API reference

Discover API v2 Documentation

Base URL: https://api.moleant.com/v2/ — one REST route per operation, authenticated with a header. Every operation is also reachable through its v1 alias.

Updated: 2026-09-21

Conventions

Every v2 route follows the same pattern:

Path: /v2/<resource>/<id>/…. Organization-scoped resources sit under /v2/organizations/{CGuid}/; the ids in the path are the same values the responses return (CGuid, SystemID, ServerID, guid…). A trailing slash is optional. Paths are case-sensitive.
Method: GET reads, POST creates, PUT or PATCH modifies (the two are interchangeable: only the fields sent are changed), DELETE deletes. A supported path with the wrong method answers 405 with the allowed methods in submessage.
Parameters: a value can come from the path, from the JSON body or from the query string, in that order of precedence. GET and DELETE requests take their remaining parameters in the query string; the writing methods take a JSON body (Content-Type: application/json). Query values are URL-decoded, so Search=Hello%20World searches for Hello World.
Content type: responses are application/json; charset=UTF-8, except the two file downloads.
CORS: Access-Control-Allow-Origin: * on every response; OPTIONS preflight requests are answered with 204 and the allowed methods and headers.

Request format

Send values as JSON strings in a body and as text in a query string. Numbers are accepted wherever digits are expected ("SystemID":"12" and "SystemID":12 behave the same).
Flags are strings too. Where a field takes "TRUE", "true"/"false" or "1", a JSON boolean does not work.
List filters (ServerID, SystemID, UserID, ComputerSoftware, issueNo) take a JSON array in a body, and in a query string either a repeated parameter (SystemID=1&SystemID=2, or SystemID[]=1&SystemID[]=2) or a single value.
Every value is validated against a format and a length range (see Value formats). A value that fails is treated as missing, which usually produces the operation's …missing or invalid failure.
A body that is not valid JSON is treated as empty. Unknown fields are ignored; field names are case-sensitive.

Response formats

Successful reads return the payload directly, usually a JSON object keyed by the collection name ({"Systems":[...]}). Writes, and every failure, return a status message with one fixed shape. The payloads and the messages are the same as in v1, so a client that parsed v1 responses parses these.

Shape	Used by	Example
Data object	Reads, on success.	`{"Query":[...],"Systems":[...]}`
Status message	All failures, and all writes.	`{"message":"Success","subcode":"Successfully added the key.","submessage":"None"}`
Status message with extra fields	Creates, on success: the id of the new record (`SystemID`, `guid`, `Guid`, `AttributeGuid`, `CGuid`, `Key`, `RandomNo`) is added to the message. Each operation says which.	`{"message":"Success","subcode":"Successfully add the system.","submessage":"None","SystemID":12}`
Agent verdict	The Active Directory engine operations: a `Success` status whose `subcode` is `TRUE` (proceed) or `FALSE` (don't), with the reason in `submessage`.	`{"message":"Success","subcode":"FALSE","submessage":"You are not the designated update server."}`
File	downloadkb and DownloadVex, on success. Their failures are status messages.	The file's bytes, with its content type and a `Content-Disposition` file name

{ "message": "Success", "subcode": "Successfully modified data to the system.", "submessage": "None" }
{ "message": "Failure", "subcode": "User token invalid or empty.", "submessage": "None" }

Attribute	Description	Example
`message`	Always `Success` or `Failure`. Use it, together with the HTTP status code, to tell the outcome.	Failure
`subcode`	What happened. This is the string to show or log. The tables below quote each operation's values verbatim, typos included.	User token invalid or empty.
`submessage`	Additional detail when there is any, otherwise the literal string `None`.	None

“No results” is not an error, but it is not always an empty list either. Most list operations answer an empty result with HTTP 200 and a placeholder array holding a string where objects would normally be, for example {"Computers":["No computer information was found."]}. Check the type of the first element before reading fields. The per-operation sections quote each placeholder.

Value types

Identifiers, counters and sizes that the API itself computes or converts, such as ServerID, SystemID, ResultCount and byte counts, are JSON numbers, and the response tables say so. Every other value is passed through as it is stored. Text is always a string. A numeric column that the API does not convert may arrive as a number or as a numeric string, depending on the column type, so parse those defensively. Missing optional values are an empty string, unless a table says null.

Status codes

Code	Meaning
`200`	The operation ran. The body is the payload, an empty-result placeholder, a `Success` status message (including an agent verdict of `FALSE`), or a file.
`204`	An `OPTIONS` preflight request.
`400`	Validation failure, invalid credential, missing permission, or a database error.
`403`	A malformed engine token, or a Stripe webhook call without a valid signature.
`404`	No route matches the path: `{"message":"Failure","subcode":"Unknown endpoint.","submessage":"None"}`.
`405`	The path exists but not with this method; `submessage` lists the allowed methods.
`429`	Rate limited — see Rate limiting.
`503`	The API could not reach its database.

Common failures

These failures can come from almost every operation that takes the credential in question, so the per-operation tables leave them out.

`subcode`	Cause
`JSON request appears to be invalid.`	The request carried neither a credential nor any parameter — typically an empty or malformed body on a v1 alias.
`User token invalid or empty.`	The user token failed validation: it did not decrypt and authenticate under a key of the operation's branch, it has expired, its header is not the one described in User token format, or it is a legacy token the API no longer accepts. Also returned when an API key is sent to an operation that takes user tokens only.
`User objectID invalid or empty.` `Users email invalid or empty.`	The user token validated but carried no usable identity. The SBOM and VEX operations spell these `User's objectID invalid or empty.` and `User's email invalid or empty.`
`Key token invalid or empty.`	On the operations that also accept an API key: the key is unknown.
`The API key does not belong to this organization.`	An API key was used on a route whose `{CGuid}` is another organization.
`A database error occurred while processing this request.`	A database statement failed. This is also what a `CGuid` for an organization without the expected tables usually produces.

Text encoding in responses

Fields validated as Text (see below) are HTML-entity encoded when they are stored, and the API returns them as stored. Characters such as &, <, ", ', %, (, +, \ and the Swedish letters å, ä and ö arrive as entities (&, <, ", ', %, (, +, \, å…), and line breaks as <br>. Decode them before rendering the text as plain text. The same applies to text reported by Moleant Engine.

Value formats

The Notes column of each request table gives a field's format and maximum length, for example Text, max 255. Lengths are counted in bytes of the value as sent, before any cleaning.

Format	Accepted	Behaviour
Alphanumeric	`a`–`z`, `A`–`Z`, `0`–`9`	Any other character rejects the value. Organization GUIDs (`CGuid`) use this format.
Hex	`0`–`9`, `a`–`f` in either case	Any other character rejects the value.
GUID	Hex digits and hyphens	Any other character rejects the value.
Digits	`0`–`9`	Other characters are removed rather than rejected; a value with no digits becomes empty.
DNS name	Letters, digits, hyphen and dot	Any other character rejects the value.
E-mail	A syntactically valid e-mail address	Anything else rejects the value.
Date	Digits, space and `: - , / T`	Any other character rejects the value.
File name	Anything except `/ : * " < > \| \`	Those characters reject the value. The extension must also be on the list of allowed upload types.
Base64	`A`–`Z`, `a`–`z`, `0`–`9`, `+ / =`	Any other character rejects the value. The length limit applies to the Base64 text.
Text	Anything, but not empty	HTML-entity encoded before it is stored — see Text encoding above. An empty value counts as missing, even where the table says it is optional.
Plain text	Anything	The characters `' < > = ;` are removed.
Tolerant text	Anything	The characters `' < > =` are removed.
SamAccountName	Anything	The characters `" [ ] : ; \| = + * ? < > / \ ,` are removed.

Multi-organization queries and paging

ListAssets, ListIssues, ListSoftware, ListSystemsForReport, ListUsers and, optionally, ListSystems take an Organizations array instead of a single CGuid. Each element names one organization and may carry its own filters; the results of all organizations are concatenated.

Attribute	Mandatory?	Description	Notes
`Organizations[].OrgName`	Yes	The organization's GUID (despite the name).	Alphanumeric, max 120.
`Organizations[].ServerID`	No	Array of asset ids to restrict to.	Digits, max 10 each.
`Organizations[].SystemID`	No	Array of system ids to restrict to.	Digits, max 10 each.
`Organizations[].UserID`	No	Array of user ids, as returned by ListUsers.	Text, max 150 each (Alphanumeric, max 50, on ListSystems).
`Organizations[].ComputerSoftware`	No	Array of applications, each `ApplicationName` or `ApplicationName-.-Version`.	Text, max 1024 each.
`Organizations[].issueNo`	No	Array of issue numbers.	Digits, max 4 each.
`Organizations[].Search`	No	Free-text search on the listed entity's name.	Text, max 120.

Filters combine with AND across kinds and OR within one array. When any organization in the request carries a filter or a search, organizations without one return nothing, so a filtered query does not accidentally list everything else. The number of organizations, the number of values in each filter array and their total are capped; exceeding a cap fails with You have selected too many <organizations|users|systems|servers|applications|issues|total items> for this query. Skip and Count page the result (both are needed, 0–1000000). Query[].TotalCount reports the unpaged total; the endpoints that document CreateTotalCount only compute it when that field is "1" and otherwise report -1.

The GET /v2/organizations/{CGuid}/… forms of these reports query one organization: the same filters are query parameters, and paging uses Skip and Count.

