IE to Platform API upgrade reference

This document explains what each Invicti Enterprise object is called in Invicti Platform, and which Invicti Platform API endpoints replace the Invicti Enterprise ones. Use it to update your existing integrations, syncs, and scripts so they run against Invicti Platform without guessing which object or call replaced which.

For a high-level overview of the API change and the steps to create an API key, refer to the API upgrade guide.

Why this matters

The Invicti Platform API isn't backward-compatible with the Invicti Enterprise API. Endpoints, request bodies, response fields, filters, and authentication all changed, and some Invicti Enterprise objects no longer exist as separate objects. Knowing what replaced each object lets you plan the changes to your integrations before you upgrade, and avoids calls that succeed but return something different from what your code expects.

Source of this mapping

This mapping compares the Invicti Enterprise API definition with the Invicti Platform API definitions published in Swagger. The Invicti Platform Swagger is the source of truth for request and response details. Refer to the API upgrade guide for the Swagger address of your region.

Terminology: what each Invicti Enterprise object is in Invicti Platform

Invicti Enterprise	Invicti Platform	Notes
Website	Target	A webapp target or an API target. The Inventory API calls it an asset of type target, and the DAST API calls it a target. They're the same object
Website group	Collection	Refer to Collection definition. Invicti Platform also has applications, which group targets differently. Refer to Applications overview
Scan profile	No separate object	The settings live in the target configuration. The upgrade creates one target for each scan profile. Refer to the IE to IP upgrade reference. Don't confuse it with the Invicti Platform scan profile, which is a list of security checks
Scan policy	Target configuration	The upgrade carries the user agent, proxy, scan speed, and CSS selector exclusions to the target configuration. The selected checks aren't listed as carried over. If you need them, create a custom scan profile
Authentication profile	Authentication in the target configuration, with credentials stored as secrets	Credentials are stored once as a secret and reused across targets. The authentication method and login details (form fields, login sequence, OAuth 2.0 settings) are configured on each target. There is no reusable authentication preset
Global client certificate	Client certificate on a target	Certificates are per target only
Issue	Vulnerability
Report policy	No equivalent object	Only the severity override part has a counterpart. Refer to Severity overrides
Scan	Scan	A scan references a target and a scan profile instead of carrying its own copy of the settings
Member	User
Team	Team
Role	Role	Permissions are granular scopes in the form resource and action
Notification	Automation	Automations are available in the user interface only. Refer to the IE notifications upgrade guide
Agent and agent group	Agent	Assigned to each target. There are no agent groups
Technologies	Technologies	Detection data isn't carried over and fills in again as you scan

Scan profile means different things

In Invicti Enterprise, a scan profile is a saved set of scan settings, and the upgrade turns each one into a target. In Invicti Platform, a scan profile is a list of security checks that you choose when you scan a target.

Scan policy checks aren't listed as carried over to Invicti Platform. After the upgrade, if you need the checks of an old scan policy, create a custom scan profile in Scans > Scan profiles and choose it when you scan the target.

How the model differs

These differences affect how you structure API calls, not only what they're named.

Settings belong to the target

In Invicti Enterprise, each scan carries its own settings: scope, authentication, URL rewrite rules, imported links, time window, and more. In Invicti Platform, those settings live in the target configuration, and a scan only references the target and a scan profile. To change how a target is scanned, update the target configuration, not the scan.

Update a target's configuration with PATCH /api/v1/targets/{target_id}/configuration. Related calls manage the login sequence, client certificate, imported files, and exclusions for the target.

One target, two views

Invicti Platform has two APIs that return targets. Use the Inventory API (/api/inventory/v1/assets) to create, list, and update targets, together with their tags, collections, and applications. Use the DAST API (/api/v1/targets) for scan configuration and scan operations on a target. The Inventory API targets endpoints are deprecated. Use assets with assetType=target instead.

Several APIs instead of one

Invicti Enterprise has one API. Invicti Platform splits the same functions across several APIs, each with its own base address:

API	Base path	Covers
Inventory API	/api/inventory/v1	Targets (assets), collections, applications, vulnerabilities, technologies
DAST API	/api/v1	Scans, scan results, scan profiles, reports, target configuration, agents
DAST API v2	/api/dast/v2	Scan schedules and group schedules
Identity Management API	/api/identity/v1	Users, teams, roles, audit log, license

The base address depends on your region: https://platform.invicti.com, https://platform-eu.invicti.com, or https://platform-ca.invicti.com.

