AI Red TeamingFoldersManagement API

Management API — Folders

Manage the organization’s folders. All endpoints are scoped to the Management API Key’s organization and require a Management API Key — see the Overview for authentication and error conventions.

Personal folders are never visible to the Management API. The organization folder (the built-in Default folder) is listed and readable, but cannot be renamed or deleted.

List folders

GET /management/folders

Returns the organization’s folders, newest first.

Query parameterTypeNotes
limitnumberMaximum folders to return. Default 100, capped at 500.
beforenumberReturn folders older than this at timestamp — the nextCursor from the previous page.
$curl -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
>  "https://$LAKERA_RED_HOST/management/folders?limit=100"
1{
2  "folders": [
3    {
4      "id": "...",
5      "at": 1786546819835,
6      "orgId": "org_abc123",
7      "name": "Team",
8      "isDefault": false
9    }
10  ],
11  "nextCursor": 1786546819835
12}

nextCursor is the before value to pass to fetch the next page, or null when the last page has been reached. Keep requesting with it until it comes back null:

$curl -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
>  "https://$LAKERA_RED_HOST/management/folders?limit=100&before={nextCursor}"

Get a folder

GET /management/folders/{folderId}

1{
2  "folder": { "id": "...", "orgId": "org_abc123", "name": "Team", "isDefault": false }
3}

Returns 404 if the folder does not exist in the key’s organization.

Create a folder

POST /management/folders

FieldTypeRequiredNotes
namestringyes1–200 characters after trimming.
descriptionstringnoUp to 2000 characters.
$curl -X POST -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
>  -H "Content-Type: application/json" \
>  -d '{"name": "Team"}' \
>  https://$LAKERA_RED_HOST/management/folders

Responds 201 with the created folder. The key’s owner is added as the folder’s admin.

Rename or update a folder

PATCH /management/folders/{folderId}

Supply name, description, or both; at least one is required. Renaming the organization folder is rejected with 400.

$curl -X PATCH -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
>  -H "Content-Type: application/json" \
>  -d '{"name": "Renamed team"}' \
>  https://$LAKERA_RED_HOST/management/folders/{folderId}

Delete a folder

DELETE /management/folders/{folderId}

Because targets and evaluations live in a folder, deletion must say what happens to the folder’s contents, via a contentMode field:

contentModeBehavior
"delete"Delete the folder’s targets, evaluations, and their scans; running scans are cancelled.
"move"Move the contents to another folder. Requires destinationFolderId, which must be an organization folder.

Either way, the folder’s Red Team API Keys are revoked. Deleting the organization folder is rejected with 400.

$curl -X DELETE -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
>  -H "Content-Type: application/json" \
>  -d '{"contentMode": "move", "destinationFolderId": "{otherFolderId}"}' \
>  https://$LAKERA_RED_HOST/management/folders/{folderId}

Responds 204 with no body.