Rate limiting (HTTP 429)

Every request passes through the same per-IP throttle as the v1 aliases before any endpoint logic runs: 120 requests per 60-second window, then a 300-second block. While blocked, every request returns HTTP 429 with a Retry-After header and the status message {"message":"Failure","subcode":"Too many requests. Please try again later.","submessage":"None"}. Agents behind one NAT share a single budget.

Authentication

The credential travels in a request header. Each operation says which credentials it accepts.

Credential	Header	Used by	Validated as
User token	`Authorization: Bearer <token>`	The web app: most operations.	An encrypted JWT (JWE) made with the Discover key; see User token format. It identifies the user; per-organization permissions are then checked against the permission levels.
Account token	`Authorization: Bearer <token>`	The account operations.	The same format, made with the separate Account key. Each branch refuses the other's tokens.
API key	`X-Api-Key: <key>` (or `Authorization: Bearer <key>`)	Integrations: the operations marked User token or API key.	An organization key from API keys. The key decides the organization: it grants Read and Write on that organization only, and a route whose `{CGuid}` is another organization is refused.
Engine token	`Authorization: Bearer <orgid>`	Moleant Engine: createserver and the Active Directory update operations.	The organization's engine id (`orgid` in ListOrganizationDetails), 24–64 hex characters. A malformed value is HTTP 403, an unknown one HTTP 400.
Stripe signature	`Stripe-Signature`	AcceptOrder.	Stripe's webhook signature for the endpoint's signing secret.

The credential may also be sent as a query parameter (Key, jwt or token), which is how the previous v2 and its key routes work, and the v1 aliases take it as a body field (jwt or token). A header is preferred: query strings end up in server logs.

A user token and an API key are told apart by shape: a value of more than 120 characters, or one containing a dot, is a user token; anything else is an API key.

User token format

The field is called jwt, but its value is an encrypted JWT: a JWE (RFC 7516) in compact serialization, five base64url parts separated by dots, the second one empty. The protected header is always {"alg":"dir","enc":"A256GCM","kid":"<key id>","typ":"JWT"}: the claims are encrypted and authenticated with AES-256-GCM under a 256-bit key that only the API and the Moleant frontend issuing the token hold. A client can't read a token or make one, and a token with any part changed, header included, is refused. So is a token with any other alg or enc, a kid the API doesn't know, or any other header field (zip, crit, jku…).

Claim	Mandatory?	Description
`iat`	Yes	Issue time in Unix seconds, as an integer. Refused if it is more than 60 seconds in the future.
`exp`	Yes	Expiry time in Unix seconds, as an integer. Refused from 60 seconds after `exp`, and whenever `exp` − `iat` exceeds 900 seconds. The web app's tokens last 600 seconds, and it fetches a new one for every call.
`data.id`	Yes	The user's object id in Moleant's Entra ID tenant. A token without one is refused.
`data.email`	No	The user's sign-in name.
`data.creationemail`	No	The e-mail address the account was created with, when the web app knows it.
`data.service`, `data.intentlock`	No	Purpose lock. Ignored unless the endpoint requires one: CreateAccount requires `CreateAccount` and `CREATE`.

Only Moleant's own frontends hold the keys, so a third party can't obtain a user token. Integrations use an organization API key instead.

Legacy HS256 tokens. While the web app moves to JWE, the API can still accept the previous format for each branch: an HS256-signed JWT whose claims sit under data (id, email, creationemail, timestamp, nonce, and for CreateAccount service and intentlock), each claim except nonce ending with the marker bm9uY2U= and the nonce. Anyone holding a legacy token can read its claims. Legacy tokens are refused once the move is complete.

Permission levels

A user's rights in an organization are a string of flags in the roles table, one character per position. The Permission column of each group's endpoint table refers to these levels.

Level	Flag position	Grants	Set with
Read	1	Viewing the organization's data.	ModifyPermission `Read`
Write	2	Adding, changing and deleting the organization's data.	`Write`
Account admin	3	Managing the organization's users and their permissions.	`Admin`
Read password / Write password	4 / 5	Stored and editable, but not checked by any endpoint.	`ReadPassword` / `WritePassword`
Organization admin	9	Accepted by ModifyPermission in place of Account admin.	Not settable through the API.

Two further roles belong to a plan (a subscription that owns organizations), not to an organization: the Discover admin owns the plan, and co-admins help run it. Creating and deleting organizations and managing co-admins require one of them; the endpoints say so. A newly invited user starts with Read only.

From v1, and from the previous v2

This version replaces the internal v1 endpoints (POST /discover/<Operation>/ with a JSON body) and the previous key-authenticated v2 with one set of REST routes. Nothing in the data changed: request field names, validation, payloads, empty-result placeholders and status messages are the same as before, so the per-operation documentation is shared.

Every v1 operation is still available at its old path as an alias of the v2 route, with the credential in the body as before. The v1 reference stays valid for those callers, and each of its sections links to the v2 route.
Removed: discover/AddUser, account/CreateOrder, account/FinishOrder, account/FinishOrderKlarna and account/ReceivePush, which did not work in any version.
The previous v2 routes (/v2/assets/, /v2/systems/… with ?Key=) keep working unchanged; see Key routes kept from the previous v2. Their query values are now URL-decoded, which they were not before.
New in this version: creates return the new record's id; PATCH is accepted wherever PUT is; unknown routes and wrong methods answer 404 and 405 as JSON; and the behaviour changes listed under Changes in this version in the affected operations, most of them tightening what a credential may reach.

The table maps every operation to its route. Operations are documented in the sections that follow, under their operation name, which is also the section id (so #ListSystemDetails links work on both references).