Common API changes

Area	Invicti Enterprise	Invicti Platform
Authentication	Basic authentication with your user ID and API token	X-Auth header with your API key, or a bearer token. Refer to Authenticate
Identifiers	UUIDs	UUIDs
Paging	page and pageSize (up to 200)	Inventory API: pageNumber and pageSize. DAST API: cursor and limit. Identity Management API: check each endpoint in Swagger
Filtering	Separate query parameters, for example severity and websiteGroupName	Inventory API: separate query parameters. DAST API: one q parameter, for example ?q=status:completed;target_id:{uuid}
Rate limits	Check your Invicti Enterprise API usage	Invicti Platform enforces rate limits. Refer to Handle responses

Both products use UUIDs, but the upgrade doesn't keep the Invicti Enterprise identifiers. Upgraded targets, scans, and users get new identifiers in Invicti Platform. If an integration or script stores Invicti Enterprise identifiers, look the objects up in Invicti Platform by name or URL after the upgrade and replace the stored values.

Endpoint mapping

The tables list the Invicti Enterprise call, the Invicti Platform call that replaces it, and what to know before you switch. Invicti Enterprise paths start with /api/1.0.

Targets

Invicti Enterprise	Invicti Platform	Notes
GET /websites/list	GET /api/inventory/v1/assets?assetType=target
GET /websites/get/{id}	GET /api/inventory/v1/assets/{assetId}
POST /websites/new	POST /api/inventory/v1/assets	Set assetType and assetDetail.assetType to target, and set assetDetail.url and assetDetail.targetType (web or api)
PUT /websites/{id}	PATCH /api/inventory/v1/assets/{assetId}
DELETE /websites/{id}	DELETE /api/inventory/v1/assets/{assetId}
/scanprofiles/*	GET and PATCH /api/v1/targets/{target_id}/configuration	IE scan profiles don't exist as objects. The Platform scan profile is a different object, a list of checks (/api/v1/scanning_profiles). Refer to Settings belong to the target

Invicti Platform has no calls to verify website ownership. Instead, each scan request confirms authorization with "user_authorized_to_scan": "yes". GET /api/inventory/v1/fqdn-registrations is read only and lists the FQDNs registered for your license. It doesn't verify ownership.

Collections

Invicti Enterprise	Invicti Platform	Notes
GET /websitegroups/list	GET /api/inventory/v1/collections
POST /websitegroups/new	POST /api/inventory/v1/collections
PUT /websitegroups/{id}	PATCH /api/inventory/v1/collections/{collectionId}
DELETE /websitegroups/{id}	DELETE /api/inventory/v1/collections/{collectionId}
Add or remove websites in a group	POST, PATCH, or DELETE /api/inventory/v1/collections/{collectionId}/assets	A target lists its collections in collectionIds

Scans

Invicti Enterprise	Invicti Platform	Notes
GET /scans/list, /scans/listbywebsite, /scans/listbystate	GET /api/v1/scans	Filter with q, for example ?q=target_id:{uuid} or ?q=status:processing,completed
GET /scans/detail/{id}	GET /api/v1/scans/{scan_id}
POST /scans/new, /scans/newwithprofile	POST /api/v1/scans, then POST /api/v1/scans/{scan_id}/trigger	Create the scan with target_id and profile_id, then start it
POST /scans/incremental	POST /api/v1/scans with incremental set to true, then trigger
POST /scans/cancel	POST /api/v1/scans/{scan_id}/abort
DELETE /scans/{id}	DELETE /api/v1/scans/{scan_id}
POST /scans/schedule, /scans/schedulewithprofile	POST /api/v1/scans with a schedule object	The schedule has start_date and recurrence
POST /scans/schedule-incremental	POST /api/v1/scans with incremental set to true and a schedule object
GET /scans/list-scheduled	GET /api/dast/v2/scans/schedules	Lists recurring and one-time scheduled scans
POST /scans/update-scheduled, /scans/update-scheduled-incremental	PATCH /api/v1/scans/{scan_id}	Send the changed schedule object
POST /scans/unschedule	POST /api/v1/scans/{scan_id}/unschedule
POST /scans/retest	POST /api/inventory/v1/retest	Retests vulnerabilities

Scan statuses are scheduled, queued, starting, processing, completed, aborting, aborted, failed, paused, pausing, and resuming.

