REST · JSON · POST-only

Moleant Discover API

REST interface for the Moleant Discover platform: organizations, systems, servers, Active Directory, SBOM/VEX artifacts, Microsoft 365 licenses, and account lifecycle. This reference was regenerated directly from the 101 live endpoint handlers in discover/*/index.php and account/*/index.php — every path, HTTP method, and body field below reflects what the code actually does, not an idealized spec.

Endpoints101
ProtocolHTTPS · REST
HTTP MethodPOST (all endpoints)
Formatapplication/json
BackendMySQL/MariaDB · Azure Blob
Discover API (94 endpoints)
Account API (7 endpoints)
MySQL/MariaDB
Azure Blob Storage

⚠ Known issue

POST /account/OffBoardAccount currently calls Plan::OnBoardAccount() instead of an off-boarding method (confirmed in account/OffBoardAccount/index.php) — almost certainly a copy/paste leftover from OnBoardAccount. The endpoint does not actually off-board an account today. Documented here as a known defect, not intended behavior.

🔑 Authentication

There is no Authorization header. Every endpoint is a POST with a JSON body read via php://input, and the credential travels as a field inside that same JSON body:

POST /discover/<Endpoint> Content-Type: application/json { "jwt": "<JWT>", "CGuid": "...", ... }

Most endpoints authenticate with a user session JWT in a field named jwt, validated against a shared secret and carrying an id/email claim used for permission checks against the customer identified by CGuid.

A small subset — the Active Directory data-push endpoints (ADCheckUpdateAllowed, ADUpdateDomainControllers, ADUpdateDomainData, ADUpdateDomainStatistics, ADUpdateDomainUserData, ADUpdateForestData) and createserver — use a field named token instead of jwt. These are agent/scanner-facing endpoints (an installed on-prem discovery agent pushing inventory data), not interactive user session calls, and use a separate token scheme.

discover/AcceptOrder is the exception: it's a Stripe webhook receiver (see the Discover Orders section) and carries no jwt/token field at all — it reads Stripe's own event payload shape.

↩ Response Envelope

{
  "result"  : "TRUE" | "FALSE",  // string, not boolean
  "message" : "<status text, or a JSON-encoded payload string on success>"
}

On success, message is often itself a hand-built JSON string (not a nested object) that the endpoint echos directly back to the client. On failure the HTTP status is usually 400 and message carries a human-readable reason. This envelope shape is built ad hoc per endpoint rather than by shared middleware, so treat it as the common case, not a strict guarantee for every path.

/discover/ Endpoints

# Organizations

POST/discover/AddOrganizationOrganization::AddOrganization
jwtCGuidCustomerNameCustomerShortName
POST/discover/DeleteOrganizationOrganization::DeleteOrganization
jwtCGuid
POST/discover/ListOrganizationsOrganization::ListOrganizations
jwt
POST/discover/ListOrganizationDetailsOrganization::ListOrganizationDetails
jwtCGuid
POST/discover/ModifyOrganizationDetailsOrganization::ModifyOrganizationDetails
jwtCGuidCustomerNameCustomerShortNameDescriptionHQAddress
POST/discover/AddOrganizationKBsOrganization::AddOrganizationKBs
jwtCGuidFilenameDescriptionFileData (base64)
POST/discover/DeleteOrganizationKBsOrganization::DeleteOrganizationKBs
jwtCGuidguid
POST/discover/ListOrganizationKBsOrganization::ListOrganizationKBs
jwtCGuid
POST/discover/ModifyOrganizationKBsOrganization::ModifyOrganizationKBs
jwtCGuidguidDescription