Operation (v1 alias)	v2 route	Credential
SecBuildTicket `POST /discover/SecBuildTicket/`	GET `/v2/me`	User token
ListAccounts `POST /discover/ListAccounts/`	GET `/v2/accounts`	User token
ListCoAdmins `POST /discover/ListCoAdmins/`	GET `/v2/coadmins`	User token
AddCoAdmin `POST /discover/AddCoAdmin/`	POST `/v2/coadmins`	User token
DeleteCoAdmin `POST /discover/DeleteCoAdmin/`	DELETE `/v2/coadmins/{Subject}`	User token
ListOrganizations `POST /discover/ListOrganizations/`	GET `/v2/organizations`	User token
AddOrganization `POST /discover/AddOrganization/`	POST `/v2/organizations`	User token
ListOrganizationDetails `POST /discover/ListOrganizationDetails/`	GET `/v2/organizations/{CGuid}`	User token or API key
ModifyOrganizationDetails `POST /discover/ModifyOrganizationDetails/`	PUT PATCH `/v2/organizations/{CGuid}`	User token
DeleteOrganization `POST /discover/DeleteOrganization/`	DELETE `/v2/organizations/{CGuid}`	User token
ListMasterLogEntries `POST /discover/ListMasterLogEntries/`	GET `/v2/masterlog` GET `/v2/organizations/{CGuid}/masterlog`	User token or API key
ListKeys `POST /discover/ListKeys/`	GET `/v2/organizations/{CGuid}/keys`	User token
AddKey `POST /discover/AddKey/`	POST `/v2/organizations/{CGuid}/keys`	User token
DeleteKey `POST /discover/DeleteKey/`	DELETE `/v2/organizations/{CGuid}/keys/{Key}`	User token
InviteUser `POST /discover/InviteUser/`	POST `/v2/organizations/{CGuid}/users`	User token
DeleteUser `POST /discover/DeleteUser/`	DELETE `/v2/organizations/{CGuid}/users/{Email}`	User token
ModifyPermission `POST /discover/ModifyPermission/`	PUT PATCH `/v2/organizations/{CGuid}/roles/{UserID}`	User token
ListAddressBook `POST /discover/ListAddressBook/`	GET `/v2/organizations/{CGuid}/addressbook`	User token or API key
AddAddressBookEntry `POST /discover/AddAddressBookEntry/`	POST `/v2/organizations/{CGuid}/addressbook`	User token
ModifyAddressBookEntry `POST /discover/ModifyAddressBookEntry/`	PUT PATCH `/v2/organizations/{CGuid}/addressbook/{Guid}`	User token
DeleteAddressBookEntry `POST /discover/DeleteAddressBookEntry/`	DELETE `/v2/organizations/{CGuid}/addressbook/{Guid}`	User token
ListAttributes `POST /discover/ListAttributes/`	GET `/v2/organizations/{CGuid}/attributes`	User token
AddAttribute `POST /discover/AddAttribute/`	POST `/v2/organizations/{CGuid}/attributes`	User token
ModifyAttribute `POST /discover/ModifyAttribute/`	PUT PATCH `/v2/organizations/{CGuid}/attributes/{AttributeGuid}`	User token
DeleteAttribute `POST /discover/DeleteAttribute/`	DELETE `/v2/organizations/{CGuid}/attributes/{AttributeGuid}`	User token
ModifyAttributeValue `POST /discover/ModifyAttributeValue/`	PUT PATCH `/v2/organizations/{CGuid}/attributes/{AttributeGuid}/value`	User token
ListLogEntries `POST /discover/ListLogEntries/`	GET `/v2/organizations/{CGuid}/logs` GET `/v2/organizations/{CGuid}/systems/{SystemID}/logs` GET `/v2/organizations/{CGuid}/assets/{ServerID}/logs`	User token or API key
AddLogEntry `POST /discover/AddLogEntry/`	POST `/v2/organizations/{CGuid}/logs` POST `/v2/organizations/{CGuid}/systems/{SystemID}/logs` POST `/v2/organizations/{CGuid}/assets/{ServerID}/logs`	User token
ModifyLogEntry `POST /discover/ModifyLogEntry/`	PUT PATCH `/v2/organizations/{CGuid}/logs/{guid}`	User token
DeleteLogEntry `POST /discover/DeleteLogEntry/`	DELETE `/v2/organizations/{CGuid}/logs/{guid}`	User token
ListSystemLogTypes `POST /discover/ListSystemLogTypes/`	GET `/v2/logtypes`	User token or API key
ListSystems `POST /discover/ListSystems/`	GET `/v2/organizations/{CGuid}/systems` POST `/v2/systems/search`	User token
ListSystemsForReport `POST /discover/ListSystemsForReport/`	POST `/v2/reports/systems`	User token
ListSystemDetails `POST /discover/ListSystemDetails/`	GET `/v2/organizations/{CGuid}/systems/{SystemID}`	User token or API key
AddSystem `POST /discover/AddSystem/`	POST `/v2/organizations/{CGuid}/systems`	User token
ModifySystemDetails `POST /discover/ModifySystemDetails/`	PUT PATCH `/v2/organizations/{CGuid}/systems/{SystemID}`	User token
DeleteSystem `POST /discover/DeleteSystem/`	DELETE `/v2/organizations/{CGuid}/systems/{SystemID}`	User token
ListServersInSystem `POST /discover/ListServersInSystem/`	GET `/v2/organizations/{CGuid}/systems/{SystemID}/assets`	User token or API key
AddServerToSystem `POST /discover/AddServerToSystem/`	PUT `/v2/organizations/{CGuid}/systems/{SystemID}/assets/{ServerID}`	User token
RemoveServerFromSystem `POST /discover/RemoveServerFromSystem/`	DELETE `/v2/organizations/{CGuid}/systems/{SystemID}/assets/{ServerID}`	User token
ListSystemsForServer `POST /discover/ListSystemsForServer/`	GET `/v2/organizations/{CGuid}/assets/{ServerID}/systems`	User token or API key
AddSystemToServer `POST /discover/AddSystemToServer/`	PUT `/v2/organizations/{CGuid}/assets/{ServerID}/systems/{SystemID}`	User token
RemoveSystemFromServer `POST /discover/RemoveSystemFromServer/`	DELETE `/v2/organizations/{CGuid}/assets/{ServerID}/systems/{SystemID}`	User token
ListSystemLicenseTypes `POST /discover/ListSystemLicenseTypes/`	GET `/v2/licensetypes`	User token or API key
ListSystemLicenses `POST /discover/ListSystemLicenses/`	GET `/v2/organizations/{CGuid}/systems/{SystemID}/licenses`	User token or API key
AddSystemLicense `POST /discover/AddSystemLicense/`	POST `/v2/organizations/{CGuid}/systems/{SystemID}/licenses`	User token
ModifySystemLicense `POST /discover/ModifySystemLicense/`	PUT PATCH `/v2/organizations/{CGuid}/systems/{SystemID}/licenses/{guid}`	User token
DeleteSystemLicense `POST /discover/DeleteSystemLicense/`	DELETE `/v2/organizations/{CGuid}/systems/{SystemID}/licenses/{guid}`	User token
ListRACITasks `POST /discover/ListRACITasks/`	GET `/v2/organizations/{CGuid}/systems/{SystemID}/raci`	User token or API key
AddRACITask `POST /discover/AddRACITask/`	POST `/v2/organizations/{CGuid}/systems/{SystemID}/raci`	User token
ModifyRACITask `POST /discover/ModifyRACITask/`	PUT PATCH `/v2/organizations/{CGuid}/systems/{SystemID}/raci/{guid}`	User token
DeleteRACITask `POST /discover/DeleteRACITask/`	DELETE `/v2/organizations/{CGuid}/systems/{SystemID}/raci/{guid}`	User token
ListComputers `POST /discover/ListComputers/`	GET `/v2/organizations/{CGuid}/assets`	User token or API key
ListServerDetails `POST /discover/ListServerDetails/`	GET `/v2/organizations/{CGuid}/assets/{ServerID}`	User token or API key
AllServerDetails —	GET `/v2/organizations/{CGuid}/assetdetails`	User token or API key
ModifyServerDetails `POST /discover/ModifyServerDetails/`	PUT PATCH `/v2/organizations/{CGuid}/assets/{ServerID}`	User token or API key
DeleteServer `POST /discover/DeleteServer/`	DELETE `/v2/organizations/{CGuid}/assets/{ServerID}`	User token or API key
ListOrganizationKBs `POST /discover/ListOrganizationKBs/`	GET `/v2/organizations/{CGuid}/kbs`	User token or API key
AddOrganizationKBs `POST /discover/AddOrganizationKBs/`	POST `/v2/organizations/{CGuid}/kbs`	User token
ModifyOrganizationKBs `POST /discover/ModifyOrganizationKBs/`	PUT PATCH `/v2/organizations/{CGuid}/kbs/{guid}`	User token
DeleteOrganizationKBs `POST /discover/DeleteOrganizationKBs/`	DELETE `/v2/organizations/{CGuid}/kbs/{guid}`	User token
ListSystemKBs `POST /discover/ListSystemKBs/`	GET `/v2/organizations/{CGuid}/systems/{SystemID}/kbs`	User token or API key
AddSystemKBs `POST /discover/AddSystemKBs/`	POST `/v2/organizations/{CGuid}/systems/{SystemID}/kbs`	User token
ModifySystemKBs `POST /discover/ModifySystemKBs/`	PUT PATCH `/v2/organizations/{CGuid}/systems/{SystemID}/kbs/{guid}`	User token
DeleteSystemKBs `POST /discover/DeleteSystemKBs/`	DELETE `/v2/organizations/{CGuid}/systems/{SystemID}/kbs/{guid}`	User token
listkbs `POST /discover/listkbs/`	GET `/v2/organizations/{CGuid}/assets/{ServerID}/kbs`	User token or API key
uploadkb `POST /discover/uploadkb/`	POST `/v2/organizations/{CGuid}/assets/{ServerID}/kbs`	User token
ModifyServerKBs `POST /discover/ModifyServerKBs/`	PUT PATCH `/v2/organizations/{CGuid}/assets/{ServerID}/kbs/{guid}`	User token
DeleteServerKBs `POST /discover/DeleteServerKBs/`	DELETE `/v2/organizations/{CGuid}/assets/{ServerID}/kbs/{guid}`	User token
downloadkb `POST /discover/downloadkb/`	GET `/v2/organizations/{CGuid}/files/{RandomNo}`	User token or API key
PopulateKBCarousel `POST /discover/PopulateKBCarousel/`	GET `/v2/organizations/{CGuid}/kbs/images` GET `/v2/organizations/{CGuid}/systems/{SystemID}/kbs/images` GET `/v2/organizations/{CGuid}/assets/{ServerID}/kbs/images`	User token or API key
ListAssets `POST /discover/ListAssets/`	POST `/v2/reports/assets`	User token or API key
ListSoftware `POST /discover/ListSoftware/`	GET `/v2/organizations/{CGuid}/software` POST `/v2/reports/software`	User token or API key
ListIssues `POST /discover/ListIssues/`	GET `/v2/organizations/{CGuid}/issues` POST `/v2/reports/issues`	User token or API key
ListUsers `POST /discover/ListUsers/`	GET `/v2/organizations/{CGuid}/users` POST `/v2/reports/users`	User token or API key
ListSbom `POST /discover/ListSbom/`	GET `/v2/organizations/{CGuid}/systems/{SystemID}/sbom`	User token or API key
UploadSBOM `POST /discover/UploadSBOM/`	PUT `/v2/organizations/{CGuid}/systems/{SystemID}/sbom`	User token
ListVex `POST /discover/ListVex/`	GET `/v2/organizations/{CGuid}/systems/{SystemID}/vex`	User token or API key
UploadVEX `POST /discover/UploadVEX/`	PUT `/v2/organizations/{CGuid}/systems/{SystemID}/vex`	User token
ModifyVex `POST /discover/ModifyVex/`	PUT PATCH `/v2/organizations/{CGuid}/systems/{SystemID}/vex/{id}`	User token or API key
DownloadVex `POST /discover/DownloadVex/`	GET `/v2/organizations/{CGuid}/systems/{SystemID}/vex/download`	User token or API key
AddM365App `POST /discover/AddM365App/`	POST `/v2/organizations/{CGuid}/m365`	User token
ListM365Licenses `POST /discover/ListM365Licenses/`	GET `/v2/organizations/{CGuid}/systems/{SystemID}/m365`	User token
Populatem365Licenses `POST /discover/Populatem365Licenses/`	POST `/v2/organizations/{CGuid}/systems/{SystemID}/m365/sync`	User token
ListEntitlements `POST /Entitlements/ListEntitlements/`	GET `/v2/organizations/{CGuid}/entitlements` GET `/v2/organizations/{CGuid}/systems/{SystemID}/entitlements`	User token or API key
AddEntitlement `POST /Entitlements/AddEntitlement/`	POST `/v2/organizations/{CGuid}/entitlements`	User token
ModifyEntitlement `POST /Entitlements/ModifyEntitlement/`	PUT PATCH `/v2/organizations/{CGuid}/entitlements/{Guid}`	User token
DeleteEntitlement `POST /Entitlements/DeleteEntitlement/`	DELETE `/v2/organizations/{CGuid}/entitlements/{Guid}`	User token
ADListDomainData `POST /discover/ADListDomainData/`	GET `/v2/organizations/{CGuid}/ad/domains/{DomainObjectGUID}`	User token
ADSearchUser `POST /discover/ADSearchUser/`	GET `/v2/organizations/{CGuid}/ad/users`	User token
ADCheckUpdateAllowed `POST /discover/ADCheckUpdateAllowed/`	POST `/v2/engine/ad/check`	Engine token
ADUpdateForestData `POST /discover/ADUpdateForestData/`	PUT `/v2/engine/ad/forest`	Engine token
ADUpdateDomainData `POST /discover/ADUpdateDomainData/`	PUT `/v2/engine/ad/domain`	Engine token
ADUpdateDomainStatistics `POST /discover/ADUpdateDomainStatistics/`	PUT `/v2/engine/ad/statistics`	Engine token
ADUpdateDomainUserData `POST /discover/ADUpdateDomainUserData/`	PUT `/v2/engine/ad/users`	Engine token
ADUpdateDomainControllers `POST /discover/ADUpdateDomainControllers/`	PUT `/v2/engine/ad/domaincontrollers`	Engine token
createserver `POST /discover/createserver/`	POST `/v2/engine/assets`	Engine token
CreateAccount `POST /account/CreateAccount/`	POST `/v2/account/users`	Account token
OnBoardAccount `POST /account/OnBoardAccount/`	POST `/v2/account/onboarding`	Account token
OffBoardAccount `POST /account/OffBoardAccount/`	POST `/v2/account/offboarding`	Account token
AcceptOrder `POST /discover/AcceptOrder/`	POST `/v2/webhooks/stripe`	Stripe signature

