Internal API reference

Discover API v1 Reference

Base URL: https://api.moleant.com/ — the v1 endpoints live under /discover/, /account/ and /Entitlements/.

Updated: 2026-09-21 · 100 endpoints

Internal reference. These POST endpoints serve Moleant's own clients: the Moleant Discover web app, Moleant Engine agents, the ordering flow on moleant.com and the Stripe webhook. They are not a supported public interface and may change without notice. Integrations should use the key-authenticated Discover API v2, which reuses several of the handlers documented here.

These endpoints are aliases. Since 2026-09-17 every v1 endpoint forwards to the corresponding Discover API v2 route: same fields, same responses, same failure messages, with the credential in the JSON body as before. New integrations should use the v2 routes. Each section below names its route. The endpoints discover/AddUser, account/CreateOrder, account/FinishOrder, account/FinishOrderKlarna and account/ReceivePush, which never worked, have been removed and answer 404. Where an operation's behaviour changed in this version, a Changes in this version note says how.

Conventions

Unless stated otherwise, every v1 endpoint follows the same pattern:

Method: POST, with every parameter in a JSON request body. A credential may also be sent as a query parameter or as a request header, as in v2.
Path: /<area>/<Operation>/, including the trailing slash. Each operation is a directory; without the slash the web server answers with a redirect that most HTTP clients follow as a GET, and the body is lost. Paths are case-sensitive (/Entitlements/ has a capital E).
Content type: send Content-Type: application/json. Responses are served as application/json; charset=UTF-8, except the two file downloads.
CORS: Access-Control-Allow-Origin: *, Access-Control-Allow-Methods: POST, OPTIONS.

Request format

The body is read raw and decoded as JSON. The endpoint copies the fields it knows onto the handler; unknown fields are ignored, and field names are case-sensitive. A body that is not valid JSON is treated as empty, which normally ends in JSON request appears to be invalid.

Send values as JSON strings. Numbers are accepted wherever digits are expected ("SystemID":"12" and "SystemID":12 behave the same).
Flags are strings too. Where a field takes "TRUE", "true"/"false" or "1", a JSON boolean does not work: true reaches the handler as the string 1 and is treated as unset.
Fields documented as arrays must be JSON arrays. Sending a scalar where an array is expected makes the request fail with HTTP 500.
Every value is validated against a format and a length range (see Value formats). A value that fails is treated as missing, which usually produces the endpoint's …missing or invalid failure.

Response formats

Successful reads return the handler's payload directly, usually a JSON object keyed by the collection name ({"Systems":[...]}). Writes, and every failure on every endpoint, return a status message with one fixed shape.

Shape	Used by	Example
Data object	Read endpoints (the `List*` calls and similar), on success.	`{"Query":[...],"Systems":[...]}`
Status message	All failures, and all writes.	`{"message":"Success","subcode":"Successfully added the key.","submessage":"None"}`
Status message with extra fields	AddRACITask, on success only.	`{"message":"Success","subcode":"RACI task was added.","submessage":"None","guid":"…"}`
Agent verdict	The Active Directory agent endpoints: a `Success` status whose `subcode` is `TRUE` (proceed) or `FALSE` (don't), with the reason in `submessage`.	`{"message":"Success","subcode":"FALSE","submessage":"You are not the designated update server."}`
File	downloadkb and DownloadVex, on success. Their failures are status messages.	The file's bytes

{ "message": "Success", "subcode": "Successfully modified data to the system.", "submessage": "None" }
{ "message": "Failure", "subcode": "User token invalid or empty.", "submessage": "None" }

Attribute	Description	Example
`message`	Always `Success` or `Failure`. Use it, together with the HTTP status code, to tell the outcome.	Failure
`subcode`	What happened, as returned by the handler. This is the string to show or log. The tables below quote each endpoint's values verbatim, typos included.	User token invalid or empty.
`submessage`	Additional detail when the handler has any, otherwise the literal string `None`.	None

Every response body, payloads and status messages alike, is produced by a JSON encoder rather than assembled by hand. Quotes, backslashes, line breaks and non-ASCII characters in the data are therefore always escaped correctly, and a response is always well-formed JSON. Keys appear once per object, in the order shown in the examples. Non-ASCII characters and slashes are sent unescaped.

Value types

Identifiers, counters and sizes that the API itself computes or converts, such as ServerID, SystemID, ResultCount and byte counts, are JSON numbers, and the response tables say so. Every other value is passed through as it is stored. Text is always a string. A numeric column that the API does not convert may arrive as a number or as a numeric string, depending on the column type, so parse those defensively. Missing optional values are an empty string, unless a table says null.

Status codes

Code	Meaning
`200`	The handler ran. The body is the payload, an empty-result placeholder, a `Success` status message (including an agent verdict of `FALSE`), or a file.
`400`	Validation failure, invalid credential, missing permission, or a database error.
`403`	A malformed agent `token` on createserver or an Active Directory update endpoint, or an AcceptOrder call without a valid Stripe signature. An unknown but well-formed token is a `400`.
`429`	Rate limited — see Rate limiting.
`500`	An unexpected error in the API. The body is a status message.
`503`	The API could not reach its database.

A path that does not exist gets the web server's own 404 page, which is HTML, not JSON. An operation folder that exists but whose operation was removed answers 404 the same way.

“No results” is not an error, but it is not always an empty list either. Most list endpoints answer an empty result with HTTP 200 and a placeholder array holding a string where objects would normally be, for example {"Computers":["No computer information was found."]}. Others return an empty array, and a few treat “no data” as a failure. Each endpoint below states which it does. A client that iterates the array and reads properties off each element must handle the placeholder.

Common failures

These failures can come from almost every endpoint that takes the credential in question, so the per-endpoint tables leave them out.

`subcode`	Cause
`JSON request appears to be invalid.`	The body carried neither the credential field nor `CGuid` — typically an empty body or one that is not valid JSON.
`User token invalid or empty.`	The user token failed validation: it did not decrypt and authenticate under a key of the endpoint's branch, it has expired, its header is not the one described in User token format, or it is a legacy token the API no longer accepts.
`User objectID invalid or empty.` `Users email invalid or empty.`	The user token validated but carried no usable identity: an empty e-mail claim, or an empty id in a legacy token. The SBOM and VEX endpoints spell these `User's objectID invalid or empty.` and `User's email invalid or empty.`
`Key token invalid or empty.`	On the endpoints that also accept an API key: the key is unknown.
`A database error occurred while processing this request.`	A database statement failed. This is also what a `CGuid` for an organization without the expected tables usually produces.

Text encoding in responses

Fields validated as Text (see below) are HTML-entity encoded when they are stored, and the API returns them as stored. Characters such as &, <, ", ', %, (, +, \ and the Swedish letters å, ä and ö arrive as entities (&, <, ", ', %, (, +, \, å…), and line breaks as <br>. Decode them before rendering the text as plain text. The same applies to text reported by Moleant Engine.

Value formats

The Notes column of each request table gives a field's format and maximum length, for example Text, max 255. Lengths are counted in bytes of the value as sent, before any cleaning.

Format	Accepted	Behaviour
Alphanumeric	`a`–`z`, `A`–`Z`, `0`–`9`	Any other character rejects the value. Organization GUIDs (`CGuid`) use this format.
Hex	`0`–`9`, `a`–`f` in either case	Any other character rejects the value.
GUID	Hex digits and hyphens	Any other character rejects the value.
Digits	`0`–`9`	Other characters are removed rather than rejected; a value with no digits becomes empty.
DNS name	Letters, digits, hyphen and dot	Any other character rejects the value.
E-mail	A syntactically valid e-mail address	Anything else rejects the value.
Date	Digits, space and `: - , / T`	Any other character rejects the value.
File name	Anything except `/ : * " < > \| \`	Those characters reject the value. The extension must also be on the list of allowed upload types.
Base64	`A`–`Z`, `a`–`z`, `0`–`9`, `+ / =`	Any other character rejects the value. The length limit applies to the Base64 text.
Text	Anything, but not empty	HTML-entity encoded before it is stored — see Text encoding above. An empty value counts as missing, even where the table says it is optional.
Plain text	Anything	The characters `' < > = ;` are removed.
Tolerant text	Anything	The characters `' < > =` are removed.
SamAccountName	Anything	The characters `" [ ] : ; \| = + * ? < > / \ ,` are removed.

Multi-organization queries

ListAssets, ListIssues, ListSoftware, ListSystemsForReport, ListUsers and, optionally, ListSystems take an Organizations array instead of a single CGuid. Each element names one organization and may carry its own filters; the results of all organizations are concatenated.

Attribute	Mandatory?	Description	Notes
`Organizations[].OrgName`	Yes	The organization's GUID (despite the name).	Alphanumeric, max 120.
`Organizations[].ServerID`	No	Array of asset ids to restrict to.	Digits, max 10 each.
`Organizations[].SystemID`	No	Array of system ids to restrict to.	Digits, max 10 each.
`Organizations[].UserID`	No	Array of user ids, as returned by ListUsers.	Text, max 150 each (Alphanumeric, max 50, on ListSystems).
`Organizations[].ComputerSoftware`	No	Array of applications, each `ApplicationName` or `ApplicationName-.-Version`.	Text, max 1024 each.
`Organizations[].issueNo`	No	Array of issue numbers.	Digits, max 4 each.
`Organizations[].Search`	No	Free-text search on the listed entity's name.	Text, max 120.

Filters combine with AND across kinds and OR within one array. When any organization in the request carries a filter or a search, organizations without one return nothing, so a filtered query does not accidentally list everything else. The number of organizations, the number of values in each filter array and their total are capped; exceeding a cap fails with You have selected too many <organizations|users|systems|servers|applications|issues|total items> for this query. Skip and Count page the result (both are needed, 0–1000000). Query[].TotalCount reports the unpaged total; the endpoints that document CreateTotalCount only compute it when that field is "1" and otherwise report -1.

Rate limiting (HTTP 429)

Every request passes through the same per-IP throttle as the v2 API before any endpoint logic runs: 120 requests per 60-second window, then a 300-second block. While blocked, every request returns HTTP 429 with a Retry-After header and the status message {"message":"Failure","subcode":"Too many requests. Please try again later.","submessage":"None"}. Agents behind one NAT share a single budget.

Authentication

There is no Authorization header. The credential travels as a field in the JSON body, and each endpoint expects one of these:

Credential	Field	Used by	Validated as
User token	`jwt`	The web app: nearly every `/discover/` and `/Entitlements/` endpoint.	An encrypted JWT (JWE) made with the Discover key; see User token format. It identifies the user; per-organization permissions are then checked against the `CGuid` in the request.
Account token	`jwt`	The `/account/` endpoints.	The same format, made with the separate Account key. Each branch refuses the other's tokens.
API key	`jwt`	The endpoints that also back the v2 API, marked User token or API key below.	These endpoints switch on length: a value of 120 characters or fewer (under 100 on DeleteServer and ModifyServerDetails) is looked up as an organization API key, which also decides the organization. Keys are hexadecimal, up to 20 characters.
Agent token	`token`	Moleant Engine: createserver and the Active Directory update endpoints.	The organization's agent id (`orgid` in ListOrganizationDetails), 24–64 hex characters. It decides the organization; there is no user.
None	—	AcceptOrder, which is authenticated by its Stripe signature instead.	—

User token format

The field is called jwt, but its value is an encrypted JWT: a JWE (RFC 7516) in compact serialization, five base64url parts separated by dots, the second one empty. The protected header is always {"alg":"dir","enc":"A256GCM","kid":"<key id>","typ":"JWT"}: the claims are encrypted and authenticated with AES-256-GCM under a 256-bit key that only the API and the Moleant frontend issuing the token hold. A client can't read a token or make one, and a token with any part changed, header included, is refused. So is a token with any other alg or enc, a kid the API doesn't know, or any other header field (zip, crit, jku…).

Claim	Mandatory?	Description
`iat`	Yes	Issue time in Unix seconds, as an integer. Refused if it is more than 60 seconds in the future.
`exp`	Yes	Expiry time in Unix seconds, as an integer. Refused from 60 seconds after `exp`, and whenever `exp` − `iat` exceeds 900 seconds. The web app's tokens last 600 seconds, and it fetches a new one for every call.
`data.id`	Yes	The user's object id in Moleant's Entra ID tenant. A token without one is refused.
`data.email`	No	The user's sign-in name.
`data.creationemail`	No	The e-mail address the account was created with, when the web app knows it.
`data.service`, `data.intentlock`	No	Purpose lock. Ignored unless the endpoint requires one: CreateAccount requires `CreateAccount` and `CREATE`.

Only Moleant's own frontends hold the keys, so a third party can't obtain a user token. Integrations use an organization API key instead.

Legacy HS256 tokens. While the web app moves to JWE, the API can still accept the previous format for each branch: an HS256-signed JWT whose claims sit under data (id, email, creationemail, timestamp, nonce, and for CreateAccount service and intentlock), each claim except nonce ending with the marker bm9uY2U= and the nonce. Anyone holding a legacy token can read its claims. Legacy tokens are refused once the move is complete.

Permission levels

A user's rights in an organization are a string of flags in the roles table, one character per position. The Permission column of each group's endpoint table refers to these levels.

Level	Flag position	Grants	Set with
Read	1	Viewing the organization's data.	ModifyPermission `Read`
Write	2	Adding, changing and deleting the organization's data.	`Write`
Account admin	3	Managing the organization's users and their permissions.	`Admin`
Read password / Write password	4 / 5	Stored and editable, but not checked by any endpoint.	`ReadPassword` / `WritePassword`
Organization admin	9	Accepted by ModifyPermission in place of Account admin.	Not settable through the API.

Two further roles belong to a plan (a subscription that owns organizations), not to an organization: the Discover admin owns the plan, and co-admins help run it. Creating and deleting organizations and managing co-admins require one of them; the endpoints say so. A newly invited user starts with Read only.

Organizations

An organization (customer) owns all inventory. Its GUID, CGuid, identifies it in every request and prefixes all of its database tables. Files attached to an organization are its knowledge base.

Endpoint	Purpose	Credential	Permission
`/discover/AddOrganization/`	Create an organization.	User token	Discover admin or co-admin
`/discover/DeleteOrganization/`	Delete an organization and its data.	User token	Discover admin or co-admin of its plan
`/discover/ListOrganizations/`	List the caller's organizations.	User token	Read (per organization)
`/discover/ListOrganizationDetails/`	Read one organization's details.	User token	Read
`/discover/ModifyOrganizationDetails/`	Change an organization's details.	User token	Write
`/discover/AddOrganizationKBs/`	Attach a file to an organization.	User token	Write
`/discover/DeleteOrganizationKBs/`	Remove an organization file.	User token	Write
`/discover/ListOrganizationKBs/`	List an organization's files.	User token	Read
`/discover/ModifyOrganizationKBs/`	Change an organization file's description.	User token	Write

AddOrganization

Creates a new organization under the caller's plan and provisions its tables. The new organization counts against the plan's organization quota.

POST https://api.moleant.com/discover/AddOrganization/

v2 route: POST /v2/organizations — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CustomerName`	Yes	Display name of the organization.	Text, max 255.
`CustomerShortName`	Yes	Short name.	Text, max 50.
`CGuid`	No	Ignored. The new organization gets a generated GUID.

Example request

POST https://api.moleant.com/discover/AddOrganization/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CustomerName":"Contoso AB","CustomerShortName":"Contoso"}

Response

A status message. On success the subcode is Successfully created organization.. The new CGuid is not returned; read it from ListOrganizations.

Failures, in addition to the common failures:

`subcode`	Cause
`CustomerName and CustomerShortName must be specified.`	A name was missing or empty.
`User is not a Discover admin or a Co-admin.`	The caller owns or co-administers no plan.
`You have used up all n organizations you were allowed to create.`	The plan's organization quota is used up.
`Unknown error.`	The plan's quota could not be read.
`Sorry, an error occurred.`	The organization could not be created. Nothing is left behind: the tables made for it are dropped again and no organization, user or role row is added. What went wrong is written to the API's error log and mailed to the administrators; the caller is never told.
`An unexpected error occurred while processing this request.`	Any other error.

Changes in this version: Creating an organization is all or nothing. Every table is created and checked before the organization, role and user rows are added; if anything fails, the tables made so far are dropped again, the details are written to the error log and mailed to the administrators, and the caller gets only Sorry, an error occurred. Earlier versions added the rows first and returned success even when some tables were missing.

DeleteOrganization

Deprovisions an organization: removes it, its tables and its users' access to it.

POST https://api.moleant.com/discover/DeleteOrganization/

v2 route: DELETE /v2/organizations/{CGuid} — documentation.

Irreversible. Every asset, system, log entry and attachment of the organization goes with it. The template organization ABCD1234 cannot be deleted.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.

Example request

POST https://api.moleant.com/discover/DeleteOrganization/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade"}

Response

A status message. On success the subcode is Successfully deleted organization..

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User is not a Discover admin or a Co-admin.`	The caller owns or co-administers no plan.
`User is not a Discover admin or a Co-admin for this particular organization.`	The organization belongs to another plan.
`Sorry, an error occurred.`	The organization could not be removed completely. It stays listed, so the removal can be repeated. What went wrong is written to the API's error log and mailed to the administrators; the caller is never told.
`An unexpected error occurred while processing this request.`	Any other error.

Changes in this version: Removing an organization is all or nothing. Every table is dropped and checked before the organization's rows and files are removed; if a table cannot be dropped the organization stays listed so the removal can be repeated, the details are written to the error log and mailed to the administrators, and the caller gets only Sorry, an error occurred. A plan whose organization count cannot be lowered no longer turns a completed removal into Unknown error.

ListOrganizations

Lists every organization in which the caller has Read permission.

POST https://api.moleant.com/discover/ListOrganizations/

v2 route: GET /v2/organizations — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.

Example request

POST https://api.moleant.com/discover/ListOrganizations/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…"}

Response

An Organisations array — note the British spelling.

Attribute	Description	Example
`Organisations[].Organization`	Organization name.	Contoso AB
`Organisations[].CustomerShortName`	Short name.	Contoso
`Organisations[].CustomerDetails`	Free-text details.	Head office and two branches
`Organisations[].CustomerDetailsCut`	The same value truncated to 40 characters, with a trailing ellipsis when it was cut.	Head office and two branches
`Organisations[].Description`	Description, HTML-entity encoded.	Nordic manufacturing group
`Organisations[].DescriptionCut`	The same value truncated to 40 characters.	Nordic manufacturing group
`Organisations[].CGUID`	Organization GUID.	7a8b26724e508ade

Example response

{"Organisations":[
  {"Organization":"Contoso AB","CustomerShortName":"Contoso",
   "CustomerDetails":"Head office and two branches","CustomerDetailsCut":"Head office and two branches",
   "Description":"Nordic manufacturing group","DescriptionCut":"Nordic manufacturing group",
   "CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Organisations":["No organization information was found for this system."]}.

Failures are the common failures only.

ListOrganizationDetails

Returns an organization's descriptive fields and its system and asset counts.

POST https://api.moleant.com/discover/ListOrganizationDetails/

v2 route: GET /v2/organizations/{CGuid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.

Example request

POST https://api.moleant.com/discover/ListOrganizationDetails/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade"}

Response

An OrganizationDetails array with one element.

Attribute	Description	Example
`OrganizationDetails[].status`	Always `OK` on success.	OK
`OrganizationDetails[].CustomerName`	Organization name.	Contoso AB
`OrganizationDetails[].CustomerShortName`	Short name.	Contoso
`OrganizationDetails[].CustomerDetails`	Free-text details.	Head office and two branches
`OrganizationDetails[].orgid`	The organization's agent id: the `token` Moleant Engine sends. Treat it as a secret.	5e0c...
`OrganizationDetails[].Description`	Description, HTML-entity encoded.	Nordic manufacturing group
`OrganizationDetails[].NumberOfSystems`	Number of systems. A number.	7
`OrganizationDetails[].NumberOfAssets`	Number of assets. A number.	42
`OrganizationDetails[].HQAddress`	Head-office address, HTML-entity encoded.	Storgatan 1<br>111 51 Stockholm

Example response

{"OrganizationDetails":[
  {"status":"OK","CustomerName":"Contoso AB","CustomerShortName":"Contoso",
   "CustomerDetails":"Head office and two branches","orgid":"5e0c...",
   "Description":"Nordic manufacturing group","NumberOfSystems":7,"NumberOfAssets":42,
   "HQAddress":"Storgatan 1<br>111 51 Stockholm"}
]}

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to get organization details.`	The caller lacks Read.
`Organization does not exist.`	No organization has that GUID.

Changes in this version: orgid (the engine token) is returned only to callers with Write on the organization; others get an empty string.

ModifyOrganizationDetails

Updates an organization's name, short name, description and address. Only the fields you send are changed; at least one is required.

POST https://api.moleant.com/discover/ModifyOrganizationDetails/

v2 route: PUT PATCH /v2/organizations/{CGuid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`CustomerName`	No	New organization name.	Text, max 120.
`CustomerShortName`	No	New short name.	Text, max 40.
`Description`	No	New description.	Text, max 4096.
`HQAddress`	No	New head-office address.	Text, max 4096.

Example request

POST https://api.moleant.com/discover/ModifyOrganizationDetails/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","Description":"Nordic manufacturing group"}

Response

A status message. On success the subcode is Successfully modified information about the organization..

Failures, in addition to the common failures:

`subcode`	Cause
`CustomerShort, CustomerShortName, Description or HQAddress must be specified.`	No field to change was sent.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to change the organization data for this customer.`	The caller lacks Write.
`Organization does not exist and cannot be modified.`	No organization has that GUID.
`Failed to modify the organization.`	The write failed.

AddOrganizationKBs

Uploads a file to the organization's knowledge base. The file is stored in blob storage and listed by ListOrganizationKBs.

POST https://api.moleant.com/discover/AddOrganizationKBs/

v2 route: POST /v2/organizations/{CGuid}/kbs — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`Filename`	Yes	File name, used for display and to pick the file type.	File name, max 241. The extension must be an allowed upload type.
`Description`	No	Description of the file. May be empty or left out.	Text, max 4096.
`FileData`	Yes	The file content, Base64-encoded.	Base64, max 16,777,216 characters.

Example request

POST https://api.moleant.com/discover/AddOrganizationKBs/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","Filename":"network-diagram.pdf","Description":"Rack layout","FileData":"JVBERi0xLjcK..."}

Response

A status message. On success the subcode is Upload was successful..

Failures, in addition to the common failures:

`subcode`	Cause
`Filename missing or invalid.`	`Filename` was missing or contained a forbidden character.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Submitted file is too large, invalid or missing.`	`FileData` was missing, too long or not Base64.
`Extension is not allowed for upload.`	The file type is not on the allowed list.
`User does not have permission to upload to this organization.`	The caller lacks Write.
`Failed to upload file.`	Blob storage or the database write failed.

Changes in this version: Description is optional, as it always was for uploadkb.

DeleteOrganizationKBs

Deletes a file from the organization's knowledge base, including the stored blob.

POST https://api.moleant.com/discover/DeleteOrganizationKBs/

v2 route: DELETE /v2/organizations/{CGuid}/kbs/{guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`guid`	Yes	Attachment GUID, `Files[].guid` from ListOrganizationKBs.	Hex, max 250.

Example request

POST https://api.moleant.com/discover/DeleteOrganizationKBs/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","guid":"9d2e41ab..."}

Response

A status message. On success the subcode is Successfully deleted the organization KB..

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to delete system kb for this organization.`	The caller lacks Write.
`Failed to delete Organization KB.`	The attachment row could not be removed.
`Failed to delete System KBs`	The stored file could not be removed.

ListOrganizationKBs

Lists the files in the organization's knowledge base.

POST https://api.moleant.com/discover/ListOrganizationKBs/

v2 route: GET /v2/organizations/{CGuid}/kbs — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.

Example request

POST https://api.moleant.com/discover/ListOrganizationKBs/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade"}

Response

A Files array.

Attribute	Description	Example
`Files[].FileName`	Original file name.	network-diagram.pdf
`Files[].Icon`	Icon name for the file type; `kb.svg` when none is known.	pdf.svg
`Files[].Description`	Description, HTML-entity encoded. An empty string, never `null`, when the file has none.	Rack layout
`Files[].RandomNo`	Storage id of the file. Pass it to downloadkb.	3c1f9e0a7b...
`Files[].guid`	Attachment GUID. Pass it to the matching Modify and Delete calls.	9d2e41ab...
`Files[].FileLength`	Size in bytes. A number.	48213

Example response

{"Files":[
  {"FileName":"network-diagram.pdf","Icon":"pdf.svg","Description":"Rack layout",
   "RandomNo":"3c1f9e0a7b...","guid":"9d2e41ab...","FileLength":48213}
]}

Empty result: HTTP 200 with {"Files":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to see the organization KBs.`	The caller lacks Read.