# Systems

POST/discover/AddSystemSystem::AddSystem
jwtCGuidSystemName
POST/discover/DeleteSystemSystem::DeleteSystem
jwtCGuidSystemID
POST/discover/ListSystemsOrganization::ListSystems
jwtCGuidComputerSoftwareCountCreateTotalCountIncludeDetailsIncludeOrgNameOrganizationsSearchServerIDSkipSystemIDUserIDissueNo
POST/discover/ListSystemDetailsSystem::ListSystemDetails
jwtCGuidSystemID
POST/discover/ModifySystemDetailsSystem::ModifySystemDetails
jwtCGuidSystemIDDescriptionHostnameOther
POST/discover/ListSystemsForReportOrganization::ListSystemsForReport
jwtCGuidComputerSoftwareCountCreateTotalCountIncludeDetailsIncludeOrgNameOrganizationsSearchServerIDSkipSystemIDUserIDissueNo
POST/discover/ListSystemsForServerServer::ListSystemsForServer
jwtCGuidServerIDServerListSystemID
POST/discover/AddSystemKBsSystem::AddSystemKBs
jwtCGuidSystemIDFilenameDescriptionFileData (base64)
POST/discover/DeleteSystemKBsBlobStore::DeleteSystemKBs
jwtCGuidSystemIDguid
POST/discover/ListSystemKBsBlobStore::ListSystemKBs
jwtCGuidSystemID
POST/discover/ModifySystemKBsSystem::ModifySystemKBs
jwtCGuidSystemIDguidDescription
POST/discover/AddSystemLicenseSystem::AddSystemLicense
jwtCGuidSystemIDLicModelLicNameLicKeyLicExp
POST/discover/DeleteSystemLicenseSystem::DeleteSystemLicense
jwtCGuidguid
POST/discover/ListSystemLicensesSystem::ListSystemLicenses
jwtCGuidSystemID
POST/discover/ModifySystemLicenseSystem::ModifySystemLicense
jwtCGuidSystemIDguidLicModelLicNameLicKeyLicExp
POST/discover/ListSystemLicenseTypesSystem::ListSystemLicenseTypes
jwtCGuidSystemID
POST/discover/ListSystemLogTypesSystem::ListSystemLogTypes
jwtCGuidSystemID

# Servers

POST/discover/createserverServer::createserver
tokenServerGuidHostnameDomainSuffixSerialNumberSystemTypeOperatingSystemRolesVendorNICSStaticRoutesWindowsTypeWindowsMemberShipListeningPortsLocalUsersLocalGroupsWindowsServicesInstalledApplicationsMemoryDisksCertificatesLastLoggedinSharesCPUDateRebootedDateCreated
Agent-facing (uses token, not jwt) — this is how an installed discovery agent registers/updates a server asset.
POST/discover/DeleteServerServer::DeleteServer
jwtCGuidServerID
POST/discover/ListServerDetailsServer::ListServerDetails
jwtCGuidServerIDServerDetailBasicServerDetailHardwareServerDetailCPUServerDetailMemoryServerDetailStorageServerDetailNetworkServerDetailApplicationsServerDetailSoftwareServerDetailServicesServerDetailRolesServerDetailGroupsServerDetailLoginsServerDetailSharesServerDetailListeningPortsServerDetailCertificatesServerDetailCardServerDetailPrimaryUser
The ServerDetail* flags select which detail blocks to include in the response.
POST/discover/ListServersInSystemSystem::ListServersInSystem
jwtCGuidSystemIDServerIDServerList
POST/discover/ModifyServerDetailsServer::ModifyServerDetails
jwtCGuidServerIDDescriptionPrimaryUserEnvironmentAssetStateDomain
POST/discover/DeleteServerKBsBlobStore::DeleteServerKBs
jwtCGuidServerIDguid
POST/discover/ModifyServerKBsBlobstore::ModifyServerKBs
jwtCGuidServerIDguidDescription
POST/discover/AddServerToSystemSystem::AddServerToSystem
jwtCGuidSystemIDServerID
POST/discover/RemoveServerFromSystemSystem::RemoveServerFromSystem
jwtCGuidSystemIDServerID
POST/discover/AddSystemToServerServer::AddSystemToServer
jwtCGuidServerIDSystemID
POST/discover/RemoveSystemFromServerServer::RemoveSystemFromServer
jwtCGuidServerIDSystemID

# Users & Permissions

POST/discover/AddUserUser::AddUser
jwtCGuidSystemIDLogAuthorLogDescriptionLogTypeLogdate
POST/discover/DeleteUserAdministration::DeleteUser
jwtCGuidEmailMode
POST/discover/InviteUserAdministration::InviteUser
jwtCGuidEmailFirstNameLastNameMode
POST/discover/ListUsersOrganization::ListUsers
jwtCGuidComputerSoftwareCountCreateTotalCountOrganizationsSearchServerIDSkipSystemIDUserIDUserTypeissueNo
POST/discover/ModifyPermissionAdministration::ModifyPermission
jwtCGuidUserIDReadWriteAdminOrgAdminPlanOwnerReadPasswordWritePassword
POST/discover/AddCoAdminAdministration::AddCoAdmin
jwtSubject
POST/discover/DeleteCoAdminAdministration::DeleteCoAdmin
jwtSubject
POST/discover/ListCoAdminsAdministration::ListCoAdmins
jwtSubjectUserlist

