Management API Overview

The Management API is an HTTP API for administering an organization’s folders, folder members, and folder-scoped API keys programmatically — the same resources you manage from Settings → Manage folders in the dashboard. It is intended for organization administrators automating workspace setup, for example provisioning folders and API keys from CI.

The API operates entirely within one organization: every request is scoped to the organization of the Management API Key that authenticates it, and there is no way to read or change another organization’s data.

Base URL

The API is served on a per-tenancy host. Use the base URL for the tenancy your organization belongs to:

If you are unsure which tenancy your organization uses, check the region shown in the dashboard or ask your Check Point contact.

The examples in this section export the host once and reuse it, so a request never hardcodes a region:

$
export LAKERA_RED_HOST=red-webhooks.lakera.ai # EU tenancy: red-webhooks-eu.lakera.ai

Paths shown below are relative to that host.

Authentication

Every request authenticates with a Management API Key sent as a bearer token:

$
curl -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
>
  https://$LAKERA_RED_HOST/management/whoami

A Management API Key is distinct from the folder-scoped Red Team API Keys used with the SDK: it authorizes organization-level administration rather than target and scan access. Management API Keys are created in the dashboard by an organization administrator (see Obtaining a Management API Key); the API itself never mints one. A folder-scoped key sent to a management endpoint is rejected with 403.

An organization administrator’s authority is verified when the key is minted, and the key is then trusted until it is revoked. A Management API Key is revoked manually, or automatically when its owner loses organization membership.

Obtaining a Management API Key

Management API Keys are created in the dashboard, not through the API. Only an organization administrator can create one:

1. Sign in to the dashboard as an organization administrator.
2. Open Settings → Management API Keys.
3. Select Create key, give it a name that identifies where it will be used (for example CI pipeline or terraform), and select Create.
4. Copy the key from the confirmation dialog. The secret is shown only once and cannot be retrieved afterward, so store it in your secret manager before closing the dialog.

The Management API Keys entry appears under Settings only for organization administrators. If you do not see it, you are not an administrator of the organization — ask an administrator to create a key for you, or to grant you the administrator role.

To stop a key from working, revoke it from the same page. Revocation takes effect immediately.

Confirm a key

GET /management/whoami returns the organization a Management API Key administers, so automation can verify a credential before issuing real calls.

$
curl -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
>
  https://$LAKERA_RED_HOST/management/whoami

1
{ "orgId": "org_abc123", "keyId": "..." }

Errors

Responses use conventional HTTP status codes. Error bodies are JSON of the form { "error": "<message>" }.

Requesting a resource that belongs to another organization returns 404 on reads (a folder in another organization is indistinguishable from one that does not exist) and 403 on writes.

Endpoints