ModifyOrganizationKBs

Replaces the description of a file in the organization's knowledge base.

POST https://api.moleant.com/discover/ModifyOrganizationKBs/

v2 route: PUT PATCH /v2/organizations/{CGuid}/kbs/{guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`guid`	Yes	Attachment GUID, `Files[].guid`.	Hex, max 250.
`Description`	Yes	New description.	Text, max 250.

Example request

POST https://api.moleant.com/discover/ModifyOrganizationKBs/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","guid":"9d2e41ab...","Description":"Rack layout, 2026"}

Response

A status message. On success the subcode is Successful modified KB..

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to modify KBs for this customer.`	The caller lacks Write.
`Failed to modify KB.`	The write failed.

Systems

A system groups the assets that together deliver a service or an application, and carries its own attachments, licences, log, RACI matrix, SBOM and VEX data. SystemID is numeric and unique within the organization.

Endpoint	Purpose	Credential	Permission
`/discover/AddSystem/`	Create a system.	User token	Write
`/discover/DeleteSystem/`	Delete a system.	User token	Write
`/discover/ListSystems/`	List systems, with filters and paging.	User token or API key	Read
`/discover/ListSystemsForReport/`	List systems across organizations for reports.	User token	Read (per organization)
`/discover/ListSystemDetails/`	Read one system's card.	User token or API key	Read
`/discover/ModifySystemDetails/`	Rename a system or change its card.	User token	Write
`/discover/AddServerToSystem/`	Make an asset a member of a system.	User token	Write
`/discover/RemoveServerFromSystem/`	Remove an asset from a system.	User token	Write
`/discover/ListServersInSystem/`	List a system's member assets, or the others.	User token	Read
`/discover/AddSystemKBs/`	Attach a file to a system.	User token	Write
`/discover/DeleteSystemKBs/`	Remove a system file.	User token	Write
`/discover/ListSystemKBs/`	List a system's files.	User token	Read
`/discover/ModifySystemKBs/`	Change a system file's description.	User token	Write
`/discover/AddSystemLicense/`	Record a licence on a system.	User token	Write
`/discover/DeleteSystemLicense/`	Remove a licence record.	User token	Write
`/discover/ListSystemLicenses/`	List a system's licences.	User token	Read
`/discover/ModifySystemLicense/`	Change a licence record.	User token	Write
`/discover/ListSystemLicenseTypes/`	List the licence types.	User token	—
`/discover/ListSystemLogTypes/`	List the log types.	User token	—

AddSystem

Creates an empty system and logs the event.

POST https://api.moleant.com/discover/AddSystem/

v2 route: POST /v2/organizations/{CGuid}/systems — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemName`	Yes	Name of the new system.	Text, max 255.

Example request

POST https://api.moleant.com/discover/AddSystem/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemName":"Payroll"}

Response

A status message. On success the subcode is Successfully add the system. (sic). The new SystemID is not returned; read it from ListSystems.

Failures, in addition to the common failures:

`subcode`	Cause
`SystemName invalid.`	`SystemName` was missing or too long.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to change the system data for this customer.`	The caller lacks Write.
`Cannot add empty system.`	The name was blank.
`System could not be created.`	The write failed.

DeleteSystem

Deletes a system together with its attachments, licences and log entries other than those classed as System Event. For a Microsoft 365 system it also removes the stored tenant and licence data, and for an Active Directory system the stored directory data of its domain. Member assets are not deleted.

POST https://api.moleant.com/discover/DeleteSystem/

v2 route: DELETE /v2/organizations/{CGuid}/systems/{SystemID} — documentation.

Irreversible. There is no soft-delete and no undo.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 6.

Example request

POST https://api.moleant.com/discover/DeleteSystem/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12"}

Response

A status message. On success the subcode is Successfully deleted the system..

Failures, in addition to the common failures:

`subcode`	Cause
`SystemID missing or invalid.`	`SystemID` was missing or too long.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to change the system data for this customer.`	The caller lacks Write.
`System does not exist.`	No system has that id.
`System could not be deleted.`	The delete failed.

Changes in this version: Also removes the system's asset memberships, RACI tasks, attribute values, SBOM and VEX data and stored files.

ListSystems

Lists the systems of one organization, or of several through a multi-organization query. This handler also serves v2 systems.

POST https://api.moleant.com/discover/ListSystems/

v2 route: GET /v2/organizations/{CGuid}/systems · POST /v2/systems/search — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token, or an organization API key.	A key also decides the organization; see Authentication.
`CGuid`	Conditional	Organization GUID for a single-organization query. Required with a user token unless `Organizations` is sent; ignored with a key.	Alphanumeric, max 50.
`Organizations`	Conditional	Array of organization objects for a multi-organization query. User token only.
`IncludeOrgName`	No	`"TRUE"` fills `OrganizationName`.	Case-sensitive.
`IncludeDetails`	No	`"TRUE"` also fills `OrganizationName`.	Case-sensitive.
`Skip`	No	Rows to skip. Applied only together with `Count`.	Digits, 0–1000000.
`Count`	No	Rows to return. Applied only together with `Skip`.	Digits, 0–1000000.
`ServerID`	No	Array of asset ids: return only systems containing one of them.	Digits, max 10 each.
`SystemID`	No	Array of system ids to return. Must be an array.	Digits, max 10 each.
`UserID`	No	Array of user ids: return only systems with one of these users on a member asset.	Alphanumeric, max 50 each.
`ComputerSoftware`	No	Array of applications (`Name` or `Name-.-Version`) installed on a member asset.	Text, max 1024 each.
`issueNo`	No	Array of issue numbers found on a member asset.	Digits, max 4 each.
`Search`	No	Substring match on the system name.	Text, max 120.

The filter fields apply to a single-organization query. In a multi-organization query each Organizations element carries its own filters.

Example request

POST https://api.moleant.com/discover/ListSystems/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","Skip":"0","Count":"25","IncludeOrgName":"TRUE"}

Response

An object with a Query header array and a Systems array, ordered by system name.

Attribute	Description	Example
`Query[].ResultCount`	Number of rows in `Systems`. A number.	7
`Query[].TotalCount`	Total matching rows before paging. A number.	7
`Systems[].SystemName`	System name. Results are ordered by this field.	Payroll
`Systems[].SystemID`	Numeric system id. A number.	12
`Systems[].SystemDescription`	Full description, HTML-entity encoded.	Payroll and HR processing
`Systems[].SystemDescriptionCut`	The description truncated to 40 characters, with a trailing ellipsis when it was cut.	Payroll and HR processing
`Systems[].SystemTypeMask`	32-bit system-type bitmask as a string: `1000…` general, `0100…` Active Directory, `0010…` Microsoft 365.	10000000000000000000000000000000
`Systems[].SystemTypeMaskHR`	Human-readable form of the mask: `General`, `Active Directory`, `Microsoft M365` or `Unknown`.	General
`Systems[].OrganizationName`	Customer name when `IncludeOrgName` or `IncludeDetails` is `"TRUE"`, otherwise empty.	Contoso AB
`Systems[].CGUID`	Organization GUID.	7a8b26724e508ade
`Systems[].SystemType`	Always the literal string `Not implemented`.	Not implemented
`Systems[].SystemTypeID`	Always the literal string `Not implemented`.	Not implemented

Example response

{"Query":[{"ResultCount":1,"TotalCount":1}],"Systems":[
  {"SystemName":"Payroll","SystemID":12,"SystemDescription":"Payroll and HR processing",
   "SystemDescriptionCut":"Payroll and HR processing","SystemTypeID":"Not implemented",
   "SystemType":"Not implemented","OrganizationName":"Contoso AB",
   "SystemTypeMask":"10000000000000000000000000000000","SystemTypeMaskHR":"General",
   "CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Systems":["No System information was found."]} and no Query object.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	A user-token call sent neither `CGuid` nor `Organizations`.
`Invalid count range.`	`Count` was out of range.
`Invalid skip range.`	`Skip` was out of range.
`You have selected too many … for this query.`	A filter cap was exceeded; see Multi-organization queries.
`Request is malformed.`	`SystemID` was not an array.
`No organizations specified.`	An `Organizations` element had no `OrgName`.
`User does not have permission to list systems for this customer.`	The caller lacks Read on a requested organization.

Changes in this version: Filters accept a single value as well as an array, and query-string values are URL-decoded.

ListSystemsForReport

A variant of ListSystems for the report pages: multi-organization only, without the type-mask fields.

POST https://api.moleant.com/discover/ListSystemsForReport/

v2 route: POST /v2/reports/systems — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`Organizations`	Yes	Array of organization objects; see Multi-organization queries.
`IncludeOrgName`	No	`"TRUE"` fills `OrganizationName`.	Case-sensitive.
`IncludeDetails`	No	`"TRUE"` also fills `OrganizationName`.	Case-sensitive.
`Skip`	No	Rows to skip. Applied only together with `Count`.	Digits, 0–1000000.
`Count`	No	Rows to return. Applied only together with `Skip`.	Digits, 0–1000000.

Search does not work on this endpoint. It filters on an installed-application column that exists only when the same organization also carries a ComputerSoftware filter; without one the call ends in a database error.

Example request

POST https://api.moleant.com/discover/ListSystemsForReport/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","Organizations":[{"OrgName":"7a8b26724e508ade","ServerID":["38"]},{"OrgName":"4f0e9b2ac1d37e55"}]}

Response

An object with a Query header array and a Systems array.

Attribute	Description	Example
`Query[].ResultCount`	Number of rows in `Systems`. A number.	7
`Query[].TotalCount`	Total matching rows before paging. A number.	7
`Systems[].SystemName`	System name. Results are ordered by this field.	Payroll
`Systems[].SystemID`	Numeric system id. A number.	12
`Systems[].SystemDescription`	Full description, HTML-entity encoded.	Payroll and HR processing
`Systems[].OrganizationName`	Customer name when requested, otherwise empty.	Contoso AB
`Systems[].CGUID`	Organization GUID.	7a8b26724e508ade
`Systems[].SystemType`	Always `Not implemented`.	Not implemented
`Systems[].SystemTypeID`	Always `Not implemented`.	Not implemented

Example response

{"Query":[{"ResultCount":1,"TotalCount":1}],"Systems":[
  {"SystemName":"Payroll","SystemID":12,"SystemDescription":"Payroll and HR processing",
   "SystemTypeID":"Not implemented","SystemType":"Not implemented","OrganizationName":"",
   "CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Systems":["No System information was found."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Invalid count range.`	`Count` was out of range.
`Invalid skip range.`	`Skip` was out of range.
`You have selected too many … for this query.`	A filter cap was exceeded.
`Request is malformed.`	`SystemID` was not an array.
`User does not have permission to list one or more systems specified for this call.`	The caller lacks Read on a requested organization.
`No organizations specified.`	`Organizations` was missing, or an element had no `OrgName`.

Changes in this version: OrganizationName is "" rather than null when the name is not requested.

ListSystemDetails

Returns the descriptive fields of one system.

POST https://api.moleant.com/discover/ListSystemDetails/

v2 route: GET /v2/organizations/{CGuid}/systems/{SystemID} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token, or an organization API key.	A key also decides the organization; see Authentication.
`CGuid`	Yes	Organization GUID. Ignored with a key.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/ListSystemDetails/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12"}

Response

A SystemDetails array with one element.

Attribute	Description	Example
`SystemDetails[].status`	`OK` on success. Check it: the empty result uses the same array.	OK
`SystemDetails[].systemname`	System name.	Payroll
`SystemDetails[].systemdescription`	Description, HTML-entity encoded.	Payroll and HR processing
`SystemDetails[].systemPermissionSetting`	Free-text permission notes.
`SystemDetails[].systemVerification`	Free-text verification notes.
`SystemDetails[].systemBackupRestore`	Free-text backup and restore notes.
`SystemDetails[].systemother`	Other notes; set with `Other` in ModifySystemDetails.
`SystemDetails[].SystemTypeMask`	System-type bitmask; see ListSystems.	01000000000000000000000000000000
`SystemDetails[].DomainDNSRoot`	AD domain of an Active Directory system, otherwise empty.	corp.example.com
`SystemDetails[].DomainObjectGUID`	Object GUID of that domain.	5b1e...

Example response

{"SystemDetails":[
  {"status":"OK","systemname":"Payroll","systemdescription":"Payroll and HR processing",
   "systemPermissionSetting":"","systemVerification":"","systemBackupRestore":"",
   "systemother":"","SystemTypeMask":"10000000000000000000000000000000",
   "DomainDNSRoot":"","DomainObjectGUID":""}
]}

Empty result: HTTP 200 with {"SystemDetails":[{"status":"No SystemDetails was found for this system."}]} — an object, not a string, so tell the two apart by status. This is also the answer for a system id that does not exist.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`System ID missing or invalid.`	`SystemID` was missing or not numeric.
`User does not have permission to get system details.`	The caller lacks Read.

ModifySystemDetails

Updates a system's name, description and other notes. Only the fields you send are changed.

POST https://api.moleant.com/discover/ModifySystemDetails/

v2 route: PUT PATCH /v2/organizations/{CGuid}/systems/{SystemID} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`Hostname`	No	The new system name — despite the field name.	Text, max 255. Must not be blank.
`Description`	No	New description.	Text, max 4096.
`Other`	No	New other notes (`systemother`).	Text, max 4096.

Example request

POST https://api.moleant.com/discover/ModifySystemDetails/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","Hostname":"Payroll 2","Description":"Payroll and HR processing"}

Response

A status message. On success the subcode is Successfully modified data to the system..

Failures, in addition to the common failures:

`subcode`	Cause
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to change the system data for this customer.`	The caller lacks Write.
`System does not exist and cannot be modified.`	No system has that id.
`SystemName cannot be empty.`	`Hostname` was blank.
`Failed to modify the system.`	The write failed.

AddServerToSystem

Adds an asset to a system. AddSystemToServer does the same from the asset's side.

POST https://api.moleant.com/discover/AddServerToSystem/

v2 route: PUT /v2/organizations/{CGuid}/systems/{SystemID}/assets/{ServerID} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`ServerID`	Yes	Numeric asset id.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/AddServerToSystem/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","ServerID":"38"}

Response

A status message. On success the subcode is Successfully added the server to the system.. If the asset is already a member, the call succeeds with Server already present in system. No change was made.

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID is missing or invalid.`	`ServerID` was missing or not numeric.
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to server to the system for this customer.`	The caller lacks Write.
`System does not exist.`	No system has that id.
`Server does not exist and cannot be added.`	No asset has that id.
`Failed to add server to system.`	The write failed.

RemoveServerFromSystem

Removes an asset's membership of a system. RemoveSystemFromServer does the same from the asset's side.

POST https://api.moleant.com/discover/RemoveServerFromSystem/

v2 route: DELETE /v2/organizations/{CGuid}/systems/{SystemID}/assets/{ServerID} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`ServerID`	Yes	Numeric asset id.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/RemoveServerFromSystem/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","ServerID":"38"}

Response

A status message. On success the subcode is Successfully removed the server from the system.. If the asset was not a member, the call succeeds with Server not present in system. No change was made.

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID is missing or invalid.`	`ServerID` was missing or not numeric.
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to server to the system for this customer.`	The caller lacks Write.
`Server does not exist and cannot be removed.`	No asset has that id.
`Failed to remove the server from the system.`	The delete failed.

ListServersInSystem

Lists the assets that are members of a system, the assets that are not, or all assets.

POST https://api.moleant.com/discover/ListServersInSystem/

v2 route: GET /v2/organizations/{CGuid}/systems/{SystemID}/assets — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`ServerList`	Yes	`Members`, `Nonmembers` or `Both` (all assets, regardless of membership).	Case-sensitive.
`SystemID`	Conditional	Numeric system id. Required unless `ServerList` is `Both`.	Digits, max 10.
`ServerID`	No	Ignored, except that it satisfies the presence check when `SystemID` is missing.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/ListServersInSystem/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","ServerList":"Members"}

Response

A Servers array. Which fields carry values depends on ServerList.

Attribute	Description	Example
`Servers[].ServerID`	Numeric asset id. A number.	38
`Servers[].Description`	Asset-card description; empty for `Nonmembers`.	Primary file server
`Servers[].Environment`	Environment id, a number — `Members` only, otherwise an empty string.	2
`Servers[].EnvironmentName`	Environment name — `Members` only.	Production
`Servers[].EnvironmentDescription`	Environment description — `Members` only.
`Servers[].Hostname`	Asset hostname.	SRV-FILE01

Example response

{"Servers":[
  {"ServerID":38,"Description":"Primary file server","Environment":2,
   "EnvironmentName":"Production","EnvironmentDescription":"","Hostname":"SRV-FILE01"}
]}

Empty result: HTTP 200 with {"Servers":[]} — an empty array, not a placeholder.

Failures, in addition to the common failures:

`subcode`	Cause
`ServerList is missing or invalid.`	`ServerList` was missing or not one of the three values.
`SystemID and ServerID is invalid or missing..`	Neither id was sent and `ServerList` is not `Both`.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to list servers for this system.`	The caller lacks Read.

AddSystemKBs

Uploads a file to a system's knowledge base.

POST https://api.moleant.com/discover/AddSystemKBs/

v2 route: POST /v2/organizations/{CGuid}/systems/{SystemID}/kbs — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`Filename`	Yes	File name, used for display and to pick the file type.	File name, max 241. The extension must be an allowed upload type.
`Description`	No	Description of the file. May be empty or left out.	Text, max 4096.
`FileData`	Yes	The file content, Base64-encoded.	Base64, max 16,777,216 characters.

Example request

POST https://api.moleant.com/discover/AddSystemKBs/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","Filename":"runbook.docx","Description":"Restore procedure","FileData":"UEsDBBQABgAIAAAAIQ..."}

Response

A status message. On success the subcode is Upload was successful..

Failures, in addition to the common failures:

`subcode`	Cause
`Filename missing or invalid.`	`Filename` was missing or contained a forbidden character.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Submitted file is too large, invalid or missing.`	`FileData` was missing, too long or not Base64.
`Submitted SystemID is too large, invalid or missing.`	`SystemID` was missing or not numeric.
`Extension is not allowed for upload.`	The file type is not on the allowed list.
`User does not have permission to upload to this customer.`	The caller lacks Write.
`Failed to upload file.`	Blob storage or the database write failed.

Changes in this version: Description is optional, as it always was for uploadkb.

DeleteSystemKBs

Deletes a file from a system's knowledge base, including the stored blob.

POST https://api.moleant.com/discover/DeleteSystemKBs/

v2 route: DELETE /v2/organizations/{CGuid}/systems/{SystemID}/kbs/{guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`guid`	Yes	Attachment GUID, `Files[].guid` from ListSystemKBs.	Hex, max 250.

Example request

POST https://api.moleant.com/discover/DeleteSystemKBs/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","guid":"9d2e41ab..."}

Response

A status message. On success the subcode is Successfully deleted the system KB..

Failures, in addition to the common failures:

`subcode`	Cause
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to delete system kb for this customer.`	The caller lacks Write.
`Failed to delete System KB.`	The attachment row could not be removed.
`Failed to remove data from table`	A related row could not be removed.
`Failed to delete System KBs`	The stored file could not be removed.

ListSystemKBs

Lists the files in a system's knowledge base, including SBOM and VEX files stored by the uploads.

POST https://api.moleant.com/discover/ListSystemKBs/

v2 route: GET /v2/organizations/{CGuid}/systems/{SystemID}/kbs — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/ListSystemKBs/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12"}

Response

A Files array.

Attribute	Description	Example
`Files[].FileName`	Original file name.	network-diagram.pdf
`Files[].Icon`	Icon name for the file type; `kb.svg` when none is known.	pdf.svg
`Files[].Description`	Description, HTML-entity encoded. An empty string, never `null`, when the file has none.	Rack layout
`Files[].RandomNo`	Storage id of the file. Pass it to downloadkb.	3c1f9e0a7b...
`Files[].guid`	Attachment GUID. Pass it to the matching Modify and Delete calls.	9d2e41ab...
`Files[].FileLength`	Size in bytes. A number.	48213

Example response

{"Files":[
  {"FileName":"runbook.docx","Icon":"docx.svg","Description":"Restore procedure",
   "RandomNo":"3c1f9e0a7b...","guid":"9d2e41ab...","FileLength":184320}
]}

Empty result: HTTP 200 with {"Files":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`System ID missing or invalid.`	`SystemID` was missing or not numeric.
`User does not have permission to download the kb-list.`	The caller lacks Read.

ModifySystemKBs

Replaces the description of a file in a system's knowledge base.

POST https://api.moleant.com/discover/ModifySystemKBs/

v2 route: PUT PATCH /v2/organizations/{CGuid}/systems/{SystemID}/kbs/{guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`guid`	Yes	Attachment GUID, `Files[].guid`.	Hex, max 250.
`Description`	Yes	New description.	Text, max 250.

Example request

POST https://api.moleant.com/discover/ModifySystemKBs/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","guid":"9d2e41ab...","Description":"Restore procedure, v2"}

Response

A status message. On success the subcode is Successful modified KB..

Failures, in addition to the common failures:

`subcode`	Cause
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to modify KBs for this customer.`	The caller lacks Write.
`Failed to modify KB.`	The write failed.

AddSystemLicense

Adds a licence record to a system.

POST https://api.moleant.com/discover/AddSystemLicense/

v2 route: POST /v2/organizations/{CGuid}/systems/{SystemID}/licenses — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`LicModel`	Yes	Licence type id, `LicenseType` from ListSystemLicenseTypes.	Digits, max 3.
`LicName`	Yes	Licence name.	Text, max 255.
`LicKey`	Yes	Licence key.	Text, max 255.
`LicExp`	Yes	Expiry date.	Date, max 60.

Example request

POST https://api.moleant.com/discover/AddSystemLicense/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","LicModel":"2","LicName":"Payroll Server 2026","LicKey":"XXXXX-XXXXX","LicExp":"2027-01-31"}

Response

A status message. On success the subcode is Successfully added system license entry..

Failures, in addition to the common failures:

`subcode`	Cause
`LicModel invalid or empty.`	`LicModel` was missing or not numeric.
`LicName invalid or empty.`	`LicName` was missing.
`LicKey invalid or empty.`	`LicKey` was missing.
`LicExp invalid or empty.`	`LicExp` was missing or not a date.
`User does not have permission to add system license data for this customer.`	The caller lacks Write.

DeleteSystemLicense

Deletes a licence record. The call succeeds even when no record has that GUID.

POST https://api.moleant.com/discover/DeleteSystemLicense/

v2 route: DELETE /v2/organizations/{CGuid}/systems/{SystemID}/licenses/{guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`guid`	Yes	Licence GUID, `SystemLicenses[].guid`.	Hex, max 50.

Example request

POST https://api.moleant.com/discover/DeleteSystemLicense/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","guid":"b7f0..."}

Response

A status message. On success the subcode is Successfully deleted system license entry..

Failures, in addition to the common failures:

`subcode`	Cause
`User does not have permission to deleted system license data for this customer.`	The caller lacks Write.

ListSystemLicenses

Lists a system's licence records, newest first.

POST https://api.moleant.com/discover/ListSystemLicenses/

v2 route: GET /v2/organizations/{CGuid}/systems/{SystemID}/licenses — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/ListSystemLicenses/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12"}

Response

A SystemLicenses array.

Attribute	Description	Example
`SystemLicenses[].LicenseDescription`	Display name of the licence type.	Per server
`SystemLicenses[].LicenseModel`	Licence model of the type.	Server
`SystemLicenses[].LicName`	Licence name.	Payroll Server 2026
`SystemLicenses[].LicKey`	Licence key.	XXXXX-XXXXX
`SystemLicenses[].guid`	Licence GUID.	b7f0...
`SystemLicenses[].LicExp`	Expiry date.	2027-01-31

Example response

{"SystemLicenses":[
  {"LicenseDescription":"Per server","LicenseModel":"Server","LicName":"Payroll Server 2026",
   "LicKey":"XXXXX-XXXXX","guid":"b7f0...","LicExp":"2027-01-31"}
]}

Empty result: HTTP 200 with {"SystemLicenses":["No licenses were found for this system."]}.