Session and plan

Who the caller is, and the plan-level administration of co-admins.

SecBuildTicket

Returns the caller's organizations with their permission flags and plan roles. The web app calls it after sign-in. On a user's first sign-in after an invitation it also binds the account to the user's object id and grants Read.

GET https://api.moleant.com/v2/me

v1 alias: POST https://api.moleant.com/discover/SecBuildTicket/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are query parameters.

No further parameters.

Example request

GET https://api.moleant.com/v2/me
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

An object with a Roles array and a GlobalRoles object. The response carries no status, so the submessage the handler sets is not sent.

Attribute	Description	Example
`Roles[].guid`	Organization GUID.	7a8b26724e508ade
`Roles[].roles`	The caller's permission flags in it.	11100000000000000000000000000000
`Roles[].CustomerName`	Organization name.	Contoso AB
`Roles[].Plan`	The plan that owns the organization.	f17f35b5...
`Roles[].isDiscoverAdmin, Roles[].isCoAdmin`	`"1"` or `"0"`: whether the caller owns or co-administers a plan. Strings.	1
`Roles[].ADDomains`	Array of the organization's AD domain names.	["corp.example.com"]
`GlobalRoles.CreationEmail`	E-mail the account was created with.	grace@contoso.com
`GlobalRoles.Email`	Current e-mail.	grace@contoso.com
`GlobalRoles.isDiscoverAdmin, GlobalRoles.isCoAdmin`	`"1"` or `"0"`. Strings.	1

Example response

{"Roles":[
  {"guid":"7a8b26724e508ade","roles":"11100000000000000000000000000000","CustomerName":"Contoso AB",
   "Plan":"f17f35b5...","isDiscoverAdmin":"1","isCoAdmin":"0","ADDomains":["corp.example.com"]}
],
 "GlobalRoles":{"CreationEmail":"grace@contoso.com","Email":"grace@contoso.com","isDiscoverAdmin":"1","isCoAdmin":"0"}}

Failures, in addition to the common failures:

`subcode`	Cause
`email: You have not been added to the MoleAnt Discover system. Please contact your system administrator`	No user record has the user token's e-mail address.

Changes in this version: Unchanged output; the route is GET /v2/me.

ListAccounts

For every organization where the caller is Account admin, lists the users' role rows and the organization's API keys. This is the user-management view of the web app.

GET https://api.moleant.com/v2/accounts

v1 alias: POST https://api.moleant.com/discover/ListAccounts/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are query parameters.

No further parameters.

Example request

GET https://api.moleant.com/v2/accounts
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A Permissions array, one entry per organization.

Attribute	Description	Example
`Permissions[].guid`	Organization GUID.	7a8b26724e508ade
`Permissions[].CustomerName`	Organization name.	Contoso AB
`Permissions[].orgid`	Agent id of the organization. Treat it as a secret.	5e0c...
`Permissions[].roles[].email`	User e-mail address.	grace@contoso.com
`Permissions[].roles[].roles`	Permission flags; see Permission levels.	11000000000000000000000000000000
`Permissions[].roles[].id`	Role row id. Send it as `UserID` to ModifyPermission. A number.	117
`Permissions[].keys[].key`	An API key of the organization.	c9c42981ebf50a4749c2

Example response

{"Permissions":[
  {"guid":"7a8b26724e508ade","CustomerName":"Contoso AB","orgid":"5e0c...",
   "roles":[{"email":"grace@contoso.com","roles":"11000000000000000000000000000000","id":117}],
   "keys":[{"key":"c9c42981ebf50a4749c2"}]}
]}

Empty result: HTTP 200 with {"Permissions":[]}.

Failures are the common failures only.

ListCoAdmins

Lists the users who share organizations with the caller, optionally narrowed to the co-admins and owner of the caller's plan, or to everyone else.

GET https://api.moleant.com/v2/coadmins

v1 alias: POST https://api.moleant.com/discover/ListCoAdmins/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`Userlist`	No	`Members` (the plan's owner and co-admins) or `Nonmembers` (everyone else). Omit for everyone.	Case-sensitive.
`Subject`	No	Read, never used.

Example request

GET https://api.moleant.com/v2/coadmins?Userlist=Nonmembers
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A SelectableAdmins array, one entry per user.

Attribute	Description	Example
`SelectableAdmins[].Email`	User e-mail address.	grace@contoso.com
`SelectableAdmins[].Objectid`	User object id. Send it as `Subject`.	74c78695-356f-4b00-8b62-bc4e166c37b2

Example response

{"SelectableAdmins":[{"Email":"grace@contoso.com","Objectid":"74c78695-356f-4b00-8b62-bc4e166c37b2"}]}

Empty result: HTTP 200 with {"SelectableAdmins":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Incorrect membersetting. Leave unset for full list.`	`Userlist` was set to something else.
`User email does not have permission to list users for any customer.`	The caller is neither Discover admin nor co-admin.

AddCoAdmin

Makes a user a co-admin of the plan the caller owns or co-administers. The user must already have access to an organization of that plan.

POST https://api.moleant.com/v2/coadmins

v1 alias: POST https://api.moleant.com/discover/AddCoAdmin/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`Subject`	Yes	Object id of the user, `Objectid` from ListCoAdmins.	GUID, max 120.

Example request

POST https://api.moleant.com/v2/coadmins
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Subject":"74c78695-356f-4b00-8b62-bc4e166c37b2"}

Response

A status message. On success the subcode is The user was successfully set as a CoAdmin (no full stop).

Failures, in addition to the common failures:

`subcode`	Cause
`You must specify a correct ObjectID of the Subject.`	`Subject` was missing or not a GUID.
`The specified subject could not be found.`	No user has that object id.
`The specified object could not be found.`	The caller's user record was not found.
`Cannot set this user as CoAdmin as they are already set as DiscoverAdmin/Owner for a Plan.`	The user owns a plan.
`Cannot set this user as CoAdmin as they are already set as CoAdmin for a Plan.`	The user is already a co-admin.
`The user has not been invited to the Plan the he needs to be in order to become a CoAdmin`	The user has no access to the plan's organizations.
`You lack the proper permissions to add someone as a CoAdmin`	The caller is neither Discover admin nor co-admin.
`An unknown error occured.`	Anything else.

DeleteCoAdmin

Removes a user's co-admin role in the caller's plan.

DELETE https://api.moleant.com/v2/coadmins/{Subject}

v1 alias: POST https://api.moleant.com/discover/DeleteCoAdmin/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`Subject`	Yes	Path segment. Object id of the co-admin.	GUID, max 120.

Example request

DELETE https://api.moleant.com/v2/coadmins/74c78695-356f-4b00-8b62-bc4e166c37b2
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is The user was successfully removed as a CoAdmin (no full stop).

Failures, in addition to the common failures:

`subcode`	Cause
`You must specify a correct ObjectID of the Subject.`	`Subject` was missing or not a GUID.
`The specified subject could not be found.`	No user has that object id.
`User email does not have permission to demote coadmins for any customer.`	The caller is neither Discover admin nor co-admin.
`The specified object could not be found.`	The caller's user record was not found.
`You cannot demote yourself from coadmin.`	The caller named themself.
`Cannot remove the permissions from this user as they are already set as DiscoverAdmin/Owner for a Plan.`	The user owns a plan.
`You cannot change a user that has another plan than yours.`	The user belongs to another plan.
`You lack the proper permissions to remove someone as a CoAdmin`	The caller may not change this user.
`An unknown error occured.`	Anything else.

Organizations

An organization is the unit of data: assets, systems, users and files belong to exactly one. A plan owns one or more organizations.

ListOrganizations

Lists every organization in which the caller has Read permission.

GET https://api.moleant.com/v2/organizations

v1 alias: POST https://api.moleant.com/discover/ListOrganizations/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are query parameters.

No further parameters.