To schedule a recurring scan for every target in a collection or an application, use POST /api/dast/v2/group-schedules. Manage these schedules with the other /api/dast/v2/group-schedules calls.

Vulnerabilities

Invicti Enterprise	Invicti Platform	Notes
GET /issues/allissues, /issues/todo, /issues/addressedissues, /issues/waitingforretest	GET /api/inventory/v1/vulnerabilities	Filter by status instead of using a separate call for each state
GET /issues/get/{id}	GET /api/inventory/v1/vulnerabilities/{vulnerabilityId}
Issues of one scan	GET /api/inventory/v1/scans/{scanId}/vulnerabilities
POST /issues/update, PUT /issues/{id}	PATCH /api/inventory/v1/vulnerabilities	Updates the status only. The body has ids and newStatus

The Inventory API filters vulnerabilities by asset, first seen and last seen dates, status, severity, source, type, and tags. It doesn't filter by asset name or collection, so look up the target first and filter by assetId.

Vulnerability statuses are open, fixed, ignored, reDiscovered, falsePositive, fixedUnconfirmed, notChecked, and notFound. Severities are info, low, medium, high, and critical. The Invicti Enterprise severity BestPractice has no Invicti Platform value.

The following table maps the Invicti Enterprise issue states to Invicti Platform vulnerability statuses.

Invicti Enterprise state	Invicti Platform status
Present	open
FixedConfirmed	fixed
FixedUnconfirmed	fixedUnconfirmed
Revived	reDiscovered
Ignored	ignored
FalsePositive	falsePositive

The Invicti Enterprise states AcceptedRisk, FixedCantRetest, and Scanning have no Invicti Platform status of the same name. notChecked and notFound are Invicti Platform statuses with no Invicti Enterprise state.

Reports

In Invicti Enterprise, GET /scans/report and GET /issues/report return the report in one call. In Invicti Platform, report generation is asynchronous, so a single call becomes three steps:

1. Send POST /api/v1/reports with a template_id and a source. The source has a list_type (for example scans) and an id_list. The response contains a report_id.
2. Poll GET /api/v1/reports/{report_id} until status is completed. The statuses are queued, processing, completed, and failed.
3. Download the report from the links in the download field of the completed report.

List the available templates with GET /api/v1/report_templates.

List the available templates with GET /api/v1/report_templates. The following table maps the Invicti Enterprise report types to the closest Invicti Platform template, using the template names that call returns. Refer to Types of reports.

Invicti Enterprise report type	Invicti Platform report
ExecutiveSummary	Executive Summary
ScanDetail, FullScanDetail	Comprehensive and Developer. Comprehensive has the request and response of each finding. Developer has the classification (CVSS, CWE, CVE). Neither lists the scan settings that the IE report shows, such as the enabled checks and the scan policy
HIPAACompliance	HIPAA
Pci32, PciDss40	PCI DSS 3.2, PCI DSS 4.0
Iso27001Compliance	ISO 27001
Nistsp80053	NIST SP 800-53
DisaStig	DISA STIG
SansTop25	CWE/SANS Top 25
WASC	WASC Threat Classification
OwaspTopTen2021, OwaspTopTen2025	OWASP Top 10 2021, OWASP Top 10 2025
OwaspApiTopTen2023	OWASP Top 10 API Security Risks 2023
Asvs40	OWASP ASVS 5.0. The Invicti Platform template is for version 5.0
Vulnerabilities, VulnerabilitiesPerWebsite	No report type of the same name. Read the data with GET /api/inventory/v1/vulnerabilities
OwaspTopTen2013, OwaspTopTen2017, OwaspApiTop10, Crawled, Scanned, KnowledgeBase, ModSecurityWafRules, F5BigIpAsmWafRules, CustomReport	No Invicti Platform template

