse it is interactively rather than through static pages. The GraphQL Explorer gives you the full, always-current schema with search, documentation for every field, and a query builder you can run authenticated requests from: set your Authorization header in the Headers tab and everything you compose runs against your real organization.

For the recurring patterns that apply across the whole schema (pagination, filtering, ordering, mutations, and bulk operations), see Schema Conventions; one read covers the machinery every query shares.

Worked Examples

Per-domain examples with complete queries and mutations live in the developer docs:

• Organizations, Groups, and Permissions
• Controls, Evidence, and Programs
• Risks and Tasks

The object pages throughout the platform docs also carry Examples sections with CSV, GraphQL, Go client, and CLI variants for their object.

Clients

The Go client is generated from this schema and is what the CLI is built on. For other languages, any standard GraphQL client works against the endpoint; introspection is enabled, so codegen tooling can generate types directly from the API.