Example request

GET https://api.moleant.com/v2/organizations
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

An Organisations array — note the British spelling.

Attribute	Description	Example
`Organisations[].Organization`	Organization name.	Contoso AB
`Organisations[].CustomerShortName`	Short name.	Contoso
`Organisations[].CustomerDetails`	Free-text details.	Head office and two branches
`Organisations[].CustomerDetailsCut`	The same value truncated to 40 characters, with a trailing ellipsis when it was cut.	Head office and two branches
`Organisations[].Description`	Description, HTML-entity encoded.	Nordic manufacturing group
`Organisations[].DescriptionCut`	The same value truncated to 40 characters.	Nordic manufacturing group
`Organisations[].CGUID`	Organization GUID.	7a8b26724e508ade

Example response

{"Organisations":[
  {"Organization":"Contoso AB","CustomerShortName":"Contoso",
   "CustomerDetails":"Head office and two branches","CustomerDetailsCut":"Head office and two branches",
   "Description":"Nordic manufacturing group","DescriptionCut":"Nordic manufacturing group",
   "CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Organisations":["No organization information was found for this system."]}.

Failures are the common failures only.

AddOrganization

Creates a new organization under the caller's plan and provisions its tables. The new organization counts against the plan's organization quota.

POST https://api.moleant.com/v2/organizations

v1 alias: POST https://api.moleant.com/discover/AddOrganization/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CustomerName`	Yes	Display name of the organization.	Text, max 255.
`CustomerShortName`	Yes	Short name.	Text, max 50.
`CGuid`	No	Ignored. The new organization gets a generated GUID.

Example request

POST https://api.moleant.com/v2/organizations
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"CustomerName":"Contoso AB","CustomerShortName":"Contoso"}

Response

A status message. On success the subcode is Successfully created organization.. The new CGuid is returned in the status message.

Returned ids: on success the status message also carries CGuid for the new record.

Failures, in addition to the common failures:

`subcode`	Cause
`CustomerName and CustomerShortName must be specified.`	A name was missing or empty.
`User is not a Discover admin or a Co-admin.`	The caller owns or co-administers no plan.
`You have used up all n organizations you were allowed to create.`	The plan's organization quota is used up.
`Unknown error.`	The plan's quota could not be read.
`Sorry, an error occurred.`	The organization could not be created. Nothing is left behind: the tables made for it are dropped again and no organization, user or role row is added. What went wrong is written to the API's error log and mailed to the administrators; the caller is never told.
`An unexpected error occurred while processing this request.`	Any other error.

Changes in this version: Creating an organization is all or nothing. Every table is created and checked before the organization, role and user rows are added; if anything fails, the tables made so far are dropped again, the details are written to the error log and mailed to the administrators, and the caller gets only Sorry, an error occurred. Earlier versions added the rows first and returned success even when some tables were missing.

ListOrganizationDetails

Returns an organization's descriptive fields and its system and asset counts.

GET https://api.moleant.com/v2/organizations/{CGuid}

v1 alias: POST https://api.moleant.com/discover/ListOrganizationDetails/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade
X-Api-Key: c9c42981ebf50a4749c2

Response

An OrganizationDetails array with one element.

Attribute	Description	Example
`OrganizationDetails[].status`	Always `OK` on success.	OK
`OrganizationDetails[].CustomerName`	Organization name.	Contoso AB
`OrganizationDetails[].CustomerShortName`	Short name.	Contoso
`OrganizationDetails[].CustomerDetails`	Free-text details.	Head office and two branches
`OrganizationDetails[].orgid`	The organization's agent id: the `token` Moleant Engine sends. Treat it as a secret.	5e0c...
`OrganizationDetails[].Description`	Description, HTML-entity encoded.	Nordic manufacturing group
`OrganizationDetails[].NumberOfSystems`	Number of systems. A number.	7
`OrganizationDetails[].NumberOfAssets`	Number of assets. A number.	42
`OrganizationDetails[].HQAddress`	Head-office address, HTML-entity encoded.	Storgatan 1<br>111 51 Stockholm

Example response

{"OrganizationDetails":[
  {"status":"OK","CustomerName":"Contoso AB","CustomerShortName":"Contoso",
   "CustomerDetails":"Head office and two branches","orgid":"5e0c...",
   "Description":"Nordic manufacturing group","NumberOfSystems":7,"NumberOfAssets":42,
   "HQAddress":"Storgatan 1<br>111 51 Stockholm"}
]}

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to get organization details.`	The caller lacks Read.
`Organization does not exist.`	No organization has that GUID.

Changes in this version: orgid (the engine token) is returned only to callers with Write on the organization; others get an empty string.

ModifyOrganizationDetails

Updates an organization's name, short name, description and address. Only the fields you send are changed; at least one is required.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}

v1 alias: POST https://api.moleant.com/discover/ModifyOrganizationDetails/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`CustomerName`	No	New organization name.	Text, max 120.
`CustomerShortName`	No	New short name.	Text, max 40.
`Description`	No	New description.	Text, max 4096.
`HQAddress`	No	New head-office address.	Text, max 4096.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Description":"Nordic manufacturing group"}

Response

A status message. On success the subcode is Successfully modified information about the organization..

Failures, in addition to the common failures:

`subcode`	Cause
`CustomerShort, CustomerShortName, Description or HQAddress must be specified.`	No field to change was sent.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to change the organization data for this customer.`	The caller lacks Write.
`Organization does not exist and cannot be modified.`	No organization has that GUID.
`Failed to modify the organization.`	The write failed.

DeleteOrganization

Deprovisions an organization: removes it, its tables and its users' access to it.

Irreversible. Every asset, system, log entry and attachment of the organization goes with it. The template organization ABCD1234 cannot be deleted.

DELETE https://api.moleant.com/v2/organizations/{CGuid}

v1 alias: POST https://api.moleant.com/discover/DeleteOrganization/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Successfully deleted organization..

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User is not a Discover admin or a Co-admin.`	The caller owns or co-administers no plan.
`User is not a Discover admin or a Co-admin for this particular organization.`	The organization belongs to another plan.
`Sorry, an error occurred.`	The organization could not be removed completely. It stays listed, so the removal can be repeated. What went wrong is written to the API's error log and mailed to the administrators; the caller is never told.
`An unexpected error occurred while processing this request.`	Any other error.

Changes in this version: Removing an organization is all or nothing. Every table is dropped and checked before the organization's rows and files are removed; if a table cannot be dropped the organization stays listed so the removal can be repeated, the details are written to the error log and mailed to the administrators, and the caller gets only Sorry, an error occurred. A plan whose organization count cannot be lowered no longer turns a completed removal into Unknown error.

ListMasterLogEntries

Returns the 250 most recent master-log entries of every organization the caller has a role in (or of one, with CGuid), merged and sorted newest first. This handler also serves v2 orglog, where every field is described; called with an API key it returns {"MasterLogs":[]}.

GET https://api.moleant.com/v2/masterlog

GET https://api.moleant.com/v2/organizations/{CGuid}/masterlog

v1 alias: POST https://api.moleant.com/discover/ListMasterLogEntries/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Narrow to one organization.	Alphanumeric, max 50.
`FilterAdmin`	No	`"1"`: only entries with `ItemClass` `Admin`.	Digits, max 2.
`FilterAuth`	No	`"1"`: leave out entries with `ItemClass` `Auth`. Overrides `FilterAdmin`.	Digits, max 2.
`SystemID, ServerID`	No	Read, never used.

Example request

GET https://api.moleant.com/v2/masterlog?FilterAuth=1
X-Api-Key: c9c42981ebf50a4749c2

Response

A MasterLogs array.

Attribute	Description	Example
`MasterLogs[].LogDate / LogTime / LastEpoch`	When; `LastEpoch` is the Unix time and the sort key. A number.	2026-08-18 / 14:22:07 / 1786976527
`MasterLogs[].id, LogID, LogAuthorID, ServerID, SystemID`	Numbers.	91204, 4471, 0, 38, 0
`MasterLogs[].LogDescription, LogName, LogType, LogAuthor, LogClass, ItemClass, Severity, EntityName, PrincipalName, PrincipalID, ObjectPrincipal, guid`	As in v2 orglog. `PrincipalID` is usually the acting user's object GUID.
`MasterLogs[].CustomerName`	Organization the entry came from.	Contoso AB
`MasterLogs[].CGuid`	GUID of the organization the entry came from.

Example response

{"MasterLogs":[
  {"LogDate":"2026-08-18","LogTime":"14:22:07","LastEpoch":1786976527,"id":91204,"LogID":4471,
   "LogDescription":"Environment changed to Production","LogAuthor":"alovelace","LogType":4,
   "LogName":"Configuration change","ServerID":38,"guid":"b13f...","LogClass":"System Event",
   "SystemID":0,"LogAuthorID":0,"Severity":"Information","EntityName":"SRV-FILE01",
   "PrincipalName":"alovelace@contoso.com","PrincipalID":"74c78695-356f-4b00-8b62-bc4e166c37b2",
   "CGuid":"7a8b26724e508ade","CustomerName":"Contoso AB","ObjectPrincipal":"SRV-FILE01","ItemClass":"Admin"}
]}

Empty result: HTTP 200 with {"MasterLogs":[]}.

Failures are the common failures only.

API keys

API keys authenticate integrations. A key belongs to one organization and grants Read and Write on it.

ListKeys

Lists API keys. Each entry names the organization the key belongs to.