Users, teams, and roles

Invicti Enterprise	Invicti Platform	Notes
GET /members/list, /members/get/{id}	GET /api/identity/v1/users, /users/{userId}
POST /members/new	POST /api/identity/v1/users
PUT /members/{id}	PUT or PATCH /api/identity/v1/users/{userId}
DELETE /members/{id}	DELETE /api/identity/v1/users/{userId}
GET /members/getapitoken	GET, POST, or DELETE /api/identity/v1/me/api-key	The key belongs to the signed-in user. Refer to Manage your API key
GET /team/list, /team/get/{id}	GET /api/identity/v1/teams, /teams/{teamId}	The Invicti Enterprise path is /team, not /teams
POST /team/new, PUT and DELETE /team/{id}	POST /api/identity/v1/teams, PUT and DELETE /teams/{teamId}
Team members	/api/identity/v1/teams/{teamId}/users
GET /roles/list, /roles/get/{id}	GET /api/identity/v1/roles, /roles/{roleId}
POST /roles/new, PUT and DELETE /roles/{id}	POST /api/identity/v1/roles, PUT and DELETE /roles/{roleId}
Role permissions	/api/identity/v1/roles/{roleId}/scopes	Scopes are granular and don't match the Invicti Enterprise permission names one to one

In Invicti Enterprise, you assign a role to a user for a website group (RoleWebsiteGroupMappings). In Invicti Platform, a user or team has roles on resources, for example on a collection. Use /api/identity/v1/users/{userId}/resource-roles and /api/identity/v1/teams/{teamId}/resource-roles to read them.

Audit log, license, and other calls

Invicti Enterprise	Invicti Platform	Notes
GET /auditlogs/list	GET /api/identity/v1/audit/log	Refer to Audit log
GET /account/license	GET /api/identity/v1/license
GET /account/me	GET /api/identity/v1/me
GET /technologies/list	GET /api/inventory/v1/technologies
GET /agents/list	GET /api/v1/config/agents
GET, POST, and DELETE /scanpolicies/*	/api/v1/scanning_profiles	Refer to the warning in Terminology

Field mapping

Target

Invicti Enterprise (website)	Invicti Platform (target)	Notes
Id	id
Name	name
RootUrl	assetDetail.url in the Inventory API, address in the DAST API
Description	description
Tags	tags
Groups	collectionIds
AgentMode	agentId	An empty value means the default agent
CreatedAt, UpdatedAt	Not available
IsVerified, TechnicalContactEmail, LicenseType	Not available
Not available	targetType, businessImpact, environmentId, applicationIds, isDemo	New in Invicti Platform

Vulnerability

Invicti Enterprise (issue)	Invicti Platform (vulnerability)	Notes
Id	id
Title	name
Severity	severity	BestPractice has no equivalent
State	status	Refer to Vulnerabilities for the status mapping
WebsiteId	assetId
WebsiteName, WebsiteRootUrl	Not in the response	Read the target with GET /assets/{assetId}
FirstSeenDate, LastSeenDate	firstSeen, lastSeen
CvssVectorString	score.cvss2.vector
Cvss31VectorString	score.cvss3.vector
Cvss40VectorString	score.cvss4.vector
ClassificationLinks	classification	An object with cve, cwe, owasp2021, owasp2017, iso27001, pci40, and disastig
Url, Parameters	dast.url, dast.parameter	dast.method and dast.attack are also available
AssigneeName	assignee
LatestVulnerabilityIsConfirmed	confirmed, confirmedByHuman
Comments	comment	Read only. No public call writes a comment

The Inventory API vulnerability response doesn't include the descriptive text of a DAST vulnerability. Read it with GET /api/v1/scans/{scan_id}/results/{result_id}/vulnerabilities/{vuln_id} in the DAST API. Take the scan_id from lastSeenScanId and list the results with GET /api/v1/scans/{scan_id}/results. The following fields are returned.

Invicti Enterprise (issue)	Invicti Platform (DAST vulnerability)
Impact	impact
Remedy	recommendation
ProofOfConcept	proofs, each with type, content_type, and contents
VulnerabilityDetail	description, long_description, and details
ExternalReferences	references

Scan

Invicti Enterprise	Invicti Platform	Notes
Id	scan_id
TargetUrl, WebsiteUrl	address, target
InitiatedDate	start_date	A field of the scan, not nested
PolicyId, PolicyName	profile_id, profile_name
MaxScanDuration	max_scan_time
Scope, authentication, time window, imported links, URL rewrite, cookies, excluded links	Target configuration	Not part of the scan. Refer to Settings belong to the target
Vulnerability counts by severity	current_session.severity_counts with critical, high, medium, low, and info
State	current_session.status	Refer to the scan statuses in Scans

severity_counts and status are part of the session, not the scan itself. current_session holds the running or latest session and previous_session holds the one before it. Both are returned by GET /api/v1/scans/{scan_id}.