# Active Directory

POST/discover/ADCheckUpdateAllowedActiveDirectory::ADCheckUpdateAllowed
tokenCGuidServerGuidDomainObjectGUIDDomainDNSRootForestDNSRootForestObjectGUID
POST/discover/ADListDomainDataActiveDirectory::ADListDomainData
jwtCGuidDomainDNSRootDomainObjectGUID
POST/discover/ADSearchUserActiveDirectory::ADSearchUser
jwtCGuidDomainSearch
POST/discover/ADUpdateDomainControllersActiveDirectory::ADUpdateDomainControllers
tokenCGuidDomainControllers
POST/discover/ADUpdateDomainDataActiveDirectory::ADUpdateDomainData
tokenCGuidServerGuidDNSRootDomainObjectGUIDDomainSIDForestDistinguishedNameNetBIOSNameDomainModeParentDomainObjectClassManagedByInfrastructureMasterPDCEmulatorRIDMasterSubordinateReferencesReplicaDirectoryServersReadOnlyReplicaDirectoryServersAllowedDNSSuffixesChildDomainsComputersContainerUsersContainerSystemsContainerDomainControllersContainerDeletedObjectsContainerForeignSecurityPrincipalsContainerLostAndFoundContainerQuotasContainerLinkedGroupPolicyObjectsLastLogonReplicationIntervalPublicKeyRequiredPasswordRolling
POST/discover/ADUpdateDomainStatisticsActiveDirectory::ADUpdateDomainStatistics
tokenServerGuidDomainDNSRootDomainObjectGUIDForestDNSRootForestObjectGUIDUsersComputersGroupsServersWorkstationsDisabledUsersDisabledComputersInactiveUsersExpiredUsersLockedOutUsersPasswordExpiredUsersLastUpdatedPrimaryUpdateServer
POST/discover/ADUpdateDomainUserDataActiveDirectory::ADUpdateDomainUserData
tokenCGuidServerGuidDNSRootDomainObjectGUIDDomainUsersUserUpdateSession
POST/discover/ADUpdateForestDataActiveDirectory::ADUpdateForestData
tokenCGuidServerGuidNameForestDNSRootForestModeDomainsGlobalCatalogsDomainNamingMasterSchemaMasterSitesSPNSuffixesUPNSuffixesPartitionsContainerApplicationPartitionsCrossForestReferences

# Assets, Software & Attributes

POST/discover/ListAssetsOrganization::ListAssets
jwtCGuidComputerSoftwareCountCreateTotalCountIncludeDetailsIncludeOrgNameOrganizationsSearchServerIDSkipSystemIDUserIDissueNo
POST/discover/ListComputersOrganization::ListComputers
jwtCGuidComputerSoftwareCountCreateTotalCountIncludeDetailsSearchServerIDSkipSystemIDUserIDissueNo
POST/discover/ListSoftwareOrganization::ListSoftware
jwtCGuidComputerSoftwareCountCreateTotalCountOrganizationsSearchServerIDSkipStackSoftwareSystemIDUserIDissueNo
POST/discover/ListIssuesOrganization::ListIssues
jwtCGuidComputerSoftwareCountCreateTotalCountOrganizationsSearchServerIDSkipSystemIDUserIDissueNo
POST/discover/AddAttributeAttributes::AddAttributes
jwtCGuidNameTypeCardTypeOrgIDSystemIDServerID
POST/discover/DeleteAttributeAttributes::DeleteAttribute
jwtCGuidAttributeGuidNameOrgIDSystemIDServerID
POST/discover/ListAttributesAttributes::ListAttributes
jwtCGuidAttributeGuidOrgIDSystemIDServerID
Aggregates attributes across every organization the caller has a role in, not just CGuid.
POST/discover/ModifyAttributeAttributes::ModifyAttribute
jwtCGuidAttributeGuidNameOrgIDSystemIDServerID
POST/discover/ModifyAttributeValueAttributes::ModifyAttributeValue
jwtCGuidAttributeGuidItemValueOrgIDSystemIDServerID

# Knowledge Base

POST/discover/listkbsBlobStore::listkbs
jwtCGuidServerID
POST/discover/downloadkbBlobStore::downloadkb
jwtCGuidRandomNo
POST, not GET despite the name — reads its parameters from the JSON body like every other endpoint.
POST/discover/uploadkbBlobStore::uploadkb
jwtCGuidServerIDFilenameDescriptionFileData (base64)
POST/discover/PopulateKBCarouselSystem::PopulateKBCarousel
jwtCGuidSystemIDServerID