GET https://api.moleant.com/v2/organizations/{CGuid}/keys

v1 alias: POST https://api.moleant.com/discover/ListKeys/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Hex, max 100.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/keys
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A Keys array.

Attribute	Description	Example
`Keys[].OrgID`	GUID of the organization the key belongs to.	7a8b26724e508ade
`Keys[].OrgName`	Its name.	Contoso AB
`Keys[].Key`	The key.	c9c42981ebf50a4749c2
`Keys[].KeyDescription`	The key's name.	Power BI export

Example response

{"Keys":[{"OrgID":"7a8b26724e508ade","OrgName":"Contoso AB","Key":"c9c42981ebf50a4749c2","KeyDescription":"Power BI export"}]}

Empty result: HTTP 200 with {"Keys":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`CGuid is missing.`	`CGuid` was missing or not hex.
`User does not have permission to list keys for this organization.`	The caller lacks Read.

Changes in this version: Only the keys of the requested organization are returned. Earlier versions returned the keys of every organization the caller could see.

AddKey

Stores a new API key for the organization.

POST https://api.moleant.com/v2/organizations/{CGuid}/keys

v1 alias: POST https://api.moleant.com/discover/AddKey/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Hex, max 100.
`Key`	Yes	The key value.	Hex. Up to 100 characters are stored, but only keys of at most 20 characters are accepted when used.
`Name`	Yes	Name of the key.	Text, max 200.

Uniqueness is not checked. Generate keys from a strong random source.

Example request

POST https://api.moleant.com/v2/organizations/7a8b26724e508ade/keys
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Key":"c9c42981ebf50a4749c2","Name":"Power BI export"}

Response

A status message. On success the subcode is Successfully added the key..

Returned ids: on success the status message also carries Key for the new record.

Failures, in addition to the common failures:

`subcode`	Cause
`CGuid is missing.`	`CGuid` was missing or not hex.
`Key is missing.`	`Key` was missing or not hex.
`Key name is missing.`	`Name` was missing.
`User does not have permission to modify attributes for this organization.`	The caller lacks Write (sic).

Changes in this version: A key must be at least 16 characters. When Key is left out the API generates a 40-character key and returns it in the Key field of the status message.

DeleteKey

Deletes an API key of the organization. The call succeeds even when the organization has no such key.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/keys/{Key}

v1 alias: POST https://api.moleant.com/discover/DeleteKey/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Hex, max 100.
`Key`	Yes	Path segment. The key to delete.	Hex, max 100.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/keys/c9c42981ebf50a4749c2
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Successfully deleted the key..

Failures, in addition to the common failures:

`subcode`	Cause
`CGuid is missing.`	`CGuid` was missing or not hex.
`Key is missing.`	`Key` was missing or not hex.
`User does not have permission to delete attributes for this organization.`	The caller lacks Write (sic).

Users and permissions

Users are Entra ID identities with a permission set per organization; see Permission levels.

InviteUser

Gives a person access to the caller's organizations. An address that already has a Moleant Discover account is granted access and notified by e-mail. Otherwise Mode decides: Invite sends a Microsoft Entra B2B invitation (the address must belong to a Microsoft 365 organization), and Create creates a new account in Moleant's own directory and e-mails the sign-in details. New users start with Read permission.

POST https://api.moleant.com/v2/organizations/{CGuid}/users

v1 alias: POST https://api.moleant.com/discover/InviteUser/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. An organization in which the caller is Account admin.	Alphanumeric, max 255.
`Email`	Yes	The person's e-mail address.	E-mail, max 255.
`Mode`	Yes	`Invite` or `Create`.	Case-sensitive.
`FirstName`	Conditional	Given name. Required for `Create`.	Text, max 255.
`LastName`	Conditional	Surname. Required for `Create`.	Text, max 255.

Example request

POST https://api.moleant.com/v2/organizations/7a8b26724e508ade/users
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Email":"grace@fabrikam.com","Mode":"Invite"}

Response

A status message. The Success subcodes, with their submessage, are:

`subcode`	`submessage`	Meaning
`Invitation sent to already existing user.`	Invitations sent.	An existing account was given access.
`User already have access to the same organizations as you do.`	Invitations sent.	Nothing to do.
`Invitation sent and user added.`	Invitations sent.	`Invite`: the B2B invitation went out.
`The user already exists and will not be added for this customer`	Invitations not needed.	`Invite`: the user already has a role here.
`User was successfully created.`	User was successfully created.	`Create`: the account exists and the e-mail was sent.

Failures, in addition to the common failures:

`subcode`	Cause
`Mode not specified or incorrect.`	`Mode` was not `Invite` or `Create`.
`Firstname and Lastname must be specified when creating a new user.`	`Create` without names.
`Email must be specified.`	`Email` was missing or not an e-mail address.
`FALSE`	With `submessage` `Organization data missing.`: `CGuid` was missing.
`User email does not have permission to perform this operation.`	The caller lacks Account admin.
`Could not handle existing users. Please contact system administration.`	The existing account could not be updated.
`The domain does not appear to be a Microsoft federation. Could not send invite.`	`Invite` to an address outside Microsoft 365.
`Could not authenticate with the Microsoft Graph API. Please contact MoleAnt System Administration.`	Moleant could not get a Graph token.
`Could not send invitation. Please make sure the use has a school/business account at Office365 and that the user is not using a @moleant.com-address.`	Graph rejected the invitation.
`Could not send invitation. Please contact MoleAnt System Administration.`	The invitation failed for another reason.
`Cannot find the Plan bound to the caller.`	The caller has no plan.
`The target email is already used for another user.`	`Create` for an address that is taken.
`Failed to create user. EC: …`	`Create`: Graph rejected the new account. The Graph error follows `EC:`.
`An error occurred while creating the user. Please try again later.`	`Create` failed for another reason.
`General error. Please contact system administration.`	Anything else.

Changes in this version: The Graph failure messages no longer carry an internal suffix. A created user's welcome mail is HTML.

DeleteUser

Removes a user. If the user belongs to the caller's plan, the user record and all of the user's roles are deleted. Otherwise only the user's roles in organizations of the caller's plan are removed. The plan owner cannot be deleted, and neither can the caller.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/users/{Email}

v1 alias: POST https://api.moleant.com/discover/DeleteUser/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. An organization in which the caller is Account admin.	Alphanumeric, max 255.
`Email`	Yes	Path segment. E-mail address of the user to remove.	E-mail, max 255.
`Mode`	No	Read, never used.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/users/grace%40contoso.com
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is User was successfully deleted., with the same text in submessage.

Failures, in addition to the common failures:

`subcode`	Cause
`Email must be specified.`	`Email` was missing or not an e-mail address.
`FALSE`	With `submessage` `Organization data missing.`: `CGuid` was missing.
`User email does not have permission to delete users for this customer.`	The caller lacks Account admin.
`User not found and could not be deleted.`	No user has that e-mail address.
`You may not delete your own admin-rights.`	The caller tried to delete themself.
`User email does not have permission to delete users for any customer.`	The caller is neither Discover admin nor co-admin.
`This user is not permissible to delete as they own the Plan.`	The user is the plan owner. `submessage`: `User could not be deleted.`

Changes in this version: Removing a user from another plan's organizations works for plans with several organizations (the old query failed with a database error).

ModifyPermission

Turns individual permission flags of one role row on or off, and logs the change. Flags you do not send are left as they are.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}/roles/{UserID}

v1 alias: POST https://api.moleant.com/discover/ModifyPermission/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 255.
`UserID`	Yes	Path segment. Id of the role row to change, `roles[].id` from ListAccounts. Not a user object id.	Digits, max 5.
`Read`	No	`"true"` or `"false"` — strings, not booleans.	Anything else leaves the flag unchanged.
`Write`	No	`"true"` or `"false"`.
`Admin`	No	`"true"` or `"false"`: Account admin.	You cannot change your own.
`ReadPassword`	No	`"true"` or `"false"`.
`WritePassword`	No	`"true"` or `"false"`.
`PlanOwner, OrgAdmin`	No	Read, never used.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/roles/117
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Read":"true","Write":"true"}

Response

A status message. On success the subcode is Permissions updated successfully.; submessage is OK.

Failures, in addition to the common failures:

`subcode`	Cause
`Permissions not declared.`	No flag was sent.
`FALSE`	With `submessage` `Organization data missing.`, `UserID data missing.`, `Incorrect CGuid specified.` (the role row is not in that organization) or `Unable to find Plan for organisation.`
`User does not have permission to change this user email data.`	The caller lacks Account admin.
`User not found...User does not have permission to change this user data.`	No role row has that id.
`You may not delete your own admin-rights.`	The caller sent `Admin` for their own role row.
`This user is not permissible to change as they own the Plan.`	The user owns the plan. `submessage`: `User could not be deleted.`

Address book

Contacts of an organization.

ListAddressBook

Lists every address-book entry of the organization.

GET https://api.moleant.com/v2/organizations/{CGuid}/addressbook

v1 alias: POST https://api.moleant.com/discover/ListAddressBook/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/addressbook
X-Api-Key: c9c42981ebf50a4749c2

Response

An AddressBook array.

Attribute	Description	Example
`AddressBook[].id`	Row id. A number.	5
`AddressBook[].GivenName / LastName / Initial`	Name.	Ada / Lovelace / AL
`AddressBook[].Phone / Email`	Contact details.	+46 8 123 45 67 / ada@contoso.com
`AddressBook[].Role / Notes`	Role and notes, HTML-entity encoded.	System owner
`AddressBook[].Guid`	Entry GUID. Used by the Modify and Delete calls and by RACI tasks.	e41f...