Failures are the common failures only.

Changes in this version: Read permission on the organization is required; earlier versions did not check it.

ModifySystemLicense

Updates a licence record. Only the fields you send are changed; at least one is required.

POST https://api.moleant.com/discover/ModifySystemLicense/

v2 route: PUT PATCH /v2/organizations/{CGuid}/systems/{SystemID}/licenses/{guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`guid`	Yes	Licence GUID.	Alphanumeric, max 50.
`LicModel`	No	New licence type id.	Digits, max 3.
`LicName`	No	New licence name.	Text, max 255.
`LicKey`	No	New licence key.	Text, max 255.
`LicExp`	No	New expiry date.	Date, max 60.
`SystemID`	No	Ignored.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/ModifySystemLicense/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","guid":"b7f0...","LicExp":"2028-01-31"}

Response

A status message. On success the subcode is Successfully modified system license entry..

Failures, in addition to the common failures:

`subcode`	Cause
`User does not have permission to add system license data for this customer.`	The caller lacks Write.
`The licensed software does not exist.`	No licence has that GUID.
`All necessary fields are empty. Modification failed.`	No field to change was sent.
`Failed to modify License.`	The write failed.

ListSystemLicenseTypes

Returns the global list of licence types used by LicModel. The same for every organization.

POST https://api.moleant.com/discover/ListSystemLicenseTypes/

v2 route: GET /v2/licensetypes — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	No	Ignored.
`SystemID`	No	Ignored.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/ListSystemLicenseTypes/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…"}

Response

A SystemLicenseTypes array.

Attribute	Description	Example
`SystemLicenseTypes[].LicenseType`	Licence type id. Send it as `LicModel`.	2
`SystemLicenseTypes[].LicenseDescription`	Display name.	Per server

Example response

{"SystemLicenseTypes":[{"LicenseType":1,"LicenseDescription":"Per user"},{"LicenseType":2,"LicenseDescription":"Per server"}]}

Empty result: HTTP 200 with {"SystemLicenseTypes":["No licensetypes were found for this system."]}.

Failures are the common failures only.

ListSystemLogTypes

Returns the global list of log types used by LogType. The same for every organization.

POST https://api.moleant.com/discover/ListSystemLogTypes/

v2 route: GET /v2/logtypes — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	No	Ignored.
`SystemID`	No	Ignored.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/ListSystemLogTypes/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…"}

Response

A SystemLogTypes array.

Attribute	Description	Example
`SystemLogTypes[].LogType`	Log type code. Send it as `LogType`.	4
`SystemLogTypes[].LogDescription`	Display name.	Configuration change

Example response

{"SystemLogTypes":[{"LogType":4,"LogDescription":"Configuration change"}]}

Empty result: HTTP 200 with {"SystemLogTypes":["No logtypes were found for this system."]}.

Failures are the common failures only.

Servers

An asset (a server or other computer) is identified by its numeric ServerID within the organization, and by the ServerGuid that Moleant Engine generates for the machine. Moleant Engine creates and refreshes assets through createserver; the other endpoints read and edit them.

Endpoint	Purpose	Credential	Permission
`/discover/createserver/`	Push an asset's inventory (agent).	Agent token	—
`/discover/DeleteServer/`	Delete an asset and its inventory.	User token or API key	Write
`/discover/ListServerDetails/`	Read one asset's inventory, by section.	User token	Read
`/discover/ModifyServerDetails/`	Change an asset's card.	User token or API key	Write
`/discover/DeleteServerKBs/`	Remove an asset file.	User token	Write
`/discover/ModifyServerKBs/`	Change an asset file's description.	User token	Write
`/discover/AddSystemToServer/`	Add an asset to a system (asset side).	User token	Write
`/discover/RemoveSystemFromServer/`	Remove an asset from a system (asset side).	User token	Write
`/discover/ListSystemsForServer/`	List the systems an asset belongs to, or the others.	User token	Read

createserver

Moleant Engine's inventory push. The first call for a ServerGuid creates the asset, with an asset card in environment 1 and asset state 1, and logs Asset was created. Later calls update the asset. Each inventory array replaces what is stored for the asset in that section.

POST https://api.moleant.com/discover/createserver/

v2 route: POST /v2/engine/assets — documentation.

Request

Attribute	Mandatory?	Description	Notes
`token`	Yes	Agent token of the organization.	Hex, 24–64 characters.
`ServerGuid`	Yes	The agent's stable id for the machine. Identifies the asset across calls.	Text, max 120.
`Hostname`	Yes	Host name.	Text, max 63.
`SystemType`	Yes	Kind of machine, as reported by the agent.	Text, max 30.
`WindowsType`	Yes	One of `DomainMember`, `Standalone`, `AzureAD` or `Unknown`.	Case-sensitive.
`SerialNumber`	No	Hardware serial number.	Text, max 100.
`Vendor`	No	Hardware vendor.	Text, max 120.
`OperatingSystem`	No	Operating system name and version.	Text, max 256.
`WindowsMemberShip`	No	Domain or workgroup.	DNS name, max 230.
`DomainSuffix`	No	DNS suffix.	DNS name, max 190.
`DateRebooted`	No	Last reboot, `YYYY-MM-DD HH:MM:SS`.	Text, max 20.
`DateCreated`	No	Installation date.	Text, max 50.
`Memory`	No	Physical memory in bytes.	Digits, max 40.
`NICS, Disks, CPU, …`	Yes	The inventory arrays in the next table.	Send every array; use `[]` when there is nothing to report.

Inventory arrays. Every element is an object with the listed keys; values are validated as Text unless noted.

Array	Element keys	Notes
`NICS`	`name`, `MAC`, `gw`, `IPAddresses` (array of strings), `Subnets` (array, parallel to `IPAddresses`), `DNS` (array of strings).
`StaticRoutes`	Strings, one route each.	Optional.
`ListeningPorts`	`LocalAddress`, `ListeningPort` (digits), `IPVersion`, `PortType`.	Optional.
`Roles`	`Name`, `InstallState`, `DisplayName`.	Optional.
`LocalUsers`	`User`.	Replaces local accounts only; primary users linked through ModifyServerDetails are kept.
`LocalGroups`	`Group`, `UserMemberShip` (array of user names).
`WindowsServices`	`Name`, `Displayname`, `Path`, `Status` (optional), `Context`, `StartType`.
`InstalledApplications`	`ApplicationName`, `Version`, `Publisher`, `InstallDate`.	Version max 20, Publisher max 60.
`Disks`	`MountPoint`, `VolumeName`, `Filesystem`, `Type` (these three optional), `TotalBytes`, `UsedBytes`, `FreeBytes` (digits), `FreePCT`.
`Certificates`	`dnsnames`, `friendlynames`, `Oid`, `HasPrivateKey`, `NotAfter`, `NotBefore` (digits, Unix time), `SerialNumber`, `Thumbprint`, `Subject`, `SubjectName`.	Optional.
`LastLoggedin`	`Name`, `LastLogin` (digits, Unix time).	Optional.
`Shares`	`ShareName`, `SharePath`, `Description`.
`CPU`	`Model`, `Speed`, `Cores` (digits).

Arrays marked optional may be omitted. Omitting any other array still clears that section, and also makes the server log a PHP warning.

Example request

POST https://api.moleant.com/discover/createserver/
Content-Type: application/json

{"token":"5e0c9a41f7d2b8e36a0c4d19","ServerGuid":"b13f7d0e5a2c","Hostname":"SRV-FILE01","SystemType":"Server",
 "WindowsType":"DomainMember","OperatingSystem":"Windows Server 2022 Standard","Vendor":"Dell Inc.",
 "SerialNumber":"7XK2QP3","WindowsMemberShip":"corp.example.com","DomainSuffix":"corp.example.com",
 "DateRebooted":"2026-07-14 03:12:08","DateCreated":"2025-02-02 09:41:11","Memory":"34359738368",
 "NICS":[{"name":"Ethernet0","MAC":"00:50:56:9A:11:22","gw":"10.0.4.1","IPAddresses":["10.0.4.21"],
          "Subnets":["255.255.255.0"],"DNS":["10.0.1.10"]}],
 "LocalUsers":[{"User":"Administrator"}],"LocalGroups":[{"Group":"Administrators","UserMemberShip":["Administrator"]}],
 "WindowsServices":[],"InstalledApplications":[{"ApplicationName":"7-Zip","Version":"23.01","Publisher":"Igor Pavlov","InstallDate":"20250310"}],
 "Disks":[{"MountPoint":"C:","TotalBytes":"137438953472","UsedBytes":"89120571392","FreeBytes":"48318382080","FreePCT":"35.2"}],
 "Shares":[],"CPU":[{"Model":"Intel Xeon Silver 4310","Speed":"2100","Cores":"12"}]}

Response

A status message. On success the subcode is Server was created., for updates too.

Failures:

`subcode`	Cause
`Invalid token.`	The token was malformed (HTTP 403) or unknown (HTTP 400).
`Mandatory value hostname missing or invalid.`	`Hostname` was missing or too long.
`Mandatory value SystemType missing or invalid.`	`SystemType` was missing or too long.
`Mandatory value ServerGuid missing or invalid.`	`ServerGuid` was missing or too long.
`Mandatory value WindowsType missing or invalid.`	`WindowsType` was not one of the four values.
`Unable to create server.`	The asset row could not be written.
`Unable to create server details.`	The asset card could not be written.
`A database error occurred while processing this request.`	A database statement failed.

Changes in this version: The inventory is replaced in one transaction, so a failure half-way leaves the previous inventory intact. DNS servers of every adapter are kept (only the last adapter's were), CPU models are stored without a leading space, and a duplicate local user or certificate in the report is skipped instead of failing the whole report.

DeleteServer

Permanently removes an asset and everything collected about it. This handler also serves v2 DELETE assets/<ServerID>.

POST https://api.moleant.com/discover/DeleteServer/

v2 route: DELETE /v2/organizations/{CGuid}/assets/{ServerID} — documentation.

Irreversible and wide-reaching. The call deletes the asset row plus its CPU, disk, DNS, installed-application, IP, last-logged-in-user, certificate, role, local-group, local-user, NIC, share, static-route and Windows-service records, its asset-card row, its attachments including the stored blobs, and its log entries other than those classed as System Event.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token, or an organization API key.	A key also decides the organization; see Authentication.
`CGuid`	Yes	Organization GUID. Ignored with a key.	Alphanumeric, max 50.
`ServerID`	Yes	Numeric asset id.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/DeleteServer/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","ServerID":"38"}

Response

A status message. On success the subcode is Successfully deleted the server..

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID invalid.`	`ServerID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to delete the server data for this customer.`	The caller lacks Write.
`Server does not exist and cannot be modified.`	No asset has that id.
`Server could not be deleted.`	The delete failed.

Changes in this version: Server KB links are deleted only within the caller's organization (an API key of another organization could delete them before). The deletion now also removes the asset's system memberships, listening ports, issues, attribute values, entitlement links and stored files, and the asset card is looked up by asset id (it was looked up by the wrong column).

ListServerDetails

Returns the inventory sections you ask for, for one asset. v2 assetdetails returns the same sections for every asset at once.

POST https://api.moleant.com/discover/ListServerDetails/

v2 route: GET /v2/organizations/{CGuid}/assets/{ServerID} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`ServerID`	Yes	Numeric asset id.	Digits, max 10.
`ServerDetailBasic, ServerDetailCertificates, ServerDetailRoles, ServerDetailCard, ServerDetailHardware, ServerDetailStorage, ServerDetailNetwork, ServerDetailCPU, ServerDetailMemory, ServerDetailShares, ServerDetailSoftware, ServerDetailServices, ServerDetailListeningPorts, ServerDetailLogins, ServerDetailGroups`	At least one	Send `"1"` for each section to include.	Digits, max 2 each.
`ServerDetailPrimaryUser`	No	`"1"` resolves the primary user inside `ServerDetailBasic`.	Digits, max 2.
`ServerDetailApplications`	No	Accepted but produces no section; installed software is `ServerDetailSoftware`.

Example request

POST https://api.moleant.com/discover/ListServerDetails/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","ServerID":"38","ServerDetailBasic":"1","ServerDetailPrimaryUser":"1","ServerDetailCard":"1","ServerDetailStorage":"1"}

Response

An object with one array per requested section. A section with no data is []. Text reported by the agent is entity-encoded, so a backslash arrives as \.

Attribute	Description	Example
`ServerDetailBasic`	Identity and lifecycle: `HostName`, `IPAddress`, `whenCardCreated` (ISO 8601), `id` (number), `Memory` (bytes, as a numeric string), `operatingsystem`, `servicePrincipalName`, `operatingSystemServicePack`, `Vendor`, `SerialNumber`, `Updated`, `DateCreated`, `DateRebooted`, `PrimaryUserResolvedUser`, `PrimaryUser`, `PossibleDomains`, `guid`. The primary-user fields are filled only when `ServerDetailPrimaryUser` is also `"1"`; `PossibleDomains` is then `[["corp.example.com",…]]` (nested), otherwise `[]`.
`ServerDetailCertificates`	`DNSNames`, `FriendlyNames`, `Oid`, `HasPrivateKey`, `NotAfter`, `NotBefore` (Unix timestamps), `SerialNumber`, `ThumbPrint`, `Subject`, `SubjectName`.
`ServerRoles`	Installed roles: `Name`, `InstallState`, `DisplayName`. Requested with `ServerDetailRoles`.
`ServerDetailCard`	`Description`, `EnvironmentDescription`, `AssetState` (number), `Environment` (number).
`ServerEnvironments`	Sent with `ServerDetailCard`: the organization's environments, `{EnvironmentID (number), EnvironmentName}`.
`AssetStates`	Sent with `ServerDetailCard`: the asset states, `{ID (number), State}`.
`ServerDetailHardware`	Always an empty array.
`ServerDetailStorage`	`MountPoint`, `FreeBytes`, `TotalBytes` (numbers), `FreePCT` (number, one decimal).
`ServerDetailNetwork`	`Name`, `MAC`, `IPAdresses` (array of `{IPaddress, Subnetmask}`; note the spelling), `DNS` (array of `{DNS}`), `Gateway`.
`ServerDetailCPU`	`Model`, `Speed`, `Cores` (number).
`ServerDetailMemory`	`PhysicalMemory`, the same value as `Memory`.
`ServerDetailShares`	`Share`, `Path`.
`ServerDetailSoftware`	`ApplicationName`, `Version`, `Publisher`, `InstallDate`.
`ServerDetailServices`	`Name`, `Displayname`, `StartType`, `Context`.
`ServerDetailListeningPorts`	TCP only: `LocalAddress`, `ListeningPort` (number), `PortType`, `IPVersion`.
`ServerDetailLogins`	`User` — local accounts.
`LastLoggedin`	Sent with `ServerDetailLogins`: `Name`, `Timestamp` (Unix timestamp), newest first.
`ServerDetailGroups`	`LocalGroupName`.

Example response

{"ServerDetailBasic":[{"HostName":"SRV-FILE01","IPAddress":"10.0.4.21",
   "whenCardCreated":"2025-02-02T09:41:11+01:00","id":38,"Memory":"34359738368",
   "operatingsystem":"Windows Server 2022 Standard","servicePrincipalName":"",
   "operatingSystemServicePack":"","Vendor":"Dell Inc.","SerialNumber":"7XK2QP3",
   "Updated":"2026-08-18 22:05:53","DateCreated":"2025-02-02 09:41:11",
   "DateRebooted":"2026-07-14 03:12:08","PrimaryUserResolvedUser":"Ada Lovelace (alovelace)",
   "PrimaryUser":"alovelace","PossibleDomains":[["corp.example.com"]],"guid":"b13f7d0e5a2c"}],
 "ServerDetailCard":[{"Description":"Primary file server","EnvironmentDescription":"Production",
   "AssetState":1,"Environment":2}],
 "ServerEnvironments":[{"EnvironmentID":1,"EnvironmentName":"Test"},{"EnvironmentID":2,"EnvironmentName":"Production"}],
 "AssetStates":[{"ID":1,"State":"In use"}],
 "ServerDetailStorage":[{"MountPoint":"C:","FreeBytes":48318382080,"TotalBytes":137438953472,"FreePCT":35.2}]}

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Server ID missing or invalid.`	`ServerID` was missing or not numeric.
`No server details were specified.`	No section flag was sent.
`No server details were enabled.`	No section flag was `"1"`.
`User does not have permission to get server details.`	The caller lacks Read.
`Server does not exist.`	No asset has that id.
`Server details does not exist.`	The asset has no asset card.
`Execution failed.`	The asset could not be read.

ModifyServerDetails

Updates the editable fields on an asset card: description, environment, asset state and primary user. Only the fields you send are touched. This handler also serves v2 PUT assets/<ServerID>.

POST https://api.moleant.com/discover/ModifyServerDetails/

v2 route: PUT PATCH /v2/organizations/{CGuid}/assets/{ServerID} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token, or an organization API key.	A key also decides the organization; see Authentication.
`CGuid`	Yes	Organization GUID. Ignored with a key.	Alphanumeric, max 50.
`ServerID`	Yes	Numeric asset id.	Digits, max 10.
`Description`	No	Free-text description. Creates the card row if it does not exist yet.	Text, max 4096.
`Environment`	No	Environment id, from `ServerEnvironments` in ListServerDetails.	Digits, max 2.
`AssetState`	No	Asset-state id, from `AssetStates`.	Digits, max 2.
`PrimaryUser`	No	SamAccountName of the primary user. The user must exist in the organization's Active Directory data for `Domain`.	SamAccountName, max 250. Requires `Domain`.
`Domain`	Conditional	Root DNS domain of `PrimaryUser`. Mandatory whenever `PrimaryUser` is sent.	DNS name, max 255.

Setting PrimaryUser replaces the asset's existing primary-user record and links the AD user to the asset. An empty PrimaryUser is a no-op, not a way to clear the assignment.

Example request

POST https://api.moleant.com/discover/ModifyServerDetails/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","ServerID":"38","Environment":"2","AssetState":"1","PrimaryUser":"alovelace","Domain":"corp.example.com"}

Response

A status message. On success the subcode is Successfully modified the server details..

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID invalid.`	`ServerID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to delete the server data for this customer.`	The caller lacks Write (sic: the message says delete).
`Asset does not exist and cannot be modified.`	No asset has that id.
`When primary user is specified, the Domain must be included as well.`	`PrimaryUser` was sent without `Domain`.
`The user does not exist in the specified Active Directory.`	No AD user matches that SamAccountName in that domain.
`Failed to modify the server.`	The write failed.

Changes in this version: Setting Environment on an asset without a card creates the card correctly (it used to create an orphan row).

DeleteServerKBs

Deletes a file attached to an asset, including the stored blob.

POST https://api.moleant.com/discover/DeleteServerKBs/

v2 route: DELETE /v2/organizations/{CGuid}/assets/{ServerID}/kbs/{guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`ServerID`	Yes	Numeric asset id.	Digits, max 10.
`guid`	Yes	Attachment GUID, `Files[].guid` from listkbs.	Hex, max 250.

Example request

POST https://api.moleant.com/discover/DeleteServerKBs/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","ServerID":"38","guid":"9d2e41ab..."}

Response

A status message. On success the subcode is Successfully deleted the server KB..

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID invalid.`	`ServerID` was missing or not numeric.
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to delete system kb for this customer.`	The caller lacks Write.
`Failed to delete Server KB.`	The attachment row could not be removed.
`Failed to delete System KBs`	The stored file could not be removed.

Changes in this version: The article is deleted only when it belongs to the caller's organization.

ModifyServerKBs

Replaces the description of a file attached to an asset.

POST https://api.moleant.com/discover/ModifyServerKBs/

v2 route: PUT PATCH /v2/organizations/{CGuid}/assets/{ServerID}/kbs/{guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`ServerID`	Yes	Numeric asset id.	Digits, max 10.
`guid`	Yes	Attachment GUID, `Files[].guid`.	Hex, max 250.
`Description`	Yes	New description.	Text, max 250.

Example request

POST https://api.moleant.com/discover/ModifyServerKBs/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","ServerID":"38","guid":"9d2e41ab...","Description":"Warranty certificate"}

Response

A status message. On success the subcode is Successful modified KB..

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID invalid.`	`ServerID` was missing or not numeric.
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to modify KBs for this customer.`	The caller lacks Write.
`Failed to modify KB.`	The write failed.

AddSystemToServer

Identical to AddServerToSystem — same fields, same messages — for use from the asset view.

POST https://api.moleant.com/discover/AddSystemToServer/

v2 route: PUT /v2/organizations/{CGuid}/assets/{ServerID}/systems/{SystemID} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`ServerID`	Yes	Numeric asset id.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/AddSystemToServer/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","ServerID":"38"}

Response

A status message. On success the subcode is Successfully added the server to the system., or Server already present in system. No change was made.

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID is missing or invalid.`	`ServerID` was missing or not numeric.
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to server to the system for this customer.`	The caller lacks Write.
`System does not exist.`	No system has that id.
`Server does not exist and cannot be added.`	No asset has that id.
`Failed to add server to system.`	The write failed.

RemoveSystemFromServer

Identical to RemoveServerFromSystem, for use from the asset view.

POST https://api.moleant.com/discover/RemoveSystemFromServer/

v2 route: DELETE /v2/organizations/{CGuid}/assets/{ServerID}/systems/{SystemID} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`ServerID`	Yes	Numeric asset id.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/RemoveSystemFromServer/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","ServerID":"38"}

Response

A status message. On success the subcode is Successfully removed the server from the system., or Server not present in system. No change was made.

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID is missing or invalid.`	`ServerID` was missing or not numeric.
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to server to the system for this customer.`	The caller lacks Write.
`Server does not exist and cannot be removed.`	No asset has that id.
`Failed to remove the server from the system.`	The delete failed.

ListSystemsForServer

Lists the systems an asset is a member of, the systems it is not in, or all systems.

POST https://api.moleant.com/discover/ListSystemsForServer/

v2 route: GET /v2/organizations/{CGuid}/assets/{ServerID}/systems — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`ServerID`	Conditional	Numeric asset id. Required unless `ServerList` is `Both`.	Digits, max 10.
`ServerList`	Yes	`Members`, `Nonmembers` or `Both` (all systems).	Case-sensitive.
`SystemID`	No	Ignored.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/ListSystemsForServer/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","ServerID":"38","ServerList":"Members"}

Response

A Systems array.

Attribute	Description	Example
`Systems[].SystemID`	Numeric system id. A number.	12
`Systems[].SystemDescription`	Description, HTML-entity encoded.	Payroll and HR processing
`Systems[].SystemName`	System name.	Payroll

Example response

{"Systems":[{"SystemID":12,"SystemDescription":"Payroll and HR processing","SystemName":"Payroll"}]}

Empty result: HTTP 200 with {"Systems":["No system member information was found for this server."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`ServerList is missing or invalid.`	`ServerList` was missing.
`SystemList is missing or invalid.`	`ServerList` was not one of the three values (sic).
`User does not have permission to list systems for this server.`	The caller lacks Read.

Users & Permissions

Users sign in to Moleant Discover with Microsoft Entra ID. A user's access is a role row per organization, holding the permission flags described under Authentication; plans add the Discover admin and co-admin roles. ListUsers is different: it lists the user accounts found in the inventory, not Moleant Discover users.

Endpoint	Purpose	Credential	Permission
`/discover/AddUser/`	Unfinished stub.	User token	—
`/discover/DeleteUser/`	Remove a user.	User token	Account admin, and Discover admin or co-admin
`/discover/InviteUser/`	Invite or create a user.	User token	Account admin
`/discover/ListUsers/`	List user accounts found in the inventory.	User token	Read (per organization)
`/discover/ModifyPermission/`	Change a user's permissions in an organization.	User token	Account admin
`/discover/AddCoAdmin/`	Make a user a co-admin of the caller's plan.	User token	Discover admin or co-admin
`/discover/DeleteCoAdmin/`	Remove a co-admin.	User token	Discover admin or co-admin
`/discover/ListCoAdmins/`	List users who are, or could become, co-admins.	User token	Discover admin or co-admin
`/discover/ListAccounts/`	List users, roles and keys of the caller's organizations.	User token	Account admin (per organization)

DeleteUser

Removes a user. If the user belongs to the caller's plan, the user record and all of the user's roles are deleted. Otherwise only the user's roles in organizations of the caller's plan are removed. The plan owner cannot be deleted, and neither can the caller.