# Security, SBOM & VEX

POST/discover/ListSbomBlobStore::listsbom
jwtCGuidSystemIDFilenameDescription
POST/discover/UploadSBOMBlobStore::uploadsbom
jwtCGuidSystemIDFilenameDescriptionFileData (base64 CycloneDX XML)
POST/discover/ListVexBlobStore::listvex
jwtCGuidSystemIDFilenameDescription
POST/discover/DownloadVexBlobStore::downloadvex
jwtCGuidSystemID
POST, not GET despite the name.
POST/discover/UploadVEXBlobStore::uploadvex
jwtCGuidSystemIDFilenameDescriptionFileData (base64 CycloneDX/OpenVEX JSON)
POST/discover/ModifyVexBlobStore::modifyvex
jwtCGuidSystemIDidFilenameDescriptionStateJustificationDetailResponseComment
POST/discover/SecBuildTicketSecurity::SecBuildTicket
jwt
Only needs the JWT — builds the caller's org/role/AD-domain summary ticket from the token's own claims.

# Logs & Events

POST/discover/AddLogEntrySystem::AddLogEntry
jwtCGuidSystemIDServerIDLogTypeLogAuthorLogDescriptionLogEpochLogdateLogtime
POST/discover/DeleteLogEntrySystem::DeleteLogEntry
jwtCGuidguid
POST/discover/ListLogEntriesSystem::ListLogEntries
jwtCGuidSystemIDServerIDFilter
POST/discover/ModifyLogEntrySystem::ModifyLogEntry
jwtCGuidguidSystemIDServerIDLogTypeLogAuthorLogDescriptionLogdateLogtime
POST/discover/ListMasterLogEntriesOrganization::ListMasterLogEntries
jwtCGuidSystemIDServerIDFilterAdminFilterAuth

# Microsoft 365

POST/discover/AddM365AppM365::AddM365App
jwtCGuidTenantNameAppIDClientSecretTenantID
POST/discover/ListM365Licensesm365::Listm365Licenses
jwtCGuidSystemID
POST/discover/Populatem365Licensesm365::Populatem365licenses
jwtCGuidSystemIDClientSecret

# Address Book

POST/discover/ListAddressBookAddressBook::ListAddressBook
jwtCGuid
POST/discover/AddAddressBookEntryAddressBook::AddAddressBookEntry
jwtCGuidGivenNameLastNameInitialPhoneEmailRoleNotes
POST/discover/DeleteAddressBookEntryAddressBook::DeleteAddressBookEntry
jwtCGuidGuid
POST/discover/ModifyAddressBookEntryAddressBook::ModifyAddressBookEntry
jwtCGuidGuidGivenNameLastNameInitialPhoneEmailRoleNotes

# Keys

POST/discover/ListKeysKeys::ListKeys
jwtCGuid
POST/discover/AddKeyKeys::AddKey
jwtCGuidNameKey
POST/discover/DeleteKeyKeys::DeleteKey
jwtCGuidKey

# RACI Tasks

POST/discover/AddRACITaskRACI::AddRACITask
jwtCGuidSystemIDTaskRACIN
POST/discover/DeleteRACITaskRACI::DeleteRACITask
jwtCGuidSystemIDguid
POST/discover/ListRACITasksRACI::ListRACITasks
jwtCGuidSystemID
POST/discover/ModifyRACITaskRACI::ModifyRACITask
jwtCGuidSystemIDguidTaskRACIN

# Discover Orders

POST/discover/AcceptOrderPayment::CreateOrder
Stripe webhook event payload — no jwt/token field.
Despite the folder name, this receives a Stripe checkout.session-style webhook (reads data.object.id, customer, customer_name, customer_phone, customer_email) and calls Payment::CreateOrder(), not an "accept" method. Not called directly by frontend clients.
POST/discover/ListAccountsAdministration::ListAccounts
jwt

/account/ Endpoints

# Account Lifecycle

POST/account/CreateAccountIdentity::CreateAccount
jwtEmailFirstNameMiddleNameLastNameModePurchasedSubscriptions
POST/account/OnBoardAccountPlan::OnBoardAccount
jwtAccountGuid
POST/account/OffBoardAccountPlan::OnBoardAccount  ⚠
jwtAccountGuid
Bug: calls OnBoardAccount() instead of an off-boarding method — see the notice at the top of this page. Documented as it actually behaves today.
POST/account/CreateOrderPayment::CreateOrder
jwtAccountGuidcouponpurchase_country
POST/account/FinishOrderPayment::FinishOrder
jwtAccountGuidOrdernumber
POST/account/FinishOrderKlarnaPayment::FinishOrder
jwtOrdernumber
Calls the same Payment::FinishOrder() as the plain FinishOrder endpoint — worth confirming this is intentionally provider-agnostic rather than a missing Klarna-specific path.
POST/account/ReceivePushPayment::ReceivePush
jwt