Example response

{"AddressBook":[
  {"id":5,"GivenName":"Ada","LastName":"Lovelace","Initial":"AL","Phone":"+46 8 123 45 67",
   "Email":"ada@contoso.com","Role":"System owner","Notes":"","Guid":"e41f..."}
]}

Empty result: HTTP 200 with {"AddressBook":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to list the addressbook for this customer.`	The caller lacks Read.

AddAddressBookEntry

Adds a person to the address book.

POST https://api.moleant.com/v2/organizations/{CGuid}/addressbook

v1 alias: POST https://api.moleant.com/discover/AddAddressBookEntry/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`GivenName`	Yes	Given name.	Text, max 250.
`LastName`	Yes	Surname.	Text, max 250.
`Initial`	No	Initials.	Text, max 250.
`Phone`	No	Phone number.	Text, max 250.
`Email`	No	E-mail address. When sent it must be valid.	E-mail, max 250.
`Role`	No	Role or title.	Text, max 4096.
`Notes`	No	Notes.	Text, max 4096.

Example request

POST https://api.moleant.com/v2/organizations/7a8b26724e508ade/addressbook
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"GivenName":"Ada","LastName":"Lovelace","Email":"ada@contoso.com","Role":"System owner"}

Response

A status message. On success the subcode is Successfully added the person to the AddressBook.. The new Guid is returned in the status message.

Returned ids: on success the status message also carries Guid for the new record.

Failures, in addition to the common failures:

`subcode`	Cause
`The email-address in the addressbook is not correctly formatted.`	`Email` was not a valid address.
`GivenName invalid or missing.`	`GivenName` was missing.
`LastName invalid or missing.`	`LastName` was missing.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to add a person to the AddressBook for this customer.`	The caller lacks Write.
`Failed to add person to AddressBook.`	The write failed.

ModifyAddressBookEntry

Rewrites an address-book entry. Every field is replaced: send the complete entry, since omitted fields are cleared.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}/addressbook/{Guid}

v1 alias: POST https://api.moleant.com/discover/ModifyAddressBookEntry/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`Guid`	Yes	Path segment. Entry GUID.	Hex, max 120.
`GivenName`	Yes	Given name.	Text, max 250.
`LastName`	Yes	Surname.	Text, max 250.
`Initial`	No	Initials.	Text, max 250.
`Phone`	No	Phone number.	Text, max 250.
`Email`	No	E-mail address. When sent it must be valid.	E-mail, max 250.
`Role`	No	Role or title.	Text, max 4096.
`Notes`	No	Notes.	Text, max 4096.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/addressbook/e41f...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"GivenName":"Ada","LastName":"Lovelace","Initial":"AL","Phone":"+46 8 123 45 67","Email":"ada@contoso.com","Role":"System owner","Notes":"Back from leave in May"}

Response

A status message. On success the subcode is Successfully modified the person in the AddressBook..

Failures, in addition to the common failures:

`subcode`	Cause
`The email-address in the addressbook is not correctly formatted.`	`Email` was not a valid address.
`GivenName invalid or missing.`	`GivenName` was missing.
`LastName invalid or missing.`	`LastName` was missing.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Object Guid missing or invalid.`	`Guid` was missing or not hex.
`User does not have permission to modify a person in the AddressBook for this customer.`	The caller lacks Write.
`The person does not exist in the addressbook and thus cannot be modified.`	No entry has that GUID.
`Failed to modify the person in the AddressBook.`	The write failed.

DeleteAddressBookEntry

Deletes an address-book entry.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/addressbook/{Guid}

v1 alias: POST https://api.moleant.com/discover/DeleteAddressBookEntry/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`Guid`	Yes	Path segment. Entry GUID.	Hex, max 250.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/addressbook/e41f...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Addressbookentry was successfully deleted..

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`Guid is missing or invalid.`	`Guid` was missing or not hex.
`User does not have permission to delete AddressBookEntry for this customer.`	The caller lacks Write.
`This address book entry does not exist.`	No entry has that GUID.
`Addressbookentry could not be deleted.`	The delete failed.

Attributes (tags)

Custom fields defined per organization and filled in per organization, system or asset. The web app calls them tags.

ListAttributes

Lists the attribute values set on one card, followed by the organization's other attributes of that card type with empty values, so the result can drive an edit form. Without a card it lists every attribute definition of every organization the caller may read, each with its Organization and CGUID.

A card (OrgID, SystemID or ServerID) is read from the organization in CGuid only: system and asset ids are unique within an organization, not across organizations.

GET https://api.moleant.com/v2/organizations/{CGuid}/attributes

v1 alias: POST https://api.moleant.com/discover/ListAttributes/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Hex, max 100.
`OrgID`	No	Organization card to read. Takes precedence over `SystemID` and `ServerID`.	Hex, max 100.
`SystemID`	No	System card to read.	Digits, max 10.
`ServerID`	No	Asset card to read.	Digits, max 10.
`AttributeGuid`	No	Read, never used.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/attributes?SystemID=12
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

An Attributes array.

Attribute	Description	Example
`Attributes[].Name`	Attribute name.	Cost centre
`Attributes[].ID`	Id of the value row, as a string; empty for an attribute without a value.	31
`Attributes[].ItemValue`	The value; empty when unset.	4410
`Attributes[].HRLocation`	Human-readable kind and place, e.g. `A single row in a system`; empty when unset.	A single row in a system
`Attributes[].AttributeGuid`	Attribute GUID.	4be1...
`Attributes[].Type`	`0` row or `1` block. A number.	0
`Attributes[].CardType`	`0` organization, `1` system, `2` asset. A number.	1
`Attributes[].Organization`	Name of the organization the attribute came from.	Contoso AB
`Attributes[].CGUID`	GUID of the organization the attribute belongs to: the `CGuid` to use when changing or deleting it.	7a8b26724e508ade

Example response

{"Attributes":[
  {"Name":"Cost centre","ID":"31","ItemValue":"4410","HRLocation":"A single row in a system",
   "AttributeGuid":"4be1...","Type":0,"CardType":1,"Organization":"Contoso AB","CGUID":"7a8b26724e508ade"},
  {"Name":"Owner","ID":"","HRLocation":"","ItemValue":"","Type":0,"CardType":1,
   "AttributeGuid":"8c02...","Organization":"Contoso AB","CGUID":"7a8b26724e508ade"}
]}

An organization without attributes answers HTTP 200 with the placeholder {"Attributes":["No attributes were found"]}.

Failures, in addition to the common failures:

`subcode`	Cause
`User does not have permission to list attributes for this organization.`	The caller lacks Read.

Changes in this version: A card (OrgID, SystemID or ServerID) is read from the organization in CGuid only; earlier versions of this release mixed in the values and attributes that other organizations of the caller hold for the same id, and those could not be saved. Without a card, the attributes of every organization the caller may read are returned, each with Organization and CGUID. An empty result is HTTP 200 with a placeholder, no longer the failure No attributes were found.

AddAttribute

Defines a new attribute for the organization. The definition applies organization-wide to cards of its CardType; give it values with ModifyAttributeValue.

POST https://api.moleant.com/v2/organizations/{CGuid}/attributes

v1 alias: POST https://api.moleant.com/discover/AddAttribute/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Hex, max 100.
`Name`	Yes	Attribute name.	Text, max 5000.
`Type`	Yes	`0` a single row, `1` a block of text.	Digits, max 3.
`CardType`	Yes	Where it appears: `0` organization, `1` system, `2` asset.	Digits, max 3.
`OrgID, SystemID, ServerID`	One of them	At least one must be sent, but none is stored.	OrgID: Hex, max 100. The ids: Digits, max 5.

Example request

POST https://api.moleant.com/v2/organizations/7a8b26724e508ade/attributes
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"OrgID":"7a8b26724e508ade","Name":"Cost centre","Type":"0","CardType":"1"}

Response

A status message. On success the subcode is Successfully added the attribute..

Returned ids: on success the status message also carries AttributeGuid for the new record.

Failures, in addition to the common failures:

`subcode`	Cause
`CGuid missing`	With `submessage` `ListAttributes failure.`: `CGuid` was missing or not hex.
`User does not have permission to add attributes for this organization.`	The caller lacks Write.
`Name is missing.`	`Name` was missing.
`CardType is missing.`	`CardType` was missing.
`Type is missing.`	`Type` was missing.
`OrgID, SystemID or ServerID must be set.`	None of the three was sent.

ModifyAttribute

Changes the name of an attribute definition.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}/attributes/{AttributeGuid}

v1 alias: POST https://api.moleant.com/discover/ModifyAttribute/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Hex, max 100.
`AttributeGuid`	Yes	Path segment. The attribute.	Hex, max 100.
`Name`	Yes	New name.	Text, max 5000.
`OrgID`	Yes	Required by the validation, otherwise unused.	Hex, max 100.
`SystemID, ServerID`	No	Read, never used.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/attributes/4be1...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"OrgID":"7a8b26724e508ade","Name":"Cost center"}

Response

A status message. On success the subcode is Successfully modified the attribute..

Failures, in addition to the common failures:

`subcode`	Cause
`CGuid missing`	With `submessage` `Modifyattributes failure.`
`OrgID is missing.`	`OrgID` was missing.
`AttributeGuid is missing.`	`AttributeGuid` was missing.
`Name is missing.`	`Name` was missing.
`User does not have permission to modify attributes for this organization.`	The caller lacks Write.
`This attribute does not exist.`	No attribute has that GUID.