POST https://api.moleant.com/discover/DeleteUser/

v2 route: DELETE /v2/organizations/{CGuid}/users/{Email} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	An organization in which the caller is Account admin.	Alphanumeric, max 255.
`Email`	Yes	E-mail address of the user to remove.	E-mail, max 255.
`Mode`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/DeleteUser/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","Email":"grace@contoso.com"}

Response

A status message. On success the subcode is User was successfully deleted., with the same text in submessage.

Failures, in addition to the common failures:

`subcode`	Cause
`Email must be specified.`	`Email` was missing or not an e-mail address.
`FALSE`	With `submessage` `Organization data missing.`: `CGuid` was missing.
`User email does not have permission to delete users for this customer.`	The caller lacks Account admin.
`User not found and could not be deleted.`	No user has that e-mail address.
`You may not delete your own admin-rights.`	The caller tried to delete themself.
`User email does not have permission to delete users for any customer.`	The caller is neither Discover admin nor co-admin.
`This user is not permissible to delete as they own the Plan.`	The user is the plan owner. `submessage`: `User could not be deleted.`

Changes in this version: Removing a user from another plan's organizations works for plans with several organizations (the old query failed with a database error).

InviteUser

Gives a person access to the caller's organizations. An address that already has a Moleant Discover account is granted access and notified by e-mail. Otherwise Mode decides: Invite sends a Microsoft Entra B2B invitation (the address must belong to a Microsoft 365 organization), and Create creates a new account in Moleant's own directory and e-mails the sign-in details. New users start with Read permission.

POST https://api.moleant.com/discover/InviteUser/

v2 route: POST /v2/organizations/{CGuid}/users — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	An organization in which the caller is Account admin.	Alphanumeric, max 255.
`Email`	Yes	The person's e-mail address.	E-mail, max 255.
`Mode`	Yes	`Invite` or `Create`.	Case-sensitive.
`FirstName`	Conditional	Given name. Required for `Create`.	Text, max 255.
`LastName`	Conditional	Surname. Required for `Create`.	Text, max 255.

Example request

POST https://api.moleant.com/discover/InviteUser/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","Email":"grace@fabrikam.com","Mode":"Invite"}

Response

A status message. The Success subcodes, with their submessage, are:

`subcode`	`submessage`	Meaning
`Invitation sent to already existing user.`	Invitations sent.	An existing account was given access.
`User already have access to the same organizations as you do.`	Invitations sent.	Nothing to do.
`Invitation sent and user added.`	Invitations sent.	`Invite`: the B2B invitation went out.
`The user already exists and will not be added for this customer`	Invitations not needed.	`Invite`: the user already has a role here.
`User was successfully created.`	User was successfully created.	`Create`: the account exists and the e-mail was sent.

Failures, in addition to the common failures:

`subcode`	Cause
`Mode not specified or incorrect.`	`Mode` was not `Invite` or `Create`.
`Firstname and Lastname must be specified when creating a new user.`	`Create` without names.
`Email must be specified.`	`Email` was missing or not an e-mail address.
`FALSE`	With `submessage` `Organization data missing.`: `CGuid` was missing.
`User email does not have permission to perform this operation.`	The caller lacks Account admin.
`Could not handle existing users. Please contact system administration.`	The existing account could not be updated.
`The domain does not appear to be a Microsoft federation. Could not send invite.`	`Invite` to an address outside Microsoft 365.
`Could not authenticate with the Microsoft Graph API. Please contact MoleAnt System Administration.`	Moleant could not get a Graph token.
`Could not send invitation. Please make sure the use has a school/business account at Office365 and that the user is not using a @moleant.com-address.`	Graph rejected the invitation.
`Could not send invitation. Please contact MoleAnt System Administration.`	The invitation failed for another reason.
`Cannot find the Plan bound to the caller.`	The caller has no plan.
`The target email is already used for another user.`	`Create` for an address that is taken.
`Failed to create user. EC: …`	`Create`: Graph rejected the new account. The Graph error follows `EC:`.
`An error occurred while creating the user. Please try again later.`	`Create` failed for another reason.
`General error. Please contact system administration.`	Anything else.

Changes in this version: The Graph failure messages no longer carry an internal suffix. A created user's welcome mail is HTML.

ListUsers

Lists the local user accounts found on assets, plus the organization's Active Directory users when no filter is set, across one or more organizations.

POST https://api.moleant.com/discover/ListUsers/

v2 route: GET /v2/organizations/{CGuid}/users · POST /v2/reports/users — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`Organizations`	Yes	Array of organization objects; see Multi-organization queries. `Search` matches the account name.
`Skip`	No	Rows to skip. Applied only together with `Count`.	Digits, 0–1000000.
`Count`	No	Rows to return. Applied only together with `Skip`.	Digits, 0–1000000.
`UserType`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/ListUsers/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","Organizations":[{"OrgName":"7a8b26724e508ade","Search":"ada"}]}

Response

An object with a Query header array and a Users array, ordered by host name.

Attribute	Description	Example
`Query[].ResultCount / TotalCount`	Rows returned, and the unpaged total. Numbers.	1 / 1
`Users[].UserGivenName`	Given name; the account name for a local account.	Ada
`Users[].UserSurName`	Surname.	Lovelace
`Users[].UserLoginName`	Account name.	alovelace
`Users[].UserID`	User id: for a local account the account name followed by the asset's `ServerGuid`, for an AD user `SamAccountName:domain`. Use it in `UserID` filters.	alovelace:corp.example.com
`Users[].UserDomain`	The asset's host name for a local account, the domain for an AD user.	corp.example.com
`Users[].UserEmail`	E-mail address, when known.	ada@contoso.com
`Users[].AccountType`	`Local user`, `Domain user` or `Primary user`.	Domain user
`Users[].CGUID`	Organization GUID.	7a8b26724e508ade
`Users[].UserAddress, UserDepartment, UserLastLogin`	Placeholders: the account name with the field name appended.	alovelaceUserAddress
`Users[].ServerID`	Placeholder: repeats `UserID`, not an asset id.

Example response

{"Query":[{"ResultCount":1,"TotalCount":1}],"Users":[
  {"UserGivenName":"Ada","UserSurName":"Lovelace","UserLoginName":"alovelace",
   "UserID":"alovelace:corp.example.com","UserDomain":"corp.example.com",
   "UserAddress":"alovelaceUserAddress","UserEmail":"ada@contoso.com",
   "UserDepartment":"alovelaceUserDepartment","UserLastLogin":"alovelaceUserLastLogon",
   "AccountType":"Domain user","ServerID":"alovelace:corp.example.com","CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Users":["No user information was found."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Invalid count range.`	`Count` was out of range.
`Invalid skip range.`	`Skip` was out of range.
`You have selected too many … for this query.`	A filter cap was exceeded.
`User does not have permission for this organization.`	The caller lacks Read on a requested organization.
`No organizations specified.`	`Organizations` was missing, or an element had no `OrgName`.

Changes in this version: Users on the same host are listed by login name.

ModifyPermission

Turns individual permission flags of one role row on or off, and logs the change. Flags you do not send are left as they are.

POST https://api.moleant.com/discover/ModifyPermission/

v2 route: PUT PATCH /v2/organizations/{CGuid}/roles/{UserID} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 255.
`UserID`	Yes	Id of the role row to change, `roles[].id` from ListAccounts. Not a user object id.	Digits, max 5.
`Read`	No	`"true"` or `"false"` — strings, not booleans.	Anything else leaves the flag unchanged.
`Write`	No	`"true"` or `"false"`.
`Admin`	No	`"true"` or `"false"`: Account admin.	You cannot change your own.
`ReadPassword`	No	`"true"` or `"false"`.
`WritePassword`	No	`"true"` or `"false"`.
`PlanOwner, OrgAdmin`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/ModifyPermission/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","UserID":"117","Read":"true","Write":"true"}

Response

A status message. On success the subcode is Permissions updated successfully.; submessage is OK.

Failures, in addition to the common failures:

`subcode`	Cause
`Permissions not declared.`	No flag was sent.
`FALSE`	With `submessage` `Organization data missing.`, `UserID data missing.`, `Incorrect CGuid specified.` (the role row is not in that organization) or `Unable to find Plan for organisation.`
`User does not have permission to change this user email data.`	The caller lacks Account admin.
`User not found...User does not have permission to change this user data.`	No role row has that id.
`You may not delete your own admin-rights.`	The caller sent `Admin` for their own role row.
`This user is not permissible to change as they own the Plan.`	The user owns the plan. `submessage`: `User could not be deleted.`

AddCoAdmin

Makes a user a co-admin of the plan the caller owns or co-administers. The user must already have access to an organization of that plan.

POST https://api.moleant.com/discover/AddCoAdmin/

v2 route: POST /v2/coadmins — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`Subject`	Yes	Object id of the user, `Objectid` from ListCoAdmins.	GUID, max 120.

Example request

POST https://api.moleant.com/discover/AddCoAdmin/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","Subject":"74c78695-356f-4b00-8b62-bc4e166c37b2"}

Response

A status message. On success the subcode is The user was successfully set as a CoAdmin (no full stop).

Failures, in addition to the common failures:

`subcode`	Cause
`You must specify a correct ObjectID of the Subject.`	`Subject` was missing or not a GUID.
`The specified subject could not be found.`	No user has that object id.
`The specified object could not be found.`	The caller's user record was not found.
`Cannot set this user as CoAdmin as they are already set as DiscoverAdmin/Owner for a Plan.`	The user owns a plan.
`Cannot set this user as CoAdmin as they are already set as CoAdmin for a Plan.`	The user is already a co-admin.
`The user has not been invited to the Plan the he needs to be in order to become a CoAdmin`	The user has no access to the plan's organizations.
`You lack the proper permissions to add someone as a CoAdmin`	The caller is neither Discover admin nor co-admin.
`An unknown error occured.`	Anything else.

DeleteCoAdmin

Removes a user's co-admin role in the caller's plan.

POST https://api.moleant.com/discover/DeleteCoAdmin/

v2 route: DELETE /v2/coadmins/{Subject} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`Subject`	Yes	Object id of the co-admin.	GUID, max 120.

Example request

POST https://api.moleant.com/discover/DeleteCoAdmin/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","Subject":"74c78695-356f-4b00-8b62-bc4e166c37b2"}

Response

A status message. On success the subcode is The user was successfully removed as a CoAdmin (no full stop).

Failures, in addition to the common failures:

`subcode`	Cause
`You must specify a correct ObjectID of the Subject.`	`Subject` was missing or not a GUID.
`The specified subject could not be found.`	No user has that object id.
`User email does not have permission to demote coadmins for any customer.`	The caller is neither Discover admin nor co-admin.
`The specified object could not be found.`	The caller's user record was not found.
`You cannot demote yourself from coadmin.`	The caller named themself.
`Cannot remove the permissions from this user as they are already set as DiscoverAdmin/Owner for a Plan.`	The user owns a plan.
`You cannot change a user that has another plan than yours.`	The user belongs to another plan.
`You lack the proper permissions to remove someone as a CoAdmin`	The caller may not change this user.
`An unknown error occured.`	Anything else.

ListCoAdmins

Lists the users who share organizations with the caller, optionally narrowed to the co-admins and owner of the caller's plan, or to everyone else.

POST https://api.moleant.com/discover/ListCoAdmins/

v2 route: GET /v2/coadmins — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`Userlist`	No	`Members` (the plan's owner and co-admins) or `Nonmembers` (everyone else). Omit for everyone.	Case-sensitive.
`Subject`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/ListCoAdmins/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","Userlist":"Nonmembers"}

Response

A SelectableAdmins array, one entry per user.

Attribute	Description	Example
`SelectableAdmins[].Email`	User e-mail address.	grace@contoso.com
`SelectableAdmins[].Objectid`	User object id. Send it as `Subject`.	74c78695-356f-4b00-8b62-bc4e166c37b2

Example response

{"SelectableAdmins":[{"Email":"grace@contoso.com","Objectid":"74c78695-356f-4b00-8b62-bc4e166c37b2"}]}

Empty result: HTTP 200 with {"SelectableAdmins":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Incorrect membersetting. Leave unset for full list.`	`Userlist` was set to something else.
`User email does not have permission to list users for any customer.`	The caller is neither Discover admin nor co-admin.

ListAccounts

For every organization where the caller is Account admin, lists the users' role rows and the organization's API keys. This is the user-management view of the web app.

POST https://api.moleant.com/discover/ListAccounts/

v2 route: GET /v2/accounts — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.

Example request

POST https://api.moleant.com/discover/ListAccounts/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…"}

Response

A Permissions array, one entry per organization.

Attribute	Description	Example
`Permissions[].guid`	Organization GUID.	7a8b26724e508ade
`Permissions[].CustomerName`	Organization name.	Contoso AB
`Permissions[].orgid`	Agent id of the organization. Treat it as a secret.	5e0c...
`Permissions[].roles[].email`	User e-mail address.	grace@contoso.com
`Permissions[].roles[].roles`	Permission flags; see Permission levels.	11000000000000000000000000000000
`Permissions[].roles[].id`	Role row id. Send it as `UserID` to ModifyPermission. A number.	117
`Permissions[].keys[].key`	An API key of the organization.	c9c42981ebf50a4749c2

Example response

{"Permissions":[
  {"guid":"7a8b26724e508ade","CustomerName":"Contoso AB","orgid":"5e0c...",
   "roles":[{"email":"grace@contoso.com","roles":"11000000000000000000000000000000","id":117}],
   "keys":[{"key":"c9c42981ebf50a4749c2"}]}
]}

Empty result: HTTP 200 with {"Permissions":[]}.

Failures are the common failures only.

Active Directory

Moleant Engine on a domain-joined machine pushes the domain's Active Directory data. Several machines may run in the same domain, so each domain has one designated update server: an agent first calls ADCheckUpdateAllowed, which assigns the role when it is free or stale, and only the designated server's pushes are accepted. The web app reads the data with ADListDomainData and ADSearchUser.

The agent endpoints answer with a verdict: a Success status whose subcode is TRUE (go ahead) or FALSE (don't), with the reason in submessage. Only a missing or broken request is a Failure, and its subcode is also FALSE. A bad token gives FALSE / Missing or corrupt token. at HTTP 403 when malformed and 400 when unknown.

Endpoint	Purpose	Credential	Permission
`/discover/ADCheckUpdateAllowed/`	Ask to become or stay the domain's update server (agent).	Agent token	—
`/discover/ADListDomainData/`	Read a domain's stored AD data.	User token	Read
`/discover/ADSearchUser/`	Search the stored AD users.	User token	Read
`/discover/ADUpdateDomainControllers/`	Push domain controllers (agent).	Agent token	—
`/discover/ADUpdateDomainData/`	Push domain properties (agent).	Agent token	Designated update server
`/discover/ADUpdateDomainStatistics/`	Push domain object counts (agent).	Agent token	Designated update server
`/discover/ADUpdateDomainUserData/`	Push domain users (agent).	Agent token	Designated update server
`/discover/ADUpdateForestData/`	Push forest properties (agent).	Agent token	Designated update server

ADCheckUpdateAllowed

Decides whether the calling agent may push data for a domain, registering the domain and assigning the designated-server role as needed.

POST https://api.moleant.com/discover/ADCheckUpdateAllowed/

v2 route: POST /v2/engine/ad/check — documentation.

Request

Attribute	Mandatory?	Description	Notes
`token`	Yes	Agent token of the organization.	Hex, 24–64 characters.
`ServerGuid`	Yes	The calling agent's id.	Alphanumeric, max 100.
`DomainDNSRoot`	Yes	The domain.	DNS name, max 255.
`DomainObjectGUID`	Yes	Object GUID of the domain.	GUID, max 100.
`ForestDNSRoot`	Yes	The forest root domain.	DNS name, max 255.
`ForestObjectGUID`	Yes	Object GUID of the forest.	GUID, max 100.
`CGuid`	No	Ignored; the token decides the organization.

Example request

POST https://api.moleant.com/discover/ADCheckUpdateAllowed/
Content-Type: application/json

{"token":"5e0c9a41f7d2b8e36a0c4d19","ServerGuid":"b13f7d0e5a2c","DomainDNSRoot":"corp.example.com","DomainObjectGUID":"5b1e0c6e-8f7a-4c7d-9e1a-2f3b4c5d6e7f","ForestDNSRoot":"example.com","ForestObjectGUID":"0a1b2c3d-4e5f-6071-8293-a4b5c6d7e8f9"}

Response

An agent verdict:

`subcode`	`submessage`
`TRUE`	Domain does not exist. It was created. Please proceed.
`TRUE`	Domain exists, but no designated update server exists. You have been assigned this role. Please proceed.
`TRUE`	You are already the designated update server. You may proceed.
`TRUE`	Last update field was missing. It has been replaced, please proceed.
`TRUE`	The last update was so old the update server has been replaced. It is you now. Please proceed. — the previous server had not updated for longer than the configured takeover period.
`FALSE`	You may not update this server. It belongs to another update server.

Failures:

`subcode`	Cause
`FALSE`	With `submessage` `Missing or corrupt token.` or `Domain and/or forest identifiers missing.`
`A database error occurred while processing this request.`	A database statement failed.

ADListDomainData

Returns the stored domain, forest, statistics and domain-controller data for one domain.

POST https://api.moleant.com/discover/ADListDomainData/

v2 route: GET /v2/organizations/{CGuid}/ad/domains/{DomainObjectGUID} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 255.
`DomainDNSRoot`	Yes	The domain.	DNS name, max 255.
`DomainObjectGUID`	Yes	Object GUID of the domain.	GUID, max 255.

Example request

POST https://api.moleant.com/discover/ADListDomainData/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","DomainDNSRoot":"corp.example.com","DomainObjectGUID":"5b1e0c6e-8f7a-4c7d-9e1a-2f3b4c5d6e7f"}

Response

An object with four one-element arrays. When a part is missing the call instead answers with a verdict: a Success status with subcode FALSE and submessage Domain does not exist., Forest does not exist. (also used when the statistics are missing), Domain controllers do not exist. or Unknown error occurred.

Attribute	Description	Example
`Domain[]`	`DomainDNSRoot`, `DomainObjectGUID`, `DomainSID`, `PDCEmulator`, `RIDMaster`, `ParentDomain`, `NetBIOSName`, `DomainMode`, `ForestRootDomain`, `ForestObjectGUID`, `UserUpdateSession`, `LastUpdated`, `PrimaryUpdateServer`, `CGUID`.
`Forest[]`	`ForestRootDomain`, `ForestObjectGUID`, `GlobalCatalogs`, `DomainNamingMaster`, `SchemaMaster`, `ForestMode`, `Sites`, `SPNSuffixes`, `UPNSuffixes`, `PrimaryUpdateServer`, `LastUpdated`, `ApplicationPartitions`, `CrossForestReferences`.
`DomainStats[]`	`DomainDNSRoot`, `ForestDNSRoot`, `DomainObjectGUID`, `ForestObjectGUID`, the counts `Users`, `Computers`, `Groups`, `InactiveUsers`, `DisabledUsers`, `LockedOutUsers`, `ExpiredUsers`, `PasswordExpiredUsers`, `Workstations`, `Servers`, `DisabledComputers` (numbers), `LastUpdated`, `PrimaryUpdateServer`.
`DomainControllers[]`	`ComputerObjectDN`, `DefaultPartition`, `Domain`, `Enabled`, `Forest`, `HostName`, `InvocationId`, `IPv4Address`, `IPv6Address`, `IsGlobalCatalog`, `LdapPort` (number), `Name`, `NTDSSettingsObjectDN`, `OperatingSystem`, `OperatingSystemHotfix`, `OperatingSystemServicePack`, `OperatingSystemVersion`, `OperationMasterRoles`, `isSchemaMaster`, `isPDC`, `isDNM`, `isRID`, `isInfra` (`"0"` or `"1"`), `Partitions`, `ServerObjectDN`, `ServerObjectGuid`, `Site`, `SslPort` (number).

Example response

{"Domain":[{"DomainDNSRoot":"corp.example.com","DomainObjectGUID":"5b1e...","DomainSID":"S-1-5-21-...",
   "PDCEmulator":"DC01.corp.example.com","RIDMaster":"DC01.corp.example.com","ParentDomain":"",
   "NetBIOSName":"","DomainMode":"Windows2016Domain","ForestRootDomain":"corp.example.com",
   "ForestObjectGUID":"0a1b...","UserUpdateSession":"9f8e...","LastUpdated":"1786954442",
   "PrimaryUpdateServer":"b13f7d0e5a2c","CGUID":"7a8b26724e508ade"}],
 "Forest":[{"ForestRootDomain":"corp.example.com","...":"..."}],
 "DomainStats":[{"DomainDNSRoot":"corp.example.com","Users":412,"Computers":96,"...":"..."}],
 "DomainControllers":[{"HostName":"DC01.corp.example.com","LdapPort":389,"SslPort":636,"isPDC":"1","...":"..."}]}

The example abbreviates the Forest, DomainStats and DomainControllers objects with "..."; the real ones carry every field listed above.

Failures, in addition to the common failures:

`subcode`	Cause
`FALSE`	With `submessage` `Domain identifiers missing.` or `Organization data missing.`
`User does not have permission to list domain data.`	The caller lacks Read.

Changes in this version: A domain, forest or statistics row that does not exist is a Failure status (Domain does not exist., Forest does not exist., Domain statistics do not exist., Domain controllers do not exist.) instead of a bare FALSE body. All domain controllers are listed; earlier versions listed only the last one.

ADSearchUser

Finds Active Directory users whose SamAccountName contains the search text, across all of the organization's domains.

POST https://api.moleant.com/discover/ADSearchUser/

v2 route: GET /v2/organizations/{CGuid}/ad/users — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 255.
`Search`	Yes	Text to look for in the SamAccountName.	Text, max 255.
`Domain`	No	Validated but not used to narrow the search.	DNS name, max 255.

Example request

POST https://api.moleant.com/discover/ADSearchUser/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","Search":"love"}

Response

An ADUsers array.

Attribute	Description	Example
`ADUsers[].DistinguishedName`	Distinguished name.	CN=Ada Lovelace,OU=Staff,DC=corp,DC=example,DC=com
`ADUsers[].SamAccountName`	Account name. Send it as `PrimaryUser` to ModifyServerDetails.	alovelace
`ADUsers[].Enabled`	Whether the account is enabled, as reported.	True
`ADUsers[].GivenName / Name / Surname`	Name fields.	Ada / Ada Lovelace / Lovelace
`ADUsers[].DomainRootDomain`	The user's domain. Send it as `Domain`.	corp.example.com
`ADUsers[].CGUID`	Organization GUID.	7a8b26724e508ade

Example response

{"ADUsers":[{"DistinguishedName":"CN=Ada Lovelace,OU=Staff,DC=corp,DC=example,DC=com",
   "SamAccountName":"alovelace","Enabled":"True","GivenName":"Ada","Name":"Ada Lovelace",
   "Surname":"Lovelace","DomainRootDomain":"corp.example.com","CGUID":"7a8b26724e508ade"}]}

Empty result: HTTP 200 with {"ADUsers":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`FALSE`	With `submessage` `Organization data missing.` or `You need to specify user to search for.`
`User does not have permission to list domain data.`	The caller lacks Read.

ADUpdateDomainControllers

Stores the domain controllers the agent found. Unlike the other pushes it does not check the designated update server.

POST https://api.moleant.com/discover/ADUpdateDomainControllers/

v2 route: PUT /v2/engine/ad/domaincontrollers — documentation.

Only one controller per domain survives. Each element first deletes every stored controller of its domain and then inserts itself, so of several controllers of the same domain — in one call or across calls — only the last one is kept.

Request

Attribute	Mandatory?	Description	Notes
`token`	Yes	Agent token of the organization.	Hex, 24–64 characters.
`DomainControllers`	Yes	Array of controller objects; see below.
`CGuid`	No	Ignored; the token decides the organization.

Keys of each DomainControllers element. Values are validated as Text, max 500, unless noted.

Key	Description	Notes
`DomainObjectGUID`	Object GUID of the controller's domain; decides which stored controllers are replaced.
`HostName, Name, Domain, Forest, Site`	Identity and location.
`ComputerObjectDN, DefaultPartition, NTDSSettingsObjectDN, ServerObjectDN, ServerObjectGuid, InvocationId`	Directory references.
`IPv4Address, IPv6Address`	Addresses.
`Enabled, IsGlobalCatalog`	As reported by PowerShell.	Max 10.
`LdapPort, SslPort`	Ports.	Digits, max 4 and 5.
`OperatingSystem, OperatingSystemHotfix, OperatingSystemServicePack, OperatingSystemVersion`	Operating system.
`OperationMasterRoles`	Space-separated FSMO roles: `SchemaMaster`, `DomainNamingMaster`, `PDCEmulator`, `RIDMaster`, `InfrastructureMaster`.	Sets the `is…` flags.
`Partitions`	Array of partition DNs.