User

Invicti Enterprise (member)	Invicti Platform (user)	Notes
Name	firstName, lastName	Two fields instead of one
Email	emailAddress
State (Enabled or Disabled)	enabled, locked	Booleans
Teams	/users/{userId}/teams
RoleWebsiteGroupMappings	/users/{userId}/resource-roles	Refer to Users, teams, and roles
IsTwoFactorAuthenticationEnabled	/api/identity/v1/totp calls

Capabilities without a public API equivalent

The following Invicti Enterprise API calls have no equivalent in the published Invicti Platform API definitions. The table lists the closest alternative.

Invicti Enterprise	Alternative in Invicti Platform
Discovery (/discovery/*)	Use the user interface. To turn discovered web assets into targets with the API, use POST /api/v1/web_assets/add_targets
Agent groups (/agentgroups/*)	Not available. Assign an agent to each target with POST /api/v1/targets/{target_id}/set_agent
Delete an agent, set agent status	Not available in the API
Notifications (/notifications/*)	Create automations in the user interface. Refer to the IE notifications upgrade guide
Scan profiles and authentication profiles	Configure the target. IE scan profiles are not Platform scan profiles, which only list security checks. Credentials can be shared through secrets, but the authentication method and login details are set on each target. Refer to Settings belong to the target
Global client certificates	Add the certificate to each target with /api/v1/targets/{target_id}/configuration/client_certificate
Export the audit log	Page through GET /api/identity/v1/audit/log
Pause or resume a single scan	Not available. To suspend or resume all scheduled scans, use the schedule calls of the DAST API (/scans/suspend-schedules, /scans/resume-schedules, /scans/suspension-status)
Group scans, scan from a previous scan	Create a scan for each target with POST /api/v1/scans
Test form authentication or credentials, validate an imported links file	Not available in the API. Test the configuration in the user interface
Write a vulnerability comment	Not available. The comment field is read only
Website verification (/websites/startverification, /websites/verify)	Not available. Add "user_authorized_to_scan": "yes" to the scan request

Update your integrations

1. List the Invicti Enterprise calls that your scripts, syncs, and pipelines make. Search your code for /api/1.0.
2. For each call, find the Invicti Platform equivalent in the tables on this page. Check the Swagger for the exact request and response.
3. Replace the Basic authentication header with X-Auth: <your API key>. Refer to Authenticate.
4. Update the fields your code reads, and update filters and paging.
5. Where a call changed from one request to several, add the extra steps, for example the target lookup before listing scans, or the report polling.
6. Test against a non-production target first. If a call has no equivalent, plan to use the user interface or a different approach.

Troubleshooting

A scan list call doesn't filter by target or status

The DAST API takes its filters in the q parameter, for example ?q=target_id:{uuid} or ?q=status:completed. Separate query parameters such as ?target_id={uuid} aren't part of the API definition. Combine several filters with a semicolon, for example ?q=status:completed;target_id:{uuid}.

A vulnerability response doesn't include the website name

The vulnerability only has an assetId. Read the target with GET /api/inventory/v1/assets/{assetId} to get the name and URL.

A team or website call returns 404

Check the Invicti Enterprise path first. Team calls use /team, not /teams, and creating a website uses /websites/new. In Invicti Platform, teams are under /api/identity/v1/teams, and websites are targets under /api/inventory/v1/assets.

My integration can't find an Invicti Enterprise identifier in Invicti Platform

Don't assume identifiers carry over. Look the object up by name or URL in Invicti Platform, then store the new identifier. For multiple targets with the same URL, refer to Multiple targets showing the same URL after upgrade.

A call returns 401 after I switch the header

Confirm that the API key is valid and has the permissions the call needs. Refer to Get started with the Invicti Platform API and Manage your API key.

---

Need help?

Invicti Support team is ready to provide you with technical help. Go to Help Center