API reference (read-only)

Version 1 is read-only and serves risk assessments: each assessment, its risk items and its signatures. Nothing from any other module is served, and neither are the post-market review records themselves.

Getting a key

1. An administrator opens Settings → API access (read-only) → API keys.
2. Name the key after the system that will use it, choose when it expires (up to a year), and select Issue key.
3. Copy the key straight away. It is shown once and Indelio does not keep a copy — store it in the calling system's secret store, the way you would a password.

To stop a key, select Revoke…, give the reason, and select Revoke permanently. It stops working on its next request and cannot be reactivated.

Sending a request

Send the key in the Authorization header of every request. Responses are JSON: { "api_version": "1", "data": … }. An error is JSON too: { "error": "…", "message": "…" } — branch on error; the message is written for a person reading a log. Timestamps are UTC, ISO 8601. Requests are limited to 60 a minute from one address.

Endpoints

• /risk/assessments: Every assessment in the key's organization, newest code first. state is optional: one of Draft, In Review, Pending Approval, Approved, Cancelled.
• /risk/assessments/{code}: One assessment. It adds its conclusion, integrity, signatures and items to the fields the list returns.

Example

One assessment, with the key read from an environment variable rather than typed into the command:

The answer (a fictional assessment; the real endpoint returns exactly this shape):

The same request with no key is refused with 401:

Responses

200

The data.

400

A query value is not allowed (for example an unknown state).

error: bad_request

401

No key was sent, or the key is not valid for this request — unknown, revoked, expired, or for an organization that is suspended. The response does not say which.

error: missing_api_key or invalid_api_key

404

No assessment with that code in the key's organization.

error: not_found

429

Too many requests: more than 60 in one minute from the same address. Wait for the minute to pass, then retry. The limit is enforced by Indelio's hosting firewall, before the request reaches Indelio, so the body is the firewall's rather than the format above.

500

Something unexpected went wrong in Indelio. Nothing about your key is implied; retry later, and tell us if it persists.

error: internal_error

503

Indelio could not complete the request. Nothing about your key is implied; retry after the Retry-After interval.

error: service_unavailable

Assessment (list and single)

code string

The assessment's number in Indelio, e.g. RA-004. Stable; use it to fetch one assessment.

title string

The assessment's title.

state string

Draft, In Review, Pending Approval, Approved or Cancelled.

method string | null

The risk-management method recorded, e.g. ISO 14971.

scope string | null

What the assessment covers.

owner string | null

The owner's name.

created_at timestamp

When the assessment was created (UTC, ISO 8601).

updated_at timestamp

When it last changed.

last_reviewed_at timestamp | null

When its last post-market review was recorded.

next_review_due timestamp | null

When its next periodic review is due.

review_interval_months number

The periodic review interval.

item_count number

How many risk items it holds.

high_residual_count number

How many items remain High after risk control.

Assessment (single only)

overall_conclusion string | null

The overall conclusion on residual risk.

content_hash string

SHA-256 of the assessment's material content. Its signatures are bound to this value.

integrity string

"intact" when the content still matches its content hash, "changed" when it does not.

signatures array

Each electronic signature on the assessment (fields below).

items array

The risk items, in item-number order (fields below).

Signature

meaning string

What the signature means, e.g. "Approved by".

signer_name string

The signer's printed name, captured at signing.

signed_at timestamp

When it was signed (UTC).

bound_to_current_content boolean

true when it was applied to the content as it is now; false when the assessment changed after signing.

Risk item

number number

The item's own number, as the audit trail records it. Never reused after an item is removed.

domain string | null

The design domain, e.g. Cyber.

hazard string

The hazard.

sequence_of_events string | null

How the hazard would reach someone.

hazardous_situation string | null

The hazardous situation.

harm string | null

The harm.

severity number

Initial severity, 1–5.

probability number | null

Initial probability, 1–5 (when scored by probability).

exploitability number | null

Initial exploitability, 1–5 (Cyber items scored by exploitability).

likelihood_basis string

"probability" or "exploitability" — which score the levels use.

cvss_score number | null

CVSS base score, where recorded.

cvss_vector string | null

CVSS vector, where recorded.

initial_level object

{ score, band } before risk control; band is Low, Medium or High.

risk_control string | null

The risk control measure.

control_option string | null

The ISO 14971 §7.1 option chosen.

option_rationale string | null

Why stronger options were not practicable.

control_ref string | null

Reference to the control's implementation.

residual_severity number | null

Severity after risk control.

residual_probability number | null

Probability after risk control.

residual_exploitability number | null

Exploitability after risk control.

residual_level object | null

{ score, band } after risk control; null until residual risk is scored.

verification string | null

How the control's effectiveness was verified.

acceptability string | null

The acceptability decision.

Looking after a key

• Keep it in the calling system's secret store — never in a URL, a code repository, a ticket or an email.
• Issue one key per system, so one can be revoked without stopping the others.
• Revoke a key as soon as it may have been exposed, or when the system or the person responsible for it leaves.
• Issue a replacement before a key expires; an expired key stops working without warning to the caller.