Example request

POST https://api.moleant.com/discover/ADUpdateDomainControllers/
Content-Type: application/json

{"token":"5e0c9a41f7d2b8e36a0c4d19","DomainControllers":[{"HostName":"DC01.corp.example.com","Name":"DC01",
 "Domain":"corp.example.com","Forest":"corp.example.com","DomainObjectGUID":"5b1e0c6e-8f7a-4c7d-9e1a-2f3b4c5d6e7f",
 "Enabled":"True","IsGlobalCatalog":"True","LdapPort":"389","SslPort":"636","IPv4Address":"10.0.1.10",
 "OperationMasterRoles":"PDCEmulator RIDMaster InfrastructureMaster","Partitions":["DC=corp,DC=example,DC=com"],
 "Site":"Stockholm","OperatingSystem":"Windows Server 2022 Standard"}]}

Response

A status message. On success the subcode is Added domain controllers to list. — a plain success, not a verdict.

Failures:

`subcode`	Cause
`FALSE`	With `submessage` `Missing or corrupt token.` or `DomainControllers missing or corrupt.`
`A database error occurred while processing this request.`	A database statement failed.

Changes in this version: Every domain controller of a domain is stored (the table template no longer has a unique index on the domain; organizations created earlier keep one row per domain until the index is dropped).

ADUpdateDomainData

Updates the stored properties of a domain. The fields mirror PowerShell's Get-ADDomain; only some are stored.

POST https://api.moleant.com/discover/ADUpdateDomainData/

v2 route: PUT /v2/engine/ad/domain — documentation.

Request

Attribute	Mandatory?	Description	Notes
`token`	Yes	Agent token of the organization.	Hex, 24–64 characters.
`ServerGuid`	Yes	The calling agent's id. Must be the designated update server.	Alphanumeric, max 100.
`DomainObjectGUID`	Yes	Object GUID of the domain.	Text, max 1024.
`DNSRoot`	Yes	The domain's DNS name.	Text, max 1024.
`DomainSID, Forest, DistinguishedName, DomainMode, InfrastructureMaster, PDCEmulator, RIDMaster, ParentDomain`	No	Stored.	Text, max 1024 each.
`ForestObjectGUID`	No	Stored.	GUID, max 100.
`AllowedDNSSuffixes, ChildDomains, ComputersContainer, DeletedObjectsContainer, DomainControllersContainer, ForeignSecurityPrincipalsContainer, LastLogonReplicationInterval, LinkedGroupPolicyObjects, LostAndFoundContainer, ManagedBy, NetBIOSName, ObjectClass, PublicKeyRequiredPasswordRolling, QuotasContainer, ReadOnlyReplicaDirectoryServers, ReplicaDirectoryServers, SubordinateReferences, SystemsContainer, UsersContainer`	No	Accepted but not stored.
`CGuid`	No	Ignored.

Example request

POST https://api.moleant.com/discover/ADUpdateDomainData/
Content-Type: application/json

{"token":"5e0c9a41f7d2b8e36a0c4d19","ServerGuid":"b13f7d0e5a2c","DomainObjectGUID":"5b1e0c6e-8f7a-4c7d-9e1a-2f3b4c5d6e7f",
 "DNSRoot":"corp.example.com","DomainSID":"S-1-5-21-1004336348-1177238915-682003330","DomainMode":"Windows2016Domain",
 "PDCEmulator":"DC01.corp.example.com","RIDMaster":"DC01.corp.example.com","InfrastructureMaster":"DC01.corp.example.com"}

Response

An agent verdict: TRUE / Domain updated. on success, or FALSE with Domain does not exist. Please call ADCheckUpdateAllowed first., Domain exists, but no designated update server exists. Please call ADCheckUpdateAllowed first. or You are not the designated update server.

Failures:

`subcode`	Cause
`FALSE`	With `submessage` `Missing or corrupt token.` or `Domain and/or server identifiers missing.`
`A database error occurred while processing this request.`	A database statement failed.

Changes in this version: NetBIOSName and ForestObjectGUID are stored; the previous endpoint dropped them.

ADUpdateDomainStatistics

Replaces the stored object counts of a domain.

POST https://api.moleant.com/discover/ADUpdateDomainStatistics/

v2 route: PUT /v2/engine/ad/statistics — documentation.

Request

Attribute	Mandatory?	Description	Notes
`token`	Yes	Agent token of the organization.	Hex, 24–64 characters.
`ServerGuid`	Yes	The calling agent's id. Must be the designated update server.	Hex, max 100.
`DomainDNSRoot`	Yes	The domain.	DNS name, max 255.
`DomainObjectGUID`	Yes	Object GUID of the domain.	GUID, max 255.
`ForestDNSRoot`	No	The forest root domain.	DNS name, max 255.
`ForestObjectGUID`	No	Object GUID of the forest.	GUID, max 100.
`Users, Groups, InactiveUsers, DisabledUsers, LockedOutUsers, ExpiredUsers, PasswordExpiredUsers, Workstations, Servers, DisabledComputers`	No	Object counts.	Digits.
`Computers`	No	Computer count.	Digits, max 10.
`PrimaryUpdateServer`	No	Stored as sent.	Text, max 1024.
`LastUpdated`	No	Ignored; the server's clock is used.

Example request

POST https://api.moleant.com/discover/ADUpdateDomainStatistics/
Content-Type: application/json

{"token":"5e0c9a41f7d2b8e36a0c4d19","ServerGuid":"b13f7d0e5a2c","DomainDNSRoot":"corp.example.com",
 "DomainObjectGUID":"5b1e0c6e-8f7a-4c7d-9e1a-2f3b4c5d6e7f","Users":"412","Computers":"96","Groups":"57",
 "InactiveUsers":"31","DisabledUsers":"12","LockedOutUsers":"0","ExpiredUsers":"2","PasswordExpiredUsers":"5",
 "Workstations":"81","Servers":"15","DisabledComputers":"4"}

Response

An agent verdict: TRUE / Cats are nice. (sic) on success, or FALSE with Domain statistics does not exist. Please call ADCheckUpdateAllowed first., Domain statistics exists, but no designated update server exists. Please call ADCheckUpdateAllowed first. or You are not the designated update server.

Failures:

`subcode`	Cause
`FALSE`	With `submessage` `Missing or corrupt token.` or `Domain identifiers missing.`
`A database error occurred while processing this request.`	A database statement failed.

ADUpdateDomainUserData

Stores a batch of domain users. Large domains are sent in several calls that share one UserUpdateSession: the first call of a new session deletes the domain's stored users, and later calls of the same session append to them.

POST https://api.moleant.com/discover/ADUpdateDomainUserData/

v2 route: PUT /v2/engine/ad/users — documentation.

Request

Attribute	Mandatory?	Description	Notes
`token`	Yes	Agent token of the organization.	Hex, 24–64 characters.
`ServerGuid`	Yes	The calling agent's id. Must be the designated update server.	Alphanumeric, max 100.
`DNSRoot`	Yes	The domain.	DNS name, max 250.
`UserUpdateSession`	Yes	Id shared by the calls of one full upload. Use a new value for each upload.	Hex, max 120.
`DomainUsers`	Yes	Array of user objects with single-letter keys; see below.
`DomainObjectGUID, CGuid`	No	Ignored.

Keys of each DomainUsers element. The agent sends more letters; these are the ones stored. Values are Text, max 250.

Key	AD attribute	Notes
`I`	SamAccountName
`F`	ObjectGUID
`G`	DistinguishedName	Optional.
`B`	Enabled	Optional.
`C`	GivenName
`D`	Name
`K`	Surname

Example request

POST https://api.moleant.com/discover/ADUpdateDomainUserData/
Content-Type: application/json

{"token":"5e0c9a41f7d2b8e36a0c4d19","ServerGuid":"b13f7d0e5a2c","DNSRoot":"corp.example.com","UserUpdateSession":"9f8e7d6c",
 "DomainUsers":[{"I":"alovelace","F":"2c7d...","G":"CN=Ada Lovelace,OU=Staff,DC=corp,DC=example,DC=com",
                 "B":"True","C":"Ada","D":"Ada Lovelace","K":"Lovelace"}]}

Response

An agent verdict: TRUE / Domain users updated on success, or FALSE with Domain does not exist. Please call ADCheckUpdateAllowed first., Domain exists, but no designated update server exists. Please call ADCheckUpdateAllowed first. or You are not the designated update server.

Failures:

`subcode`	Cause
`FALSE`	With `submessage` `Missing or corrupt token.`, `DomainUsers missing or corrupt.`, `UserUpdateSession missing or corrupt.` or `Domain identifiers missing.`
`A database error occurred while processing this request.`	A database statement failed.

Changes in this version: A user already present in the session is updated instead of failing the batch.

ADUpdateForestData

Updates the stored properties of the forest. The fields mirror PowerShell's Get-ADForest.

POST https://api.moleant.com/discover/ADUpdateForestData/

v2 route: PUT /v2/engine/ad/forest — documentation.

Request

Attribute	Mandatory?	Description	Notes
`token`	Yes	Agent token of the organization.	Hex, 24–64 characters.
`ServerGuid`	Yes	The calling agent's id. Must be the designated update server.	Alphanumeric, max 100.
`ForestDNSRoot`	Yes	The forest root domain.	DNS name, max 255.
`ApplicationPartitions, CrossForestReferences, DomainNamingMaster, Domains, ForestMode, GlobalCatalogs, Name, PartitionsContainer, SchemaMaster, Sites, SPNSuffixes, UPNSuffixes`	No	Forest properties.	Text, max 1024 each.
`CGuid`	No	Ignored.

Example request

POST https://api.moleant.com/discover/ADUpdateForestData/
Content-Type: application/json

{"token":"5e0c9a41f7d2b8e36a0c4d19","ServerGuid":"b13f7d0e5a2c","ForestDNSRoot":"corp.example.com",
 "ForestMode":"Windows2016Forest","SchemaMaster":"DC01.corp.example.com","DomainNamingMaster":"DC01.corp.example.com",
 "GlobalCatalogs":"DC01.corp.example.com","Sites":"Stockholm","UPNSuffixes":"contoso.com"}

Response

An agent verdict: TRUE / Cats are nice. (sic) on success, or FALSE with Domain does not exist. Please call ADCheckUpdateAllowed first., Domain exists, but no designated update server exists. Please call ADCheckUpdateAllowed first. or You are not the designated update server.

Failures:

`subcode`	Cause
`FALSE`	With `submessage` `Missing or corrupt token.` or `Domain and/or forest identifiers missing.`
`A database error occurred while processing this request.`	A database statement failed.

Assets, Software & Attributes

Inventory queries across assets, installed software and the issues Moleant Discover has found, plus attributes: organization-defined fields (tags) that can be given a value on an organization, a system or an asset.

Endpoint	Purpose	Credential	Permission
`/discover/ListAssets/`	List assets across organizations.	User token	Read (per organization)
`/discover/ListComputers/`	List one organization's assets.	User token or API key	Read
`/discover/ListSoftware/`	List installed software across organizations.	User token	Read (per organization)
`/discover/ListIssues/`	List issues found in the inventory.	User token	Read (per organization)
`/discover/AddAttribute/`	Define an attribute.	User token	Write
`/discover/DeleteAttribute/`	Delete an attribute.	User token	Write
`/discover/ListAttributes/`	List attributes and their values.	User token	Read
`/discover/ModifyAttribute/`	Rename an attribute.	User token	Write
`/discover/ModifyAttributeValue/`	Set an attribute's value on a card.	User token	Write

ListAssets

Lists assets across one or more organizations through a multi-organization query. ListComputers is the single-organization equivalent.

POST https://api.moleant.com/discover/ListAssets/

v2 route: POST /v2/reports/assets — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`Organizations`	Yes	Array of organization objects. `Search` matches the hostname.
`IncludeDetails`	No	`"TRUE"` adds the asset-card description and the organization name.	Case-sensitive.
`IncludeOrgName`	No	`"TRUE"` adds the organization name.	Case-sensitive.
`Skip`	No	Rows to skip. Applied only together with `Count`.	Digits, 0–1000000.
`Count`	No	Rows to return. Applied only together with `Skip`.	Digits, 0–1000000.

Example request

POST https://api.moleant.com/discover/ListAssets/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","Organizations":[{"OrgName":"7a8b26724e508ade","ComputerSoftware":["7-Zip-.-23.01"]}],"IncludeOrgName":"TRUE"}

Response

An object with a Query header array and an Assets array.

Attribute	Description	Example
`Query[].ResultCount`	Number of rows returned. A number.	1
`Query[].TotalCount`	Unpaged total, or `-1` when not computed. A number.	-1
`Assets[].Hostname`	Asset hostname.	SRV-FILE01
`Assets[].ServerID`	Numeric asset id. A number.	38
`Assets[].OperatingSystem`	Reported operating system.	Windows Server 2022 Standard
`Assets[].DateRebooted`	Last recorded reboot.	2026-07-14 03:12:08
`Assets[].DateCreated`	When the asset record was created.	2025-02-02 09:41:11
`Assets[].Updated`	When the asset last checked in.	2026-08-18 22:05:53
`Assets[].Description`	Asset-card description. Empty unless `IncludeDetails` is `"TRUE"`.	Primary file server
`Assets[].OrganizationName`	Customer name. Empty unless requested with `IncludeOrgName` or `IncludeDetails`.	Contoso AB
`Assets[].CGUID`	Organization GUID.	7a8b26724e508ade
`Assets[].UserLoginName, Assets[].UserID`	Placeholders, regenerated at random on every request.

Example response

{"Query":[{"ResultCount":1,"TotalCount":1}],"Assets":[
  {"Hostname":"SRV-FILE01","ServerID":38,"OperatingSystem":"Windows Server 2022 Standard",
   "UserLoginName":"3f0c...","UserID":"a71b...","DateRebooted":"2026-07-14 03:12:08",
   "DateCreated":"2025-02-02 09:41:11","Updated":"2026-08-18 22:05:53","Description":"",
   "OrganizationName":"Contoso AB","CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Assets":["No asset information was found."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Invalid count range.`	`Count` was out of range.
`Invalid skip range.`	`Skip` was out of range.
`You have selected too many … for this query.`	A filter cap was exceeded; see Multi-organization queries.
`No organizations specified.`	`Organizations` was missing, or an element had no `OrgName`.

ListComputers

Lists the assets of one organization, with filters and paging. This handler also serves v2 assets, and the response is documented in detail there.

POST https://api.moleant.com/discover/ListComputers/

v2 route: GET /v2/organizations/{CGuid}/assets — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token, or an organization API key.	A key also decides the organization; see Authentication.
`CGuid`	Yes	Organization GUID. Ignored with a key.	Alphanumeric, max 50.
`IncludeDetails`	No	`"TRUE"` adds the asset card: `Description`, `DescriptionCut`, `Environment`, `EnvironmentName` and `OrganizationName`.	Case-sensitive.
`CreateTotalCount`	No	`"1"` computes `TotalCount`.	Digits, max 2.
`Search`	No	Substring match on hostname.	Plain text, max 30.
`ServerID, SystemID, UserID, ComputerSoftware, issueNo`	No	Filter arrays, as in a multi-organization query but at the top level. `UserID` values are Alphanumeric, max 50.	Arrays.
`Skip`	No	Rows to skip. Applied only together with `Count`.	Digits, 0–1000000.
`Count`	No	Rows to return. Applied only together with `Skip`.	Digits, 0–1000000.

Example request

POST https://api.moleant.com/discover/ListComputers/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","IncludeDetails":"TRUE","CreateTotalCount":"1","Skip":"0","Count":"50"}

Response

An object with a Query header array and a Computers array.

Attribute	Description	Example
`Query[].ResultCount`	Number of rows returned. A number.	1
`Query[].TotalCount`	Unpaged total, or `-1` when not computed. A number.	-1
`Computers[].Hostname`	Asset hostname.	SRV-FILE01
`Computers[].ServerID`	Numeric asset id. A number.	38
`Computers[].OperatingSystem`	Reported operating system.	Windows Server 2022 Standard
`Computers[].DateRebooted`	Last recorded reboot.	2026-07-14 03:12:08
`Computers[].DateCreated`	When the asset record was created.	2025-02-02 09:41:11
`Computers[].Updated`	When the asset last checked in.	2026-08-18 22:05:53
`Computers[].Description`	Asset-card description. Empty unless `IncludeDetails` is `"TRUE"`.	Primary file server
`Computers[].DescriptionCut`	The description truncated to 40 characters.	Primary file server
`Computers[].Environment`	Environment id from the asset card, as stored (a numeric string). Empty without details.	2
`Computers[].EnvironmentName`	Environment name. Empty without details.	Production
`Computers[].OrganizationName`	Customer name. Empty unless requested with `IncludeDetails`.	Contoso AB
`Computers[].CGUID`	Organization GUID.	7a8b26724e508ade
`Computers[].UserLoginName, Computers[].UserID`	Placeholders, regenerated at random on every request.

Example response

{"Query":[{"ResultCount":1,"TotalCount":42}],"Computers":[
  {"Hostname":"SRV-FILE01","ServerID":38,"OperatingSystem":"Windows Server 2022 Standard",
   "UserLoginName":"3f0c...","UserID":"a71b...","DateRebooted":"2026-07-14 03:12:08",
   "DateCreated":"2025-02-02 09:41:11","Updated":"2026-08-18 22:05:53",
   "Description":"Primary file server","DescriptionCut":"Primary file server","Environment":"2",
   "EnvironmentName":"Production","OrganizationName":"Contoso AB","CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Computers":["No computer information was found."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to list computers for this customer.`	The caller lacks Read.
`Invalid count range.`	`Count` was out of range.
`Invalid skip range.`	`Skip` was out of range.
`You have selected too many … for this query.`	A filter cap was exceeded; see Multi-organization queries.

Changes in this version: Filters accept a single value as well as an array, and query-string values are URL-decoded. Query parameters of the v2 routes reach the API again: the rewrite rule had dropped them, so IncludeDetails, filters, paging and ?Key= were ignored on the server. With IncludeDetails, an asset whose card has no description still reports its Environment and EnvironmentName.

ListSoftware

Lists installed applications with their installation counts, across one or more organizations, most installed first.

POST https://api.moleant.com/discover/ListSoftware/

v2 route: GET /v2/organizations/{CGuid}/software · POST /v2/reports/software — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`Organizations`	Yes	Array of organization objects. `Search` matches the application name or publisher.
`StackSoftware`	No	`"1"` groups by application and publisher, ignoring versions. `"0"` (default) groups by application and version.	Digits, max 2.
`CreateTotalCount`	No	`"1"` computes `TotalCount`.	Digits, max 2.
`Skip`	No	Rows to skip. Applied only together with `Count`.	Digits, 0–1000000.
`Count`	No	Rows to return. Applied only together with `Skip`.	Digits, 0–1000000.

Example request

POST https://api.moleant.com/discover/ListSoftware/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","Organizations":[{"OrgName":"7a8b26724e508ade"}],"StackSoftware":"1","Skip":"0","Count":"100"}

Response

An object with a Query header array and a Software array.

Attribute	Description	Example
`Query[].ResultCount / TotalCount`	Rows returned, and the unpaged total or `-1`. Numbers.	1 / -1
`Software[].Name`	Application name.	7-Zip
`Software[].Vendor`	Publisher.	Igor Pavlov
`Software[].StackSoftware`	The grouping used, `0` or `1`. A number.	1
`Software[].Version`	Version; `-` when grouped by publisher.	-
`Software[].NumberOfInstalls`	Installations found. A number.	14
`Software[].CGUID`	Organization GUID.	7a8b26724e508ade

Example response

{"Query":[{"ResultCount":1,"TotalCount":-1}],"Software":[
  {"Name":"7-Zip","Vendor":"Igor Pavlov","StackSoftware":1,"Version":"-","NumberOfInstalls":14,
   "CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Software":["No Software information was found."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Invalid count range.`	`Count` was out of range.
`Invalid skip range.`	`Skip` was out of range.
`You have selected too many … for this query.`	A filter cap was exceeded; see Multi-organization queries.
`No organizations specified.`	`Organizations` was missing, or an element had no `OrgName`.

Changes in this version: Applications with the same install count are listed by name and version.

ListIssues

Lists the issues Moleant Discover has found on assets, across one or more organizations.

POST https://api.moleant.com/discover/ListIssues/

v2 route: GET /v2/organizations/{CGuid}/issues · POST /v2/reports/issues — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`Organizations`	Yes	Array of organization objects. `Search` matches the issue text.
`Skip`	No	Rows to skip. Applied only together with `Count`.	Digits, 0–1000000.
`Count`	No	Rows to return. Applied only together with `Skip`.	Digits, 0–1000000.

Example request

POST https://api.moleant.com/discover/ListIssues/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","Organizations":[{"OrgName":"7a8b26724e508ade","SystemID":["12"]}]}

Response

An object with a Query header array and an Issues array.

Attribute	Description	Example
`Query[].ResultCount / TotalCount`	Rows returned, and the unpaged total. Numbers.	1 / 1
`Issues[].IssueNo`	Issue number. A number.	17
`Issues[].IssueText`	Description of the issue.	Disk C: has less than 10% free space
`Issues[].issueSeverity`	Severity code.	2
`Issues[].SystemID`	System concerned, or `0`. A number.	0
`Issues[].ServerID`	Asset concerned, or `0`. A number.	38
`Issues[].CGUID`	Organization GUID.	7a8b26724e508ade

Example response

{"Query":[{"ResultCount":1,"TotalCount":1}],"Issues":[
  {"IssueNo":17,"IssueText":"Disk C: has less than 10% free space","issueSeverity":2,
   "SystemID":0,"ServerID":38,"CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Issues":["No issue information was found."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`No organizations are set.`	`Organizations` was missing.
`Invalid count range.`	`Count` was out of range.
`Invalid skip range.`	`Skip` was out of range.
`You have selected too many … for this query.`	A filter cap was exceeded; see Multi-organization queries.
`User does not have permission to list computers for this customer.`	The caller lacks Read on a requested organization.
`No organizations specified.`	An element had no `OrgName`.

AddAttribute

Defines a new attribute for the organization. The definition applies organization-wide to cards of its CardType; give it values with ModifyAttributeValue.

POST https://api.moleant.com/discover/AddAttribute/

v2 route: POST /v2/organizations/{CGuid}/attributes — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Hex, max 100.
`Name`	Yes	Attribute name.	Text, max 5000.
`Type`	Yes	`0` a single row, `1` a block of text.	Digits, max 3.
`CardType`	Yes	Where it appears: `0` organization, `1` system, `2` asset.	Digits, max 3.
`OrgID, SystemID, ServerID`	One of them	At least one must be sent, but none is stored.	OrgID: Hex, max 100. The ids: Digits, max 5.

Example request

POST https://api.moleant.com/discover/AddAttribute/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","OrgID":"7a8b26724e508ade","Name":"Cost centre","Type":"0","CardType":"1"}

Response

A status message. On success the subcode is Successfully added the attribute..

Failures, in addition to the common failures:

`subcode`	Cause
`CGuid missing`	With `submessage` `ListAttributes failure.`: `CGuid` was missing or not hex.
`User does not have permission to add attributes for this organization.`	The caller lacks Write.
`Name is missing.`	`Name` was missing.
`CardType is missing.`	`CardType` was missing.
`Type is missing.`	`Type` was missing.
`OrgID, SystemID or ServerID must be set.`	None of the three was sent.

DeleteAttribute

Deletes an attribute definition.

POST https://api.moleant.com/discover/DeleteAttribute/

v2 route: DELETE /v2/organizations/{CGuid}/attributes/{AttributeGuid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Hex, max 100.
`AttributeGuid`	Yes	The attribute.	Hex, max 100.
`OrgID, SystemID, ServerID, Name`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/DeleteAttribute/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","AttributeGuid":"4be1..."}

Response

A status message. On success the subcode is Successfully deleted the attribute..

Failures, in addition to the common failures:

`subcode`	Cause
`CGuid missing`	With `submessage` `DeleteAttributes failure.`
`AttributeGuid is missing.`	`AttributeGuid` was missing or not hex.
`User does not have permission to delete attributes for this organization.`	The caller lacks Write.
`This attribute does not exist.`	No attribute has that GUID.

ListAttributes

Lists the attribute values set on one card, followed by the organization's other attributes of that card type with empty values, so the result can drive an edit form. Without a card it lists every attribute definition of every organization the caller may read, each with its Organization and CGUID.

POST https://api.moleant.com/discover/ListAttributes/

v2 route: GET /v2/organizations/{CGuid}/attributes — documentation.

A card (OrgID, SystemID or ServerID) is read from the organization in CGuid only: system and asset ids are unique within an organization, not across organizations.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Hex, max 100.
`OrgID`	No	Organization card to read. Takes precedence over `SystemID` and `ServerID`.	Hex, max 100.
`SystemID`	No	System card to read.	Digits, max 10.
`ServerID`	No	Asset card to read.	Digits, max 10.
`AttributeGuid`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/ListAttributes/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12"}

Response

An Attributes array.

Attribute	Description	Example
`Attributes[].Name`	Attribute name.	Cost centre
`Attributes[].ID`	Id of the value row, as a string; empty for an attribute without a value.	31
`Attributes[].ItemValue`	The value; empty when unset.	4410
`Attributes[].HRLocation`	Human-readable kind and place, e.g. `A single row in a system`; empty when unset.	A single row in a system
`Attributes[].AttributeGuid`	Attribute GUID.	4be1...
`Attributes[].Type`	`0` row or `1` block. A number.	0
`Attributes[].CardType`	`0` organization, `1` system, `2` asset. A number.	1
`Attributes[].Organization`	Name of the organization the attribute came from.	Contoso AB
`Attributes[].CGUID`	GUID of the organization the attribute belongs to: the `CGuid` to use when changing or deleting it.	7a8b26724e508ade

Example response

{"Attributes":[
  {"Name":"Cost centre","ID":"31","ItemValue":"4410","HRLocation":"A single row in a system",
   "AttributeGuid":"4be1...","Type":0,"CardType":1,"Organization":"Contoso AB","CGUID":"7a8b26724e508ade"},
  {"Name":"Owner","ID":"","HRLocation":"","ItemValue":"","Type":0,"CardType":1,
   "AttributeGuid":"8c02...","Organization":"Contoso AB","CGUID":"7a8b26724e508ade"}
]}

An organization without attributes answers HTTP 200 with the placeholder {"Attributes":["No attributes were found"]}.

Failures, in addition to the common failures:

`subcode`	Cause
`User does not have permission to list attributes for this organization.`	The caller lacks Read.

Changes in this version: A card (OrgID, SystemID or ServerID) is read from the organization in CGuid only; earlier versions of this release mixed in the values and attributes that other organizations of the caller hold for the same id, and those could not be saved. Without a card, the attributes of every organization the caller may read are returned, each with Organization and CGUID. An empty result is HTTP 200 with a placeholder, no longer the failure No attributes were found.

ModifyAttribute

Changes the name of an attribute definition.

POST https://api.moleant.com/discover/ModifyAttribute/

v2 route: PUT PATCH /v2/organizations/{CGuid}/attributes/{AttributeGuid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Hex, max 100.
`AttributeGuid`	Yes	The attribute.	Hex, max 100.
`Name`	Yes	New name.	Text, max 5000.
`OrgID`	Yes	Required by the validation, otherwise unused.	Hex, max 100.
`SystemID, ServerID`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/ModifyAttribute/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","OrgID":"7a8b26724e508ade","AttributeGuid":"4be1...","Name":"Cost center"}

Response

A status message. On success the subcode is Successfully modified the attribute..

Failures, in addition to the common failures:

`subcode`	Cause
`CGuid missing`	With `submessage` `Modifyattributes failure.`
`OrgID is missing.`	`OrgID` was missing.
`AttributeGuid is missing.`	`AttributeGuid` was missing.
`Name is missing.`	`Name` was missing.
`User does not have permission to modify attributes for this organization.`	The caller lacks Write.
`This attribute does not exist.`	No attribute has that GUID.

ModifyAttributeValue

Sets the value of an attribute on one organization, system or asset card, creating the value row the first time.

POST https://api.moleant.com/discover/ModifyAttributeValue/

v2 route: PUT PATCH /v2/organizations/{CGuid}/attributes/{AttributeGuid}/value — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Hex, max 100.
`AttributeGuid`	Yes	The attribute.	Hex, max 100.
`ItemValue`	Yes	The value.	Text, max 5000.
`OrgID, SystemID, ServerID`	One of them	The card to set it on.	OrgID: Hex, max 100. The ids: Digits, max 5.
`Name`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/ModifyAttributeValue/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","AttributeGuid":"4be1...","ItemValue":"4410"}

Response

A status message. On success the subcode is Successfully edited the tag. when a value is replaced, and New value added to tag. when the first value is set.

Failures, in addition to the common failures:

`subcode`	Cause
`CGuid missing`	With `submessage` `ListAttributes failure.`
`OrgID, SystemID or ServerID is missing.`	No card was named.
`AttributeGuid is missing.`	`AttributeGuid` was missing.
`User does not have permission to modify attributes for this organization.`	The caller lacks Write.
`This attribute does not exist.`	No attribute has that GUID.
`This systemid, serverid or orgid does not exist`	The named card does not exist.

Knowledge Base

Files attached to assets, and the image carousel shown on cards. Organization and system files have their own endpoints under Organizations and Systems; every attachment is downloaded with downloadkb.

Endpoint	Purpose	Credential	Permission
`/discover/listkbs/`	List an asset's files.	User token	Read
`/discover/downloadkb/`	Download an attached file.	User token	Read
`/discover/uploadkb/`	Attach a file to an asset.	User token	Write
`/discover/PopulateKBCarousel/`	Fetch recent images for a card.	User token	Read

listkbs

Lists the files attached to an asset.

POST https://api.moleant.com/discover/listkbs/

v2 route: GET /v2/organizations/{CGuid}/assets/{ServerID}/kbs — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`ServerID`	Yes	Numeric asset id.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/listkbs/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","ServerID":"38"}

Response

A Files array.

Attribute	Description	Example
`Files[].FileName`	Original file name.	network-diagram.pdf
`Files[].Icon`	Icon name for the file type.	pdf.svg
`Files[].Description`	Description, HTML-entity encoded. An empty string, never `null`, when the file has none.	Rack layout
`Files[].RandomNo`	Storage id of the file. Pass it to downloadkb.	3c1f9e0a7b...
`Files[].guid`	Attachment GUID. Pass it to the matching Modify and Delete calls.	9d2e41ab...
`Files[].FileLength`	Size in bytes. A number.	48213

Example response

{"Files":[
  {"FileName":"warranty.pdf","Icon":"pdf.svg","Description":"Warranty certificate",
   "RandomNo":"3c1f9e0a7b...","guid":"9d2e41ab...","FileLength":48213}
]}

Empty result: HTTP 200 with {"Files":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Server ID missing or invalid.`	`ServerID` was missing or not numeric.
`User does not have permission to download the kb-list.`	The caller lacks Read.

downloadkb

Streams an attached file — of an organization, a system or an asset — from blob storage.

POST https://api.moleant.com/discover/downloadkb/

v2 route: GET /v2/organizations/{CGuid}/files/{RandomNo} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`RandomNo`	Yes	Storage id of the file, `Files[].RandomNo` from a listing.	Hex, max 40.

Example request

POST https://api.moleant.com/discover/downloadkb/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","RandomNo":"3c1f9e0a7b..."}

Response

On success the body is the file's raw bytes, not JSON. The response still declares Content-Type: application/json and carries no file name, so save the body under the FileName from the listing. Failures are status messages.

An unknown RandomNo is not detected: the body is then blob storage's XML error document, at HTTP 200.

Failures, in addition to the common failures:

`subcode`	Cause
`File identifier is missing or invalid.`	`RandomNo` was missing or not hex.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to download from this customer.`	The caller lacks Read.
`Transport error contacting blob storage.`	Blob storage could not be reached; `submessage` has the transport error.

Changes in this version: The file must belong to the caller's organization, and it is served with its stored MIME type and a Content-Disposition file name.

uploadkb

Uploads a file and attaches it to an asset.

POST https://api.moleant.com/discover/uploadkb/

v2 route: POST /v2/organizations/{CGuid}/assets/{ServerID}/kbs — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`ServerID`	Yes	Numeric asset id.	Digits, max 10.
`Filename`	Yes	File name, used for display and to pick the file type.	File name, max 241. The extension must be an allowed upload type.
`Description`	No	Description of the file.	Text, max 4096.
`FileData`	Yes	The file content, Base64-encoded.	Base64, max 16,777,216 characters.

Example request

POST https://api.moleant.com/discover/uploadkb/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","ServerID":"38","Filename":"warranty.pdf","Description":"Warranty certificate","FileData":"JVBERi0xLjcK..."}

Response

A status message. On success the subcode is Upload was successful..

Failures, in addition to the common failures:

`subcode`	Cause
`Filename missing or invalid.`	`Filename` was missing or contained a forbidden character.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Submitted file is too large, invalid or missing.`	`FileData` was missing, too long or not Base64.
`Submitted serverid is too large, invalid or missing.`	`ServerID` was missing or not numeric.
`Extension is not allowed for upload.`	The file type is not on the allowed list.
`User does not have permission to upload to this customer.`	The caller lacks Write.
`Failed to upload file.`	Blob storage or the file record failed.
`2Failed to upload file.`	The file could not be linked to the asset (sic).

PopulateKBCarousel

Returns up to five of the most recently uploaded images (.jpg, .jpeg, .png, .gif) attached to a system, an asset or the organization, with their content inline.

POST https://api.moleant.com/discover/PopulateKBCarousel/

v2 route: GET /v2/organizations/{CGuid}/kbs/images · GET /v2/organizations/{CGuid}/systems/{SystemID}/kbs/images · GET /v2/organizations/{CGuid}/assets/{ServerID}/kbs/images — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	No	Return the system's images. Takes precedence over `ServerID`.	Digits, max 10.
`ServerID`	No	Return the asset's images.	Digits, max 10.

With neither id the organization's images are returned.

Example request

POST https://api.moleant.com/discover/PopulateKBCarousel/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","ServerID":"38"}

Response

A Files array, newest first.

Attribute	Description	Example
`Files[].FileName`	Original file name.	rack-front.jpg
`Files[].Description`	Description, HTML-entity encoded. An empty string, never `null`, when the file has none.	Front of rack A
`Files[].RandomNo`	Storage id of the file.	3c1f9e0a7b...
`Files[].FileData`	The image, Base64-encoded.	/9j/4AAQSkZJRgABAQ...
`Files[].FileLength`	Size in bytes. A number.	284113

Example response

{"Files":[{"FileName":"rack-front.jpg","Description":"Front of rack A","RandomNo":"3c1f9e0a7b...",
  "FileData":"/9j/4AAQSkZJRgABAQ...","FileLength":284113}]}

Empty result: HTTP 200 with {"Files":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`User does not have permission to get imagedata from this customer.`	The caller lacks Read.

Security, SBOM & VEX

Software bills of materials (SBOM) and vulnerability exploitability exchange (VEX) data are kept per system, together with the sign-in ticket the web app builds its menus from.

Endpoint	Purpose	Credential	Permission
`/discover/ListSbom/`	Read a system's SBOM.	User token or API key	Read
`/discover/UploadSBOM/`	Upload a CycloneDX XML SBOM.	User token	Write
`/discover/ListVex/`	Read a system's VEX document.	User token or API key	Read
`/discover/DownloadVex/`	Download a system's VEX document as a file.	User token	Read
`/discover/UploadVEX/`	Upload a CycloneDX or OpenVEX document.	User token	Write
`/discover/ModifyVex/`	Record an analysis of one vulnerability.	User token or API key	Write
`/discover/SecBuildTicket/`	Get the signed-in user's roles.	User token	—

ListSbom

Returns the SBOM documents recorded for a system and the components they declare. This handler also serves v2 sbom.

POST https://api.moleant.com/discover/ListSbom/

v2 route: GET /v2/organizations/{CGuid}/systems/{SystemID}/sbom — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token, or an organization API key.	A key also decides the organization; see Authentication.
`CGuid`	Conditional	Organization GUID. Required with a user token; ignored with a key.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`Filename, Description`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/ListSbom/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12"}

Response

Two arrays.

Attribute	Description	Example
`SBOM[].Name`	Name of the SBOM document.	Acme Product
`SBOM[].Version`	Document version. Capitalised `V`.	2.4.0
`SBOMFiles[].Name`	Component name.	openssl
`SBOMFiles[].version`	Component version. Lower-case `v`.	3.0.13
`SBOMFiles[].Purl`	Package URL of the component.	pkg:generic/openssl@3.0.13

Example response

{"SBOM":[{"Version":"2.4.0","Name":"Acme Product"}],
 "SBOMFiles":[{"version":"3.0.13","Name":"openssl","Purl":"pkg:generic/openssl@3.0.13"}]}

A system without an SBOM answers HTTP 200 with the placeholder {"SBOM":["This system does not have any SBOM data uploaded."],"SBOMFiles":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`User's CGud is invalid or empty.`	`CGuid` was missing or malformed (user token only).
`User does not have permission to list SBOM for this customer.`	The caller lacks Read.

Changes in this version: A system without an SBOM answers HTTP 200 with a placeholder; it was a failure at HTTP 400.

UploadSBOM

Uploads a CycloneDX SBOM in XML. The system's component list is replaced by the file's components, the document is added to its SBOM list, and the file is stored as a system attachment.

POST https://api.moleant.com/discover/UploadSBOM/

v2 route: PUT /v2/organizations/{CGuid}/systems/{SystemID}/sbom — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`Filename`	Yes	File name; the extension must be an allowed upload type.	File name, max 241.
`Description`	No	Description of the attachment.	Text, max 4096.
`FileData`	Yes	The XML document, Base64-encoded.	Base64, max 16,777,216 characters.

Example request

POST https://api.moleant.com/discover/UploadSBOM/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","Filename":"acme-sbom.xml","FileData":"PD94bWwgdmVyc2lvbj0iMS4wIj8+..."}

Response

A status message. On success the subcode is Upload was successful..

Failures, in addition to the common failures:

`subcode`	Cause
`Filename missing or invalid.`	`Filename` was missing or contained a forbidden character.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Submitted file is too large, invalid or missing.`	`FileData` was missing, too long or not Base64.
`Submitted SystemID is too large, invalid or missing.`	`SystemID` was missing or not numeric.
`Extension is not allowed for upload.`	The file type is not on the allowed list.
`User does not have permission to upload to this customer.`	The caller lacks Write.
`The uploaded SBOM file is not valid XML.`	The decoded file did not parse as XML.
`Failed to upload file.`	Blob storage or the database write failed.
`An unexpected error occurred while processing this request.`	Any other error.

ListVex

Returns the system's VEX data as a CycloneDX-style document. This handler also serves v2 vex, where every field is described; DownloadVex returns the same document as a file.

POST https://api.moleant.com/discover/ListVex/

v2 route: GET /v2/organizations/{CGuid}/systems/{SystemID}/vex — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token, or an organization API key.	A key also decides the organization; see Authentication.
`CGuid`	Conditional	Organization GUID. Required with a user token; ignored with a key.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`Filename, Description`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/ListVex/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12"}

Response

The document. version and ratings[].score are numbers; a missing score or justification is null.

Attribute	Description	Example
`bomFormat, specVersion, version`	Document header.	CycloneDX, 1.4, 1
`metadata.timestamp, metadata.component.{name, version, type, bom-ref}`	The subject component.	Acme Product
`vulnerabilities[]`	`id`, `source{name, url}`, `comments[]{cve, comment, created_at}`, `ratings[]{source, score, severity, method, vector}`, `analysis{state, justification, response[], detail}`, `affects[]{ref}`.

Example response

{
  "bomFormat":"CycloneDX","specVersion":"1.4","version":1,
  "metadata":{"timestamp":"2026-01-13T00:00:00Z",
    "component":{"name":"Acme Product","version":"2.4.0","type":"application","bom-ref":"acme-product"}},
  "vulnerabilities":[
    {"id":"CVE-2025-12345",
     "source":{"name":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12345"},
     "comments":[{"cve":"CVE-2025-12345","comment":"Reviewed 2026-02-01","created_at":"2026-02-01 10:02:11"}],
     "ratings":[{"source":{"name":"NVD","url":"https://nvd.nist.gov/"},"score":7.5,"severity":"high",
                 "method":"CVSSv31","vector":"AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],
     "analysis":{"state":"not_affected","justification":"code_not_reachable",
                 "response":["will_not_fix"],"detail":"Component ships disabled."},
     "affects":[{"ref":"acme-product"}]}
  ]
}

A system without VEX data answers HTTP 200 with the placeholder {"vulnerabilities":["This system does not have any VEX data uploaded."]}: check the type of the first element, as with every list.

Failures, in addition to the common failures:

`subcode`	Cause
`User's CGud is invalid or empty.`	`CGuid` was missing or malformed (user token only).
`User does not have permission to list SBOM for this customer.`	The caller lacks Read.

Changes in this version: The document is assembled from one query per table instead of one per vulnerability. A system without VEX data answers HTTP 200 with a placeholder; it was a failure at HTTP 400.

DownloadVex

Returns the same document as ListVex, as a file download.

POST https://api.moleant.com/discover/DownloadVex/

v2 route: GET /v2/organizations/{CGuid}/systems/{SystemID}/vex/download — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/DownloadVex/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12"}

Response

On success the body is the VEX document, exactly as ListVex returns it, with these headers:

Content-Type: application/json
Content-Disposition: attachment; filename="vex_data_<CGuid>_<SystemID>_<YYYY-MM-DD_HH-MM-SS>.json"
Cache-Control: no-cache, must-revalidate

Failures are status messages.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to download from this customer.`	The caller lacks Read.
`This system does not have any VEX data uploaded.`	No VEX data for the system. Answered with HTTP 404.

Changes in this version: A system without VEX data answers HTTP 404 instead of 400.

UploadVEX

Uploads a VEX document in JSON, either CycloneDX (bomFormat CycloneDX, spec 1.4 or later) or OpenVEX (an @context on openvex.dev). Its metadata, vulnerabilities, ratings, responses and affected components become the system's VEX data, and the file is stored as a system attachment.

POST https://api.moleant.com/discover/UploadVEX/

v2 route: PUT /v2/organizations/{CGuid}/systems/{SystemID}/vex — documentation.

An upload replaces all of the system's VEX data, analyst comments included, and the old data is deleted before the new file is validated. A rejected file therefore leaves the system with no VEX data at all.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`Filename`	Yes	File name; the extension must be an allowed upload type.	File name, max 241.
`Description`	No	Description of the attachment.	Text, max 4096.
`FileData`	Yes	The JSON document, Base64-encoded.	Base64, max 16,777,216 characters.

Example request

POST https://api.moleant.com/discover/UploadVEX/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","Filename":"acme-vex.json","FileData":"eyJib21Gb3JtYXQiOiJDeWNsb25lRFgiLC..."}

Response

A status message. On success the subcode is Upload was successful..

Failures, in addition to the common failures:

`subcode`	Cause
`Filename missing or invalid.`	`Filename` was missing or contained a forbidden character.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Submitted file is too large, invalid or missing.`	`FileData` was missing, too long or not Base64.
`Submitted SystemID is too large, invalid or missing.`	`SystemID` was missing or not numeric.
`Extension is not allowed for upload.`	The file type is not on the allowed list.
`User does not have permission to upload to this customer.`	The caller lacks Write.
`The uploaded VEX/SBOM file is not valid JSON.`	The decoded file did not parse as JSON.
`The uploaded VEX/SBOM file is invalid: reason`	The document failed validation, e.g. `Missing required CycloneDX field: specVersion`.
`Failed to remove data from table`	The previous VEX data could not be deleted.
`Failed to upload file.`	Blob storage or the database write failed.
`An unexpected error occurred while processing this request.`	Any other error.

ModifyVex

Updates the analysis of one vulnerability in a system's VEX data, and can add an analyst comment. Only the fields you send are changed.

POST https://api.moleant.com/discover/ModifyVex/

v2 route: PUT PATCH /v2/organizations/{CGuid}/systems/{SystemID}/vex/{id} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token, or an organization API key.	A key also decides the organization; see Authentication.
`CGuid`	Yes	Organization GUID. Ignored with a key.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`id`	Yes	The vulnerability id, e.g. a CVE.	Text, max 20.
`State`	No	New analysis state.	Text, max 30.
`Justification`	No	New justification. Also accepted as `justification`.	Text, max 30.
`Response`	No	A response or an array of responses; replaces all existing responses. Also accepted as `responses`.	Text, max 30 each.
`Detail`	No	New analysis detail. Also accepted as `detail`.	Text, max 4096.
`Comment`	No	A comment to append to the vulnerability's comments. Also accepted as `comments`.	Text, max 4096.
`Filename, Description`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/ModifyVex/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","id":"CVE-2025-12345","State":"not_affected","Justification":"code_not_reachable","Response":["will_not_fix"],"Comment":"Reviewed by the platform team"}

Response

A status message. On success the subcode is VEX entry updated successfully..

Failures, in addition to the common failures:

`subcode`	Cause
`User's CGud is invalid or empty.`	`CGuid` was missing or malformed (user token only).
`User does not have permission to modify VEX for this customer.`	The caller lacks Write.
`Vulnerability ID is invalid or empty.`	`id` was missing.
`Submitted SystemID is too large, invalid or missing.`	`SystemID` was missing or not numeric.
`No matching vulnerability found for this system.`	The system has no vulnerability with that id.

Changes in this version: The lowercase field names justification, responses, detail and comments are accepted as aliases. A comment that repeats the vulnerability's latest comment word for word is not added again.

SecBuildTicket

Returns the caller's organizations with their permission flags and plan roles. The web app calls it after sign-in. On a user's first sign-in after an invitation it also binds the account to the user's object id and grants Read.

POST https://api.moleant.com/discover/SecBuildTicket/

v2 route: GET /v2/me — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.

Example request

POST https://api.moleant.com/discover/SecBuildTicket/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…"}

Response

An object with a Roles array and a GlobalRoles object. The response carries no status, so the submessage the handler sets is not sent.

Attribute	Description	Example
`Roles[].guid`	Organization GUID.	7a8b26724e508ade
`Roles[].roles`	The caller's permission flags in it.	11100000000000000000000000000000
`Roles[].CustomerName`	Organization name.	Contoso AB
`Roles[].Plan`	The plan that owns the organization.	f17f35b5...
`Roles[].isDiscoverAdmin, Roles[].isCoAdmin`	`"1"` or `"0"`: whether the caller owns or co-administers a plan. Strings.	1
`Roles[].ADDomains`	Array of the organization's AD domain names.	["corp.example.com"]
`GlobalRoles.CreationEmail`	E-mail the account was created with.	grace@contoso.com
`GlobalRoles.Email`	Current e-mail.	grace@contoso.com
`GlobalRoles.isDiscoverAdmin, GlobalRoles.isCoAdmin`	`"1"` or `"0"`. Strings.	1

Example response

{"Roles":[
  {"guid":"7a8b26724e508ade","roles":"11100000000000000000000000000000","CustomerName":"Contoso AB",
   "Plan":"f17f35b5...","isDiscoverAdmin":"1","isCoAdmin":"0","ADDomains":["corp.example.com"]}
],
 "GlobalRoles":{"CreationEmail":"grace@contoso.com","Email":"grace@contoso.com","isDiscoverAdmin":"1","isCoAdmin":"0"}}

Failures, in addition to the common failures:

`subcode`	Cause
`email: You have not been added to the MoleAnt Discover system. Please contact your system administrator`	No user record has the user token's e-mail address.

Changes in this version: Unchanged output; the route is GET /v2/me.

Logs & Events

Each organization keeps one master log. Entries belong to a system or an asset; Moleant Discover writes System Event entries itself, and users add their own. ListSystemLogTypes lists the log types.

Endpoint	Purpose	Credential	Permission
`/discover/AddLogEntry/`	Add a log entry to a system or asset.	User token	Write
`/discover/DeleteLogEntry/`	Delete a log entry.	User token	Write
`/discover/ListLogEntries/`	List log entries.	User token or API key	Read
`/discover/ModifyLogEntry/`	Change a log entry.	User token	Write
`/discover/ListMasterLogEntries/`	Read the master log across organizations.	User token	Any role (per organization)

AddLogEntry

Writes a user log entry for a system or an asset. The entry's date and time are taken from LogEpoch.

POST https://api.moleant.com/discover/AddLogEntry/

v2 route: POST /v2/organizations/{CGuid}/logs · POST /v2/organizations/{CGuid}/systems/{SystemID}/logs · POST /v2/organizations/{CGuid}/assets/{ServerID}/logs — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Conditional	The system. At least one of `SystemID` and `ServerID` is required; send both and two entries are written, one for each.	Digits, max 10.
`ServerID`	Conditional	The asset.	Digits, max 10.
`LogType`	Yes	Log type code from ListSystemLogTypes.	Digits, max 3.
`LogDescription`	Yes	The entry text.	Text, max 255.
`LogAuthor`	Yes	Author shown on the entry.	Text, max 255.
`LogEpoch`	Yes	When it happened, as a Unix timestamp in seconds.	Digits, max 30.
`Logdate, Logtime`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/AddLogEntry/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","LogType":"4","LogDescription":"Patched to 2.4.1","LogAuthor":"alovelace","LogEpoch":"1786976527"}

Response

A status message. On success the subcode is Successfully added the log entry..

Failures, in addition to the common failures:

`subcode`	Cause
`Logtype invalid or empty.`	`LogType` was missing or not numeric.
`LogDescription invalid or empty.`	`LogDescription` was missing.
`LogAuthor invalid or empty.`	`LogAuthor` was missing.
`LogEpoch invalid or empty.`	`LogEpoch` was missing or not numeric.
`User does not have permission to add log data for this customer.`	The caller lacks Write.
`Failed to add entry. SystemID and ServerID both missing.`	Neither id was sent.
`System does not exist and logs cannot be added.`	No system has that id.
`Server does not exist and logs cannot be added.`	No asset has that id.

DeleteLogEntry

Deletes one log entry.

POST https://api.moleant.com/discover/DeleteLogEntry/

v2 route: DELETE /v2/organizations/{CGuid}/logs/{guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`guid`	Yes	Entry GUID, `SystemLogs[].guid`.	Hex, max 250.

Example request

POST https://api.moleant.com/discover/DeleteLogEntry/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","guid":"b13f..."}

Response

A status message. On success the subcode is Successfully deleted Logentry (no full stop).

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to delete system kb for this customer.`	The caller lacks Write (sic).
`Failed to delete Logentry.`	The delete failed.

ListLogEntries

Lists the log entries of a system, an asset, some log classes, or the whole organization, newest first. This handler also serves v2 systemlog.

POST https://api.moleant.com/discover/ListLogEntries/

v2 route: GET /v2/organizations/{CGuid}/logs · GET /v2/organizations/{CGuid}/systems/{SystemID}/logs · GET /v2/organizations/{CGuid}/assets/{ServerID}/logs — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token, or an organization API key.	A key also decides the organization; see Authentication.
`CGuid`	Yes	Organization GUID. Ignored with a key.	Alphanumeric, max 50.
`SystemID`	No	Entries of this system, without routine check-in entries.	Digits, max 10.
`ServerID`	No	Entries of this asset, without routine check-in entries.	Digits, max 10.
`Filter`	No	Array of `LogClass` values; returns entries of those classes and overrides the ids.	Array, Text, max 50 each.

Example request

POST https://api.moleant.com/discover/ListLogEntries/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","Filter":["System Event"]}

Response

A SystemLogs array.

Attribute	Description	Example
`SystemLogs[].LogDescription`	Display name of the log type.	Configuration change
`SystemLogs[].LogType`	Log type code.	4
`SystemLogs[].LogAuthor`	Who or what wrote the entry.	alovelace
`SystemLogs[].Logdate / Logtime`	Entry date and time. Note the lower-case `d` and `t`.	2026-08-18 / 14:22:07
`SystemLogs[].guid`	Entry GUID. Pass it to ModifyLogEntry and DeleteLogEntry.	b13f...
`SystemLogs[].Severity`	Severity.	Information
`SystemLogs[].EntityName`	Name of the entity the entry concerns.	Payroll
`SystemLogs[].ObjectPrincipal`	Principal associated with the object.	alovelace@contoso.com
`SystemLogs[].LogClass, SystemID, ServerID`	Present only when neither `SystemID` nor `ServerID` was sent. The ids are numbers, `0` when not applicable.	System Event, 12, 0
`SystemLogs[].ItemClass`	Item classification.	Admin
`SystemLogs[].Description`	The entry text.	Environment changed to Production

Example response

{"SystemLogs":[
  {"LogDescription":"Configuration change","LogType":4,"LogAuthor":"alovelace",
   "Logdate":"2026-08-18","Logtime":"14:22:07","guid":"b13f...","Severity":"Information",
   "EntityName":"Payroll","ObjectPrincipal":"alovelace@contoso.com","LogClass":"System Event",
   "SystemID":12,"ServerID":0,"ItemClass":"Admin","Description":"Environment changed to Production"}
]}

Empty result: HTTP 200 with {"SystemLogs":["No logs were found for this system."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Organisation ID invalid or empty.`	`CGuid` was missing or malformed.
`Filter definitions are malformed.`	`Filter` was not an array.
`You have selected too many LogClass entries for this query.`	`Filter` had too many values.

Changes in this version: Read permission on the organization is required; earlier versions did not check it.

ModifyLogEntry

Rewrites a log entry. All fields are required.

POST https://api.moleant.com/discover/ModifyLogEntry/

v2 route: PUT PATCH /v2/organizations/{CGuid}/logs/{guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`guid`	Yes	Entry GUID.	Hex, max 40.
`SystemID`	Conditional	The system. One of `SystemID` and `ServerID` is required.	Digits, max 10.
`ServerID`	Conditional	The asset.	Digits, max 10.
`LogType`	Yes	Log type code.	Digits, max 3.
`LogDescription`	Yes	The entry text.	Text, max 255.
`LogAuthor`	Yes	Author.	Text, max 255.
`Logdate`	Yes	Date.	Date, max 30.
`Logtime`	Yes	Time.	Text, max 30.

Example request

POST https://api.moleant.com/discover/ModifyLogEntry/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","guid":"b13f...","SystemID":"12","LogType":"4","LogDescription":"Patched to 2.4.2","LogAuthor":"alovelace","Logdate":"2026-08-18","Logtime":"14:22:07"}

Response

A status message. On success the subcode is Successfully modified the log entry..

Failures, in addition to the common failures:

`subcode`	Cause
`Logtype invalid or empty.`	`LogType` was missing.
`LogDescription invalid or empty.`	`LogDescription` was missing.
`LogAuthor invalid or empty.`	`LogAuthor` was missing.
`Logdate invalid or empty.`	`Logdate` was missing or not a date.
`LogTime invalid or empty.`	`Logtime` was missing.
`Guid invalid or empty.`	`guid` was missing or not hex.
`User does not have permission to modfify log data for this customer.`	The caller lacks Write (sic).
`Failed to modify entry. SystemID and ServerID both missing.`	Neither id was sent.
`Failed to modify entry. The entry does not exist.`	No entry has that GUID.
`Technical problems prevented this operation from succeeding.`	The write failed.

Changes in this version: An entry keeps its LogClass (System for system entries); earlier versions set it to Server.

ListMasterLogEntries

Returns the 250 most recent master-log entries of every organization the caller has a role in (or of one, with CGuid), merged and sorted newest first. This handler also serves v2 orglog, where every field is described; called with an API key it returns {"MasterLogs":[]}.

POST https://api.moleant.com/discover/ListMasterLogEntries/

v2 route: GET /v2/masterlog · GET /v2/organizations/{CGuid}/masterlog — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	No	Narrow to one organization.	Alphanumeric, max 50.
`FilterAdmin`	No	`"1"`: only entries with `ItemClass` `Admin`.	Digits, max 2.
`FilterAuth`	No	`"1"`: leave out entries with `ItemClass` `Auth`. Overrides `FilterAdmin`.	Digits, max 2.
`SystemID, ServerID`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/ListMasterLogEntries/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","FilterAuth":"1"}

Response

A MasterLogs array.

Attribute	Description	Example
`MasterLogs[].LogDate / LogTime / LastEpoch`	When; `LastEpoch` is the Unix time and the sort key. A number.	2026-08-18 / 14:22:07 / 1786976527
`MasterLogs[].id, LogID, LogAuthorID, ServerID, SystemID`	Numbers.	91204, 4471, 0, 38, 0
`MasterLogs[].LogDescription, LogName, LogType, LogAuthor, LogClass, ItemClass, Severity, EntityName, PrincipalName, PrincipalID, ObjectPrincipal, guid`	As in v2 orglog. `PrincipalID` is usually the acting user's object GUID.
`MasterLogs[].CustomerName`	Organization the entry came from.	Contoso AB
`MasterLogs[].CGuid`	GUID of the organization the entry came from.

Example response

{"MasterLogs":[
  {"LogDate":"2026-08-18","LogTime":"14:22:07","LastEpoch":1786976527,"id":91204,"LogID":4471,
   "LogDescription":"Environment changed to Production","LogAuthor":"alovelace","LogType":4,
   "LogName":"Configuration change","ServerID":38,"guid":"b13f...","LogClass":"System Event",
   "SystemID":0,"LogAuthorID":0,"Severity":"Information","EntityName":"SRV-FILE01",
   "PrincipalName":"alovelace@contoso.com","PrincipalID":"74c78695-356f-4b00-8b62-bc4e166c37b2",
   "CGuid":"7a8b26724e508ade","CustomerName":"Contoso AB","ObjectPrincipal":"SRV-FILE01","ItemClass":"Admin"}
]}

Empty result: HTTP 200 with {"MasterLogs":[]}.

Failures are the common failures only.

Microsoft 365

A Microsoft 365 system represents a tenant. Moleant Discover reads the tenant's users, domains and licence subscriptions through Microsoft Graph with an app registration that the customer creates in their own tenant.

Endpoint	Purpose	Credential	Permission
`/discover/AddM365App/`	Connect a Microsoft 365 tenant.	User token	Write
`/discover/ListM365Licenses/`	Read a tenant's licence data.	User token	Read
`/discover/Populatem365Licenses/`	Fetch fresh licence data from Microsoft Graph.	None (app secret)	—

AddM365App

Checks the app registration by requesting a Graph token with it, then creates a Microsoft 365 system named after the tenant, stores the app's settings and logs the event.

POST https://api.moleant.com/discover/AddM365App/

v2 route: POST /v2/organizations/{CGuid}/m365 — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Hex, max 100.
`TenantName`	Yes	Name for the tenant; becomes the system name.	Plain text, max 450.
`TenantID`	Yes	Directory (tenant) id.	GUID, max 300.
`AppID`	Yes	Application (client) id of the app registration.	GUID, max 100.
`ClientSecret`	Yes	Client secret of the app registration.	Tolerant text, max 300.

Example request

POST https://api.moleant.com/discover/AddM365App/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","TenantName":"Contoso Tenant","TenantID":"72f988bf-86f1-41af-91ab-2d7cd011db47","AppID":"0f3c8a2d-5b6e-4c1f-9a7d-8e2b1c4d5f60","ClientSecret":"Vn8Q~..."}

Response

A status message. On success the subcode is Successfully created the Microsoft 365 system..

Failures, in addition to the common failures:

`subcode`	Cause
`User does not have permission to add appss for this organization.`	The caller lacks Write (sic).
`Either of ClientSecret, AppID, TenantID or TenantName are missing.`	A field was missing. `submessage`: `AddM365App failure.`
`CGuid missing`	`CGuid` was missing. `submessage`: `AddM365App failure.`
`CGuid incorrect`	`CGuid` was malformed. `submessage`: `AddM365App failure.`
`ClientSecret wrong.`	Microsoft refused the credentials.
`System could not be created.`	The write failed.

Changes in this version: The client secret is validated against Microsoft Entra but no longer stored; Populatem365Licenses takes it with every call. The new SystemID is returned.

ListM365Licenses

Returns the stored tenant summary, licence subscriptions and a sample of user licences of a Microsoft 365 system, as last fetched by Populatem365Licenses.

POST https://api.moleant.com/discover/ListM365Licenses/

v2 route: GET /v2/organizations/{CGuid}/systems/{SystemID}/m365 — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	The Microsoft 365 system.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/ListM365Licenses/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"19"}

Response

An object with three arrays.

Attribute	Description	Example
`AzureGeneralStats[].NumberOfUsers`	Users in the tenant. A number.	287
`AzureGeneralStats[].TenantName`	Tenant name.	Contoso Tenant
`AzureGeneralStats[].NumberOfGAs`	Always `0` today. A number.	0
`AzureGeneralStats[].LastSync`	Unix time of the last fetch.	1786954442
`AzureGeneralStats[].LastSyncHR`	The same time as `Y-m-d h:i:s` — a 12-hour clock without AM/PM.	2026-08-18 08:14:02
`AzureGeneralStats[].AcceptedMailDomains`	Comma-separated verified domains.	contoso.com,contoso.se
`AzureTenantLicenses[]`	One per enabled subscription: `capabilityStatus`, `consumedUnits`, `enabled`, `suspended`, `warning` (numbers), `id`, `skuId`, `skuPartNumber`, `appliesTo`.
`AzureUserLicenses[]`	The first ten user-licence assignments: `CGuid`, `UserGuid`, `LicenseGuid`, `LicensName` (sic), `UserName`.

Example response

{"AzureGeneralStats":[{"NumberOfUsers":287,"TenantName":"Contoso Tenant","NumberOfGAs":0,
   "LastSync":"1786954442","LastSyncHR":"2026-08-18 08:14:02","AcceptedMailDomains":"contoso.com,contoso.se"}],
 "AzureTenantLicenses":[{"capabilityStatus":"Enabled","consumedUnits":287,"id":"72f9..._05e9...",
   "enabled":300,"suspended":0,"warning":0,"skuId":"05e9a617-0261-4cee-bb44-138d3ef5d965",
   "skuPartNumber":"SPE_E3","appliesTo":"User"}],
 "AzureUserLicenses":[{"CGuid":"7a8b26724e508ade","UserGuid":"2c7d...","LicenseGuid":"05e9...",
   "LicensName":"SPE_E3","UserName":"ada@contoso.com"}]}

Empty result: HTTP 200 with a placeholder in place of the whole object: {"AzureGeneralStats":["No Azure licensing informationwas found for this system."]} when there is no tenant summary, or {"AzureTenantLicenses":["No Azure licensing informationwas found for this system."]} when there are no enabled subscriptions. Note the missing space in informationwas.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`SystemID missing or invalid.`	`SystemID` was missing or not numeric.
`User does not have permission to list the M365 licenses for this organization.`	The caller lacks Read.

Populatem365Licenses

Fetches the tenant's users, domains and subscriptions from Microsoft Graph and replaces the stored data of the Microsoft 365 system. The request is authorised by the app registration's client secret: it must obtain a Graph token together with the settings stored by AddM365App.

POST https://api.moleant.com/discover/Populatem365Licenses/

v2 route: POST /v2/organizations/{CGuid}/systems/{SystemID}/m365/sync — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token with Write on the organization.	See Authentication.
`CGuid`	Yes	Organization GUID.	Hex, max 100.
`SystemID`	Yes	The Microsoft 365 system.	Digits, max 5.
`ClientSecret`	Yes	Client secret of the app registration.	Tolerant text, max 200.
`jwt`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/Populatem365Licenses/
Content-Type: application/json

{"CGuid":"7a8b26724e508ade","SystemID":"19","ClientSecret":"Vn8Q~..."}

Response

A status message. On success the subcode is Population was successful..

Failures:

`subcode`	Cause
`CGuid is missing.`	`CGuid` was missing or not hex.
`SystemID is missing.`	`SystemID` was missing.
`ClientSecret is missing.`	`ClientSecret` was missing.
`SystemID does not exist.`	The system is not a connected Microsoft 365 system.
`ClientSecret wrong.`	Microsoft refused the credentials.
`Could not retrieve data from Microsoft Graph.`	A Graph request failed; `submessage` has the transport error.
`A database error occurred while processing this request.`	A database statement failed.

Changes in this version: A user token with Write on the organization is required; the operation was unauthenticated before. The tenant's user list is now read completely (all pages), users are counted with the Graph $count query, and licence names come from the tenant's subscribed SKUs where known.

Address Book

People connected to an organization — owners, suppliers, contacts. Address-book entries are what the RACI matrix refers to.

Endpoint	Purpose	Credential	Permission
`/discover/ListAddressBook/`	List the address book.	User token	Read
`/discover/AddAddressBookEntry/`	Add a person.	User token	Write
`/discover/DeleteAddressBookEntry/`	Remove a person.	User token	Write
`/discover/ModifyAddressBookEntry/`	Change a person.	User token	Write

ListAddressBook

Lists every address-book entry of the organization.

POST https://api.moleant.com/discover/ListAddressBook/

v2 route: GET /v2/organizations/{CGuid}/addressbook — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.

Example request

POST https://api.moleant.com/discover/ListAddressBook/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade"}

Response

An AddressBook array.

Attribute	Description	Example
`AddressBook[].id`	Row id. A number.	5
`AddressBook[].GivenName / LastName / Initial`	Name.	Ada / Lovelace / AL
`AddressBook[].Phone / Email`	Contact details.	+46 8 123 45 67 / ada@contoso.com
`AddressBook[].Role / Notes`	Role and notes, HTML-entity encoded.	System owner
`AddressBook[].Guid`	Entry GUID. Used by the Modify and Delete calls and by RACI tasks.	e41f...

Example response

{"AddressBook":[
  {"id":5,"GivenName":"Ada","LastName":"Lovelace","Initial":"AL","Phone":"+46 8 123 45 67",
   "Email":"ada@contoso.com","Role":"System owner","Notes":"","Guid":"e41f..."}
]}

Empty result: HTTP 200 with {"AddressBook":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to list the addressbook for this customer.`	The caller lacks Read.

AddAddressBookEntry

Adds a person to the address book.

POST https://api.moleant.com/discover/AddAddressBookEntry/

v2 route: POST /v2/organizations/{CGuid}/addressbook — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`GivenName`	Yes	Given name.	Text, max 250.
`LastName`	Yes	Surname.	Text, max 250.
`Initial`	No	Initials.	Text, max 250.
`Phone`	No	Phone number.	Text, max 250.
`Email`	No	E-mail address. When sent it must be valid.	E-mail, max 250.
`Role`	No	Role or title.	Text, max 4096.
`Notes`	No	Notes.	Text, max 4096.

Example request

POST https://api.moleant.com/discover/AddAddressBookEntry/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","GivenName":"Ada","LastName":"Lovelace","Email":"ada@contoso.com","Role":"System owner"}

Response

A status message. On success the subcode is Successfully added the person to the AddressBook.. The new Guid is not returned.

Failures, in addition to the common failures:

`subcode`	Cause
`The email-address in the addressbook is not correctly formatted.`	`Email` was not a valid address.
`GivenName invalid or missing.`	`GivenName` was missing.
`LastName invalid or missing.`	`LastName` was missing.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to add a person to the AddressBook for this customer.`	The caller lacks Write.
`Failed to add person to AddressBook.`	The write failed.

DeleteAddressBookEntry

Deletes an address-book entry.

POST https://api.moleant.com/discover/DeleteAddressBookEntry/

v2 route: DELETE /v2/organizations/{CGuid}/addressbook/{Guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`Guid`	Yes	Entry GUID.	Hex, max 250.

Example request

POST https://api.moleant.com/discover/DeleteAddressBookEntry/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","Guid":"e41f..."}

Response

A status message. On success the subcode is Addressbookentry was successfully deleted..

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`Guid is missing or invalid.`	`Guid` was missing or not hex.
`User does not have permission to delete AddressBookEntry for this customer.`	The caller lacks Write.
`This address book entry does not exist.`	No entry has that GUID.
`Addressbookentry could not be deleted.`	The delete failed.

ModifyAddressBookEntry

Rewrites an address-book entry. Every field is replaced: send the complete entry, since omitted fields are cleared.

POST https://api.moleant.com/discover/ModifyAddressBookEntry/

v2 route: PUT PATCH /v2/organizations/{CGuid}/addressbook/{Guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`Guid`	Yes	Entry GUID.	Hex, max 120.
`GivenName`	Yes	Given name.	Text, max 250.
`LastName`	Yes	Surname.	Text, max 250.
`Initial`	No	Initials.	Text, max 250.
`Phone`	No	Phone number.	Text, max 250.
`Email`	No	E-mail address. When sent it must be valid.	E-mail, max 250.
`Role`	No	Role or title.	Text, max 4096.
`Notes`	No	Notes.	Text, max 4096.

Example request

POST https://api.moleant.com/discover/ModifyAddressBookEntry/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","Guid":"e41f...","GivenName":"Ada","LastName":"Lovelace","Initial":"AL","Phone":"+46 8 123 45 67","Email":"ada@contoso.com","Role":"System owner","Notes":"Back from leave in May"}

Response

A status message. On success the subcode is Successfully modified the person in the AddressBook..

Failures, in addition to the common failures:

`subcode`	Cause
`The email-address in the addressbook is not correctly formatted.`	`Email` was not a valid address.
`GivenName invalid or missing.`	`GivenName` was missing.
`LastName invalid or missing.`	`LastName` was missing.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Object Guid missing or invalid.`	`Guid` was missing or not hex.
`User does not have permission to modify a person in the AddressBook for this customer.`	The caller lacks Write.
`The person does not exist in the addressbook and thus cannot be modified.`	No entry has that GUID.
`Failed to modify the person in the AddressBook.`	The write failed.

API Keys

Organization API keys authenticate the Discover API v2 and the v1 endpoints marked User token or API key. The client chooses the key value; Moleant Discover generates one in the web app.

Endpoint	Purpose	Credential	Permission
`/discover/ListKeys/`	List API keys.	User token	Read
`/discover/AddKey/`	Add an API key.	User token	Write
`/discover/DeleteKey/`	Revoke an API key.	User token	Write

ListKeys

Lists API keys. Each entry names the organization the key belongs to.

POST https://api.moleant.com/discover/ListKeys/

v2 route: GET /v2/organizations/{CGuid}/keys — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Hex, max 100.

Example request

POST https://api.moleant.com/discover/ListKeys/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade"}

Response

A Keys array.

Attribute	Description	Example
`Keys[].OrgID`	GUID of the organization the key belongs to.	7a8b26724e508ade
`Keys[].OrgName`	Its name.	Contoso AB
`Keys[].Key`	The key.	c9c42981ebf50a4749c2
`Keys[].KeyDescription`	The key's name.	Power BI export

Example response

{"Keys":[{"OrgID":"7a8b26724e508ade","OrgName":"Contoso AB","Key":"c9c42981ebf50a4749c2","KeyDescription":"Power BI export"}]}

Empty result: HTTP 200 with {"Keys":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`CGuid is missing.`	`CGuid` was missing or not hex.
`User does not have permission to list keys for this organization.`	The caller lacks Read.

Changes in this version: Only the keys of the requested organization are returned. Earlier versions returned the keys of every organization the caller could see.

AddKey

Stores a new API key for the organization.

POST https://api.moleant.com/discover/AddKey/

v2 route: POST /v2/organizations/{CGuid}/keys — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Hex, max 100.
`Key`	Yes	The key value.	Hex. Up to 100 characters are stored, but only keys of at most 20 characters are accepted when used.
`Name`	Yes	Name of the key.	Text, max 200.

Uniqueness is not checked. Generate keys from a strong random source.

Example request

POST https://api.moleant.com/discover/AddKey/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","Key":"c9c42981ebf50a4749c2","Name":"Power BI export"}

Response

A status message. On success the subcode is Successfully added the key..

Failures, in addition to the common failures:

`subcode`	Cause
`CGuid is missing.`	`CGuid` was missing or not hex.
`Key is missing.`	`Key` was missing or not hex.
`Key name is missing.`	`Name` was missing.
`User does not have permission to modify attributes for this organization.`	The caller lacks Write (sic).

Changes in this version: A key must be at least 16 characters. When Key is left out the API generates a 40-character key and returns it in the Key field of the status message.

DeleteKey

Deletes an API key of the organization. The call succeeds even when the organization has no such key.

POST https://api.moleant.com/discover/DeleteKey/

v2 route: DELETE /v2/organizations/{CGuid}/keys/{Key} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Hex, max 100.
`Key`	Yes	The key to delete.	Hex, max 100.

Example request

POST https://api.moleant.com/discover/DeleteKey/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","Key":"c9c42981ebf50a4749c2"}

Response

A status message. On success the subcode is Successfully deleted the key..

Failures, in addition to the common failures:

`subcode`	Cause
`CGuid is missing.`	`CGuid` was missing or not hex.
`Key is missing.`	`Key` was missing or not hex.
`User does not have permission to delete attributes for this organization.`	The caller lacks Write (sic).

RACI Tasks

A RACI matrix per system: for each task, who is Responsible, Accountable, Consulted and Informed. The people are address-book entries, referred to by their Guid.

Endpoint	Purpose	Credential	Permission
`/discover/ListRACITasks/`	List a system's RACI tasks.	User token	Read
`/discover/AddRACITask/`	Add a RACI task.	User token	Write
`/discover/DeleteRACITask/`	Delete a RACI task.	User token	Write
`/discover/ModifyRACITask/`	Change a RACI task.	User token	Write

ListRACITasks

Lists the RACI tasks of a system.

POST https://api.moleant.com/discover/ListRACITasks/

v2 route: GET /v2/organizations/{CGuid}/systems/{SystemID}/raci — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.

Example request

POST https://api.moleant.com/discover/ListRACITasks/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12"}

Response

A RACI array.

Attribute	Description	Example
`RACI[].guid`	Task GUID.	a90c...
`RACI[].task`	The task.	Monthly payroll run
`RACI[].Responsible / Accountable / Consulted / Informant`	Address-book entry GUIDs, or empty.	e41f... / 77b2... / /
`RACI[].Notes`	Notes.

Example response

{"RACI":[{"guid":"a90c...","Responsible":"e41f...","Accountable":"77b2...","Consulted":"",
  "task":"Monthly payroll run","Informant":"","Notes":""}]}

Empty result: HTTP 200 with {"RACI":["No RACI information was found for this system."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to list RACI for this customer.`	The caller lacks Read.

AddRACITask

Adds a task to a system's RACI matrix and returns its GUID.

POST https://api.moleant.com/discover/AddRACITask/

v2 route: POST /v2/organizations/{CGuid}/systems/{SystemID}/raci — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`Task`	Yes	The task.	Text, max 250.
`R`	No	Responsible: an address-book entry `Guid`.	Text, max 250. Must exist when sent.
`A`	No	Accountable.	As `R`.
`C`	No	Consulted.	As `R`.
`I`	No	Informed.	As `R`.
`N`	No	Notes.	Text, max 2500.

Example request

POST https://api.moleant.com/discover/AddRACITask/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","Task":"Monthly payroll run","R":"e41f...","A":"77b2..."}

Response

A status message. On success it carries the new task's GUID as an extra field:

{ "message": "Success", "subcode": "RACI task was added.", "submessage": "None", "guid": "a90c..." }

Failures, in addition to the common failures:

`subcode`	Cause
`Task not specified or invalid.`	`Task` was missing.
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to add RACI to this customer.`	The caller lacks Write.
`The system selected for RACI does not exist`	No system has that id.
`The user selected for responsible does not exist`	`R` is not an address-book entry. The same message exists for accountable, consulted and informant.
`Failed to add RACI.`	The write failed.

DeleteRACITask

Deletes a task from a system's RACI matrix.

POST https://api.moleant.com/discover/DeleteRACITask/

v2 route: DELETE /v2/organizations/{CGuid}/systems/{SystemID}/raci/{guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Numeric system id.	Digits, max 10.
`guid`	Yes	Task GUID.	Hex, max 250.

Example request

POST https://api.moleant.com/discover/DeleteRACITask/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","guid":"a90c..."}

Response

A status message. On success the subcode is RACI task was deleted..

Failures, in addition to the common failures:

`subcode`	Cause
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to delete RACI for this customer.`	The caller lacks Write.
`This RACI-task does not exist.`	No task has that GUID.
`Failed to delete RACI.`	The delete failed.

ModifyRACITask

Rewrites a RACI task, and can move it to another system. Every field is replaced, including Task and N: send the complete task. At least one of R, A, C and I is required.

POST https://api.moleant.com/discover/ModifyRACITask/

v2 route: PUT PATCH /v2/organizations/{CGuid}/systems/{SystemID}/raci/{guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	The system the task belongs to afterwards.	Digits, max 10.
`guid`	Yes	Task GUID.	Hex, max 250.
`Task`	No	The task.	Text, max 250.
`R`	No	Responsible: an address-book entry `Guid`.	Text, max 250. Must exist when sent.
`A`	No	Accountable.	As `R`.
`C`	No	Consulted.	As `R`.
`I`	No	Informed.	As `R`.
`N`	No	Notes.	Text, max 2500.

Example request

POST https://api.moleant.com/discover/ModifyRACITask/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","SystemID":"12","guid":"a90c...","Task":"Monthly payroll run","R":"e41f...","A":"77b2...","I":"3d5e..."}

Response

A status message. On success the subcode is RACI task was modified..

Failures, in addition to the common failures:

`subcode`	Cause
`You most specify one of the following: r,a,c,i.`	None of `R`, `A`, `C`, `I` was sent (sic).
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to modify RACI to this customer.`	The caller lacks Write.
`This RACI-task does not exist.`	No task has that GUID.
`Failed to modify RACI.`	The write failed.

Orders & Accounts

Signing up for Moleant Discover creates an account in Moleant's own directory, a plan and one or more subscriptions; provisioning a subscription creates the customer's first organization. Stripe drives this through AcceptOrder; the /account/ endpoints let the website follow and reverse it. The /account/ endpoints use the Account token.

Endpoint	Purpose	Credential	Permission
`/discover/AcceptOrder/`	Receive a Stripe checkout event.	None	—
`/account/CreateAccount/`	Create an account with subscriptions.	Account token	—
`/account/OnBoardAccount/`	Follow an account's provisioning.	Account token	—
`/account/OffBoardAccount/`	Deprovision an account's subscriptions.	Account token	—
`/account/CreateOrder/`	Unfinished.	None	—
`/account/FinishOrder/`	Disabled.	—	—
`/account/FinishOrderKlarna/`	Not working.	Account token	—
`/account/ReceivePush/`	Not working.	None	—

AcceptOrder

Stripe's webhook for a completed checkout. For a customer Moleant has not seen before it creates an account in Moleant's directory with the default subscription and e-mails the sign-in details. For a known customer it records the payment.

POST https://api.moleant.com/discover/AcceptOrder/

v2 route: POST /v2/webhooks/stripe — documentation.

Request

Attribute	Mandatory?	Description	Notes
`data.object.customer`	Yes	Stripe customer id; identifies the order.	Text, max 200.
`data.object.customer_name`	Yes	Customer name; the first two words become given name and surname.	Text, max 200.
`data.object.customer_email`	Yes	Customer e-mail address; receives the welcome e-mail.	Text, max 355.
`data.object.customer_phone`	Yes	Customer phone number.	Text, max 200.
`data.object.id`	No	Read, never used.

Example request

POST https://api.moleant.com/discover/AcceptOrder/
Content-Type: application/json

{"id":"evt_1MRI0CH2l3145r1K1Kl9v4d7","type":"checkout.session.completed",
 "data":{"object":{"id":"cs_live_a1b2...","customer":"cus_NBfaOUY0f3fziN","customer_name":"Ada Lovelace",
   "customer_email":"ada@contoso.com","customer_phone":"+46701234567"}}}

Response

A status message. On success the subcode is User was successfully created., with the same text in submessage. A known customer gets a Success status with an empty subcode.

Failures:

`subcode`	Cause
`customer missing`	The field was missing; likewise `customer_name missing`, `customer_phone missing` and `customer_email missing`. `submessage`: `Provisioning failure.`
`Could not authenticate with the Microsoft Graph API. Please contact MoleAnt System Administration.. EC: …`	Moleant could not get a Graph token.
`Failed to create user. EC: …`	Graph rejected the new account.
`User could not be created.`	The account record could not be written.
`An error occurred while creating the user. Please try again later.`	Anything else. `submessage`: `User creation failure.`

Changes in this version: The request must carry a valid Stripe-Signature header for the endpoint's signing secret; unsigned calls get HTTP 403. Customer details are also read from data.object.customer_details when the top-level fields are absent.

CreateAccount

Creates an account in Moleant's directory with the given subscriptions and e-mails the sign-in details.

POST https://api.moleant.com/account/CreateAccount/

v2 route: POST /v2/account/users — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	Account token with the claims `service` = `CreateAccount` and `intentlock` = `CREATE`.	See Authentication.
`Mode`	Yes	`Create`. `Invite` is accepted but not implemented.	Case-sensitive.
`Email`	Yes	E-mail address of the new account.	E-mail, max 255.
`FirstName`	Yes	Given name.	Plain text, max 255.
`LastName`	Yes	Surname.	Plain text, max 255.
`MiddleName`	No	Middle name.	Plain text, max 255.
`PurchasedSubscriptions`	Yes	Array of subscription GUIDs. Every one must exist.	Hex, max 120 each.

Example request

POST https://api.moleant.com/account/CreateAccount/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","Mode":"Create","Email":"ada@contoso.com","FirstName":"Ada","LastName":"Lovelace","PurchasedSubscriptions":["f17f35b502f0d4d965ef594fe1c9fc0c"]}

Response

A status message. On success the subcode is User was successfully created., with the same text in submessage.

Failures, in addition to the common failures:

`subcode`	Cause
`Mode not specified or incorrect.`	`Mode` was not `Create` or `Invite`.
`Firstname and Lastname must be specified when creating a new user.`	A name was missing.
`Email must be specified.`	`Email` was missing or not an e-mail address.
`FALSE`	With `submessage` `Subscription data missing or invalid`: `PurchasedSubscriptions` was missing or not an array.
`User does already exist and cannot be added again.`	The address already has an account.
`The Invite function is not implemented at this time.`	`Mode` was `Invite`.
`The target email is already used for another user.`	The address is taken in the directory.
`One of the subscriptions does not exist.`	An unknown subscription GUID. `submessage`: `Invalid subscription id.`
`Could not authenticate with the Microsoft Graph API. Please contact MoleAnt System Administration.. EC: …`	Moleant could not get a Graph token.
`Failed to create user. EC: …`	Graph rejected the new account.
`User could not be created.`	The account record could not be written.
`An error occurred while creating the user. Please try again later.`	The account could not be confirmed.
`General error. Please contact system administration.`	Anything else.

Changes in this version: The hidden password override has been removed; only an Account token with the CreateAccount/CREATE purpose lock is accepted.

OnBoardAccount

Returns an account, its plan and the state of each subscription, for the website to show while provisioning runs. Calling it also starts provisioning of every subscription that is still in state 1.

POST https://api.moleant.com/account/OnBoardAccount/

v2 route: POST /v2/account/onboarding — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	Account token.	See Authentication.
`AccountGuid`	Yes	Object id of the account.	GUID, max 255.

Example request

POST https://api.moleant.com/account/OnBoardAccount/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","AccountGuid":"74c78695-356f-4b00-8b62-bc4e166c37b2"}

Response

An object with a User array (one element) and a Subscriptions array. All values are strings.

Attribute	Description	Example
`User[].UserID`	The account's e-mail address.	ada@contoso.com
`User[].AccountGuid`	Object id of the account.	74c78695-356f-4b00-8b62-bc4e166c37b2
`User[].GivenName / MiddleName / SurName`	Name.	Ada / / Lovelace
`User[].Plan`	Plan GUID.	b0d2...
`Subscriptions[].SubscriptionGuid`	Subscription GUID.	f17f35b502f0d4d965ef594fe1c9fc0c
`Subscriptions[].Name / Description`	Subscription name and description.	Moleant Discover
`Subscriptions[].StateControl`	`1` received, `2` started, `4` in progress, `8` ready, `16` failed.	8
`Subscriptions[].StateMessage`	Text to show for the state.	This subscription is now ready and can be used.
`Subscriptions[].LandingZone`	Where to send the user when it is ready.	https://discover.moleant.com/

Example response

{"User":[{"UserID":"ada@contoso.com","AccountGuid":"74c78695-356f-4b00-8b62-bc4e166c37b2",
   "GivenName":"Ada","MiddleName":"","SurName":"Lovelace","Plan":"b0d2..."}],
 "Subscriptions":[{"SubscriptionGuid":"f17f35b502f0d4d965ef594fe1c9fc0c","Name":"Moleant Discover",
   "Description":"Moleant Discover standard subscription","StateControl":"8",
   "StateMessage":"This subscription is now ready and can be used.","LandingZone":"https://discover.moleant.com/"}]}

Failures, in addition to the common failures:

`subcode`	Cause
`AccountGuid missing.`	`AccountGuid` was missing or not a GUID.
`User does not exist.`	No account has that id.
`User is not bound to a plan.`	The account has no plan.
`User is not bound to a subscription.`	The plan has no subscription.
`General error. Please contact system administration.`	Anything else.

Changes in this version: Only the account of the token holder can be onboarded (AccountGuid must be the caller's own id).

OffBoardAccount

Deprovisions every ready subscription (state 8) of an account, removing the organization it provisioned. A subscription is skipped when the account is linked to more or fewer than one organization, since the right one cannot be told apart.

POST https://api.moleant.com/account/OffBoardAccount/

v2 route: POST /v2/account/offboarding — documentation.

Irreversible. Deprovisioning deletes the organization and its data.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	Account token.	See Authentication.
`AccountGuid`	Yes	Object id of the account.	GUID, max 255.

Example request

POST https://api.moleant.com/account/OffBoardAccount/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","AccountGuid":"74c78695-356f-4b00-8b62-bc4e166c37b2"}

Response

An object listing what happened.

Attribute	Description	Example
`Deprovisioned`	Array of subscription GUIDs that were deprovisioned.	["f17f35b502f0d4d965ef594fe1c9fc0c"]
`Skipped`	Array of subscription GUIDs that could not be deprovisioned. Present only when there are any.

Example response

{"Deprovisioned":["f17f35b502f0d4d965ef594fe1c9fc0c"]}

Failures, in addition to the common failures:

`subcode`	Cause
`AccountGuid missing.`	`AccountGuid` was missing or not a GUID.
`User does not exist.`	No account has that id.
`User is not bound to a plan.`	The account has no plan.
`User is not bound to a subscription.`	The plan has no subscription.
`No subscriptions could be deprovisioned.`	Nothing was deprovisioned. `submessage` lists the skipped GUIDs, or says `No provisioned subscriptions found for this account.`

Changes in this version: Only the account of the token holder can be offboarded.

Entitlements

Licence entitlements: licences an organization owns, linked either to assets or to installed applications, so Moleant Discover can compare licences owned with installations found. These endpoints live under /Entitlements/, with a capital E.

Endpoint	Purpose	Credential	Permission
`/Entitlements/ListEntitlements/`	List entitlements with compliance verdicts.	User token or API key	Read
`/Entitlements/AddEntitlement/`	Create an entitlement.	User token	Write
`/Entitlements/ModifyEntitlement/`	Change an entitlement.	User token	Write
`/Entitlements/DeleteEntitlement/`	Delete an entitlement.	User token	Account admin

ListEntitlements

Lists the organization's entitlements with their links, installation counts and compliance verdict, followed by its Microsoft 365 licence pools. This handler also serves v2 entitlements, where every field and verdict is described.

POST https://api.moleant.com/Entitlements/ListEntitlements/

v2 route: GET /v2/organizations/{CGuid}/entitlements · GET /v2/organizations/{CGuid}/systems/{SystemID}/entitlements — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token, or an organization API key.	A key also decides the organization; see Authentication.
`CGuid`	Yes	Organization GUID. Ignored with a key.	Alphanumeric, max 120.
`SystemID`	No	Only asset entitlements that reach this system; also drops the Microsoft 365 pools.	Digits, max 10.

Example request

POST https://api.moleant.com/Entitlements/ListEntitlements/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade"}

Response

An Entitlements array; see v2 entitlements for every field.

Attribute	Description	Example
`Entitlements[].Guid, EntitlementName, SerialKey, ExpiryDate, LogDate, LogTime, Type, Comments`	The entitlement's own fields. `ExpiryDate` is a Unix timestamp in a string; `LogDate`/`LogTime` are the same moment split.
`Entitlements[].Licenses, TotalInstalls, HighestWinningNumber`	Numbers.	25, 2, 2
`Entitlements[].EntitlementAssets / EntitlementSoftware`	Links: `{ServerID}` or `{ApplicationName, Version, Installs}`.
`Entitlements[].HasFile, FileName`	`HasFile` is the string `"true"` or `"false"`.	true
`Entitlements[].Alert`	Compliance verdict.	Over-licensed (178%)

Example response

{"Entitlements":[
  {"Guid":"c30a...","EntitlementName":"Adobe Acrobat Pro","SerialKey":"XXXXX-XXXXX-XXXXX",
   "ExpiryDate":"1801353600","LogDate":"2027-01-31","LogTime":"00:00:00","Type":"Assets",
   "Licenses":25,"Comments":"Renewed via reseller","EntitlementAssets":[{"ServerID":38},{"ServerID":41}],
   "HasFile":"true","FileName":"acrobat-licence.pdf","TotalInstalls":2,"HighestWinningNumber":2,
   "Alert":"Over-licensed (1250%)"}
]}

Empty result: HTTP 200 with {"Entitlements":["No Entitlements were found."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`User does not have permission to list computers for this customer.`	The caller lacks Read (sic).

Changes in this version: With SystemID, an Assets entitlement is listed when one of its assets is a member of that system; Software entitlements are not system-bound and are left out, as before.

AddEntitlement

Creates an entitlement, links it to assets or applications, and stores an optional licence document.

POST https://api.moleant.com/Entitlements/AddEntitlement/

v2 route: POST /v2/organizations/{CGuid}/entitlements — documentation.

Not atomic. The entitlement is created before its links are checked, so a failure about an asset, an application or the document leaves the entitlement in place with only some of its links. Delete it with DeleteEntitlement and try again.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`Type`	No	`Assets` or `Software`. Decides how ListEntitlements filters by system.	Text, max 20.
`EntitlementName`	Yes	Name of the entitlement.	Text, max 255.
`Licenses`	Yes	Number of licences owned. Must be at least 1.	Digits.
`EntitlementAssets`	Conditional	For an asset entitlement: array of `{"ServerID": "<id>"}`. Every asset must exist.	Digits, max 5 each.
`EntitlementFiles`	Conditional	For a software entitlement: array of `{"ApplicationName": "…", "Version": "…"}`; leave `Version` empty to match every version. Every application must be installed somewhere. Used only when `EntitlementAssets` is absent.	Text, max 450 each.
`SerialKey`	No	Serial or licence key.	Text, max 300.
`ExpiryDate`	No	Expiry as a Unix timestamp in seconds.	Digits.
`trackVersion`	No	Whether the entitlement is bound to exact versions.	Text, max 255.
`Notes`	No	Comments; returned as `Comments`.	Text, max 4096.
`FileName`	No	Name of a licence document to attach.	The extension must be an allowed upload type.
`FileData`	No	The document, Base64-encoded. One document per entitlement.	Base64.
`Subject`	No	Read, never used.

Example request

POST https://api.moleant.com/Entitlements/AddEntitlement/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","EntitlementName":"Adobe Acrobat Pro","Type":"Assets","Licenses":"25","EntitlementAssets":[{"ServerID":"38"},{"ServerID":"41"}],"SerialKey":"XXXXX-XXXXX-XXXXX","ExpiryDate":"1801353600"}

Response

A status message. On success the subcode is Entitlement uploaded successfully..

Failures, in addition to the common failures:

`subcode`	Cause
`User does not have permission to add entitlement.`	The caller lacks Write.
`EntitlementName and Licenses must be specified.`	A required field was missing, or `Licenses` was 0.
`Too many assets specified.`	`EntitlementAssets` exceeded the cap.
`One or more assets specified were empty.`	An element had no `ServerID`.
`One of the assets specified does not exist.`	No asset has that id.
`Too many files specified.`	`EntitlementFiles` exceeded the cap.
`One or more files specified were empty.`	An element had no `ApplicationName`.
`One of the softwares specified does not exist.`	No asset has that application (and version) installed.
`Filename missing or invalid.`	`FileName` was invalid.
`Extension is not allowed for upload.`	The document type is not on the allowed list.
`Failed to upload file.`	The document could not be stored.

Changes in this version: The entitlement, its assets or software links and its file are created in one transaction: a failure (for example an unknown asset) no longer leaves a half-created entitlement behind. The new Guid is returned.

ModifyEntitlement

Rewrites an entitlement. It is a full replacement: the name, licences, serial key, expiry and comments are all overwritten, and every asset and application link is removed and rebuilt from the request. The type cannot be changed.

POST https://api.moleant.com/Entitlements/ModifyEntitlement/

v2 route: PUT PATCH /v2/organizations/{CGuid}/entitlements/{Guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`Guid`	Yes	The entitlement.	Hex, max 120.
`EntitlementName`	Yes	Name of the entitlement.	Text, max 255.
`Licenses`	Yes	Number of licences owned. Must be at least 1.	Digits.
`EntitlementAssets`	Conditional	For an asset entitlement: array of `{"ServerID": "<id>"}`. Every asset must exist.	Digits, max 5 each.
`EntitlementFiles`	Conditional	For a software entitlement: array of `{"ApplicationName": "…", "Version": "…"}`; leave `Version` empty to match every version. Every application must be installed somewhere. Used only when `EntitlementAssets` is absent.	Text, max 450 each.
`SerialKey`	No	Serial or licence key.	Text, max 300.
`ExpiryDate`	No	Expiry as a Unix timestamp in seconds.	Digits.
`trackVersion`	No	Whether the entitlement is bound to exact versions.	Text, max 255.
`Notes`	No	Comments; returned as `Comments`.	Text, max 4096.
`FileName`	No	Name of a licence document to attach.	The extension must be an allowed upload type.
`FileData`	No	The document, Base64-encoded. One document per entitlement.	Base64.
`Subject`	No	Read, never used.

Example request

POST https://api.moleant.com/Entitlements/ModifyEntitlement/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","Guid":"c30a...","EntitlementName":"Adobe Acrobat Pro","Licenses":"30","EntitlementAssets":[{"ServerID":"38"},{"ServerID":"41"},{"ServerID":"52"}],"SerialKey":"XXXXX-XXXXX-XXXXX","ExpiryDate":"1801353600"}

Response

A status message. On success the subcode is Entitlement modified successfully..

Failures, in addition to the common failures:

`subcode`	Cause
`Guid must be specified.`	`Guid` was missing.
`User does not have permission to modify entitlement.`	The caller lacks Write.
`This entitlement does not exist.`	No entitlement has that GUID.
`User does not have permission to upload to this organization.`	The caller may not store the document.
`EntitlementName and Licenses must be specified.`	A required field was missing, or `Licenses` was 0.
`Too many assets specified.`	`EntitlementAssets` exceeded the cap.
`One or more assets specified were empty.`	An element had no `ServerID`.
`One of the assets specified does not exist.`	No asset has that id.
`Too many files specified.`	`EntitlementFiles` exceeded the cap.
`One or more files specified were empty.`	An element had no `ApplicationName`.
`One of the softwares specified does not exist.`	No asset has that application (and version) installed.
`Filename missing or invalid.`	`FileName` was invalid.
`Extension is not allowed for upload.`	The document type is not on the allowed list.
`Failed to upload file.`	The document could not be stored.

Changes in this version: The change is transactional.

DeleteEntitlement

Deletes an entitlement with its links and document. Unlike the other entitlement writes, this needs Account admin.

POST https://api.moleant.com/Entitlements/DeleteEntitlement/

v2 route: DELETE /v2/organizations/{CGuid}/entitlements/{Guid} — documentation.

Request

Attribute	Mandatory?	Description	Notes
`jwt`	Yes	User token.	See Authentication.
`CGuid`	Yes	Organization GUID.	Alphanumeric, max 50.
`Guid`	Yes	The entitlement.	Hex, max 120.

Example request

POST https://api.moleant.com/Entitlements/DeleteEntitlement/
Content-Type: application/json

{"jwt":"eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…","CGuid":"7a8b26724e508ade","Guid":"c30a..."}

Response

A status message. On success the subcode is Entitlement successfully deleted..

Failures, in addition to the common failures:

`subcode`	Cause
`This Guid does not exist.`	`Guid` was missing or not hex.
`User does not have permission to delete entitlement.`	The caller lacks Account admin.
`This entitlement does not exist.`	No entitlement has that GUID.

Changes in this version: The attached file's stored-file record is removed as well.