DeleteAttribute

Deletes an attribute definition.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/attributes/{AttributeGuid}

v1 alias: POST https://api.moleant.com/discover/DeleteAttribute/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Hex, max 100.
`AttributeGuid`	Yes	Path segment. The attribute.	Hex, max 100.
`OrgID, SystemID, ServerID, Name`	No	Read, never used.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/attributes/4be1...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Successfully deleted the attribute..

Failures, in addition to the common failures:

`subcode`	Cause
`CGuid missing`	With `submessage` `DeleteAttributes failure.`
`AttributeGuid is missing.`	`AttributeGuid` was missing or not hex.
`User does not have permission to delete attributes for this organization.`	The caller lacks Write.
`This attribute does not exist.`	No attribute has that GUID.

ModifyAttributeValue

Sets the value of an attribute on one organization, system or asset card, creating the value row the first time.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}/attributes/{AttributeGuid}/value

v1 alias: POST https://api.moleant.com/discover/ModifyAttributeValue/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Hex, max 100.
`AttributeGuid`	Yes	Path segment. The attribute.	Hex, max 100.
`ItemValue`	Yes	The value.	Text, max 5000.
`OrgID, SystemID, ServerID`	One of them	The card to set it on.	OrgID: Hex, max 100. The ids: Digits, max 5.
`Name`	No	Read, never used.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/attributes/4be1.../value
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"SystemID":"12","ItemValue":"4410"}

Response

A status message. On success the subcode is Successfully edited the tag. when a value is replaced, and New value added to tag. when the first value is set.

Failures, in addition to the common failures:

`subcode`	Cause
`CGuid missing`	With `submessage` `ListAttributes failure.`
`OrgID, SystemID or ServerID is missing.`	No card was named.
`AttributeGuid is missing.`	`AttributeGuid` was missing.
`User does not have permission to modify attributes for this organization.`	The caller lacks Write.
`This attribute does not exist.`	No attribute has that GUID.
`This systemid, serverid or orgid does not exist`	The named card does not exist.

Log entries

The organization's master log: audit entries the API writes, and entries users write for systems and assets.

ListLogEntries

Lists the log entries of a system, an asset, some log classes, or the whole organization, newest first. This handler also serves v2 systemlog.

GET https://api.moleant.com/v2/organizations/{CGuid}/logs

GET https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/logs

GET https://api.moleant.com/v2/organizations/{CGuid}/assets/{ServerID}/logs

v1 alias: POST https://api.moleant.com/discover/ListLogEntries/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID. Ignored with a key.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Entries of this system, without routine check-in entries.	Digits, max 10.
`ServerID`	Yes	Path segment. Entries of this asset, without routine check-in entries.	Digits, max 10.
`Filter`	No	Array of `LogClass` values; returns entries of those classes and overrides the ids.	Array, Text, max 50 each.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/logs?Filter[]=System%20Event
X-Api-Key: c9c42981ebf50a4749c2

Response

A SystemLogs array.

Attribute	Description	Example
`SystemLogs[].LogDescription`	Display name of the log type.	Configuration change
`SystemLogs[].LogType`	Log type code.	4
`SystemLogs[].LogAuthor`	Who or what wrote the entry.	alovelace
`SystemLogs[].Logdate / Logtime`	Entry date and time. Note the lower-case `d` and `t`.	2026-08-18 / 14:22:07
`SystemLogs[].guid`	Entry GUID. Pass it to ModifyLogEntry and DeleteLogEntry.	b13f...
`SystemLogs[].Severity`	Severity.	Information
`SystemLogs[].EntityName`	Name of the entity the entry concerns.	Payroll
`SystemLogs[].ObjectPrincipal`	Principal associated with the object.	alovelace@contoso.com
`SystemLogs[].LogClass, SystemID, ServerID`	Present only when neither `SystemID` nor `ServerID` was sent. The ids are numbers, `0` when not applicable.	System Event, 12, 0
`SystemLogs[].ItemClass`	Item classification.	Admin
`SystemLogs[].Description`	The entry text.	Environment changed to Production

Example response

{"SystemLogs":[
  {"LogDescription":"Configuration change","LogType":4,"LogAuthor":"alovelace",
   "Logdate":"2026-08-18","Logtime":"14:22:07","guid":"b13f...","Severity":"Information",
   "EntityName":"Payroll","ObjectPrincipal":"alovelace@contoso.com","LogClass":"System Event",
   "SystemID":12,"ServerID":0,"ItemClass":"Admin","Description":"Environment changed to Production"}
]}

Empty result: HTTP 200 with {"SystemLogs":["No logs were found for this system."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Organisation ID invalid or empty.`	`CGuid` was missing or malformed.
`Filter definitions are malformed.`	`Filter` was not an array.
`You have selected too many LogClass entries for this query.`	`Filter` had too many values.

Changes in this version: Read permission on the organization is required; earlier versions did not check it.

AddLogEntry

Writes a user log entry for a system or an asset. The entry's date and time are taken from LogEpoch.

POST https://api.moleant.com/v2/organizations/{CGuid}/logs

POST https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/logs

POST https://api.moleant.com/v2/organizations/{CGuid}/assets/{ServerID}/logs

v1 alias: POST https://api.moleant.com/discover/AddLogEntry/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. The system. At least one of `SystemID` and `ServerID` is required; send both and two entries are written, one for each.	Digits, max 10.
`ServerID`	Yes	Path segment. The asset.	Digits, max 10.
`LogType`	Yes	Log type code from ListSystemLogTypes.	Digits, max 3.
`LogDescription`	Yes	The entry text.	Text, max 255.
`LogAuthor`	Yes	Author shown on the entry.	Text, max 255.
`LogEpoch`	Yes	When it happened, as a Unix timestamp in seconds.	Digits, max 30.
`Logdate, Logtime`	No	Read, never used.

Example request

POST https://api.moleant.com/v2/organizations/7a8b26724e508ade/logs
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"SystemID":"12","LogType":"4","LogDescription":"Patched to 2.4.1","LogAuthor":"alovelace","LogEpoch":"1786976527"}

Response

A status message. On success the subcode is Successfully added the log entry..

Returned ids: on success the status message also carries guid for the new record.

Failures, in addition to the common failures:

`subcode`	Cause
`Logtype invalid or empty.`	`LogType` was missing or not numeric.
`LogDescription invalid or empty.`	`LogDescription` was missing.
`LogAuthor invalid or empty.`	`LogAuthor` was missing.
`LogEpoch invalid or empty.`	`LogEpoch` was missing or not numeric.
`User does not have permission to add log data for this customer.`	The caller lacks Write.
`Failed to add entry. SystemID and ServerID both missing.`	Neither id was sent.
`System does not exist and logs cannot be added.`	No system has that id.
`Server does not exist and logs cannot be added.`	No asset has that id.

ModifyLogEntry

Rewrites a log entry. All fields are required.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}/logs/{guid}

v1 alias: POST https://api.moleant.com/discover/ModifyLogEntry/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`guid`	Yes	Path segment. Entry GUID.	Hex, max 40.
`SystemID`	Conditional	The system. One of `SystemID` and `ServerID` is required.	Digits, max 10.
`ServerID`	Conditional	The asset.	Digits, max 10.
`LogType`	Yes	Log type code.	Digits, max 3.
`LogDescription`	Yes	The entry text.	Text, max 255.
`LogAuthor`	Yes	Author.	Text, max 255.
`Logdate`	Yes	Date.	Date, max 30.
`Logtime`	Yes	Time.	Text, max 30.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/logs/b13f...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"SystemID":"12","LogType":"4","LogDescription":"Patched to 2.4.2","LogAuthor":"alovelace","Logdate":"2026-08-18","Logtime":"14:22:07"}

Response

A status message. On success the subcode is Successfully modified the log entry..

Failures, in addition to the common failures:

`subcode`	Cause
`Logtype invalid or empty.`	`LogType` was missing.
`LogDescription invalid or empty.`	`LogDescription` was missing.
`LogAuthor invalid or empty.`	`LogAuthor` was missing.
`Logdate invalid or empty.`	`Logdate` was missing or not a date.
`LogTime invalid or empty.`	`Logtime` was missing.
`Guid invalid or empty.`	`guid` was missing or not hex.
`User does not have permission to modfify log data for this customer.`	The caller lacks Write (sic).
`Failed to modify entry. SystemID and ServerID both missing.`	Neither id was sent.
`Failed to modify entry. The entry does not exist.`	No entry has that GUID.
`Technical problems prevented this operation from succeeding.`	The write failed.

Changes in this version: An entry keeps its LogClass (System for system entries); earlier versions set it to Server.

DeleteLogEntry

Deletes one log entry.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/logs/{guid}

v1 alias: POST https://api.moleant.com/discover/DeleteLogEntry/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`guid`	Yes	Path segment. Entry GUID, `SystemLogs[].guid`.	Hex, max 250.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/logs/b13f...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Successfully deleted Logentry (no full stop).

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to delete system kb for this customer.`	The caller lacks Write (sic).
`Failed to delete Logentry.`	The delete failed.

ListSystemLogTypes

Returns the global list of log types used by LogType. The same for every organization.

GET https://api.moleant.com/v2/logtypes

v1 alias: POST https://api.moleant.com/discover/ListSystemLogTypes/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	No	Ignored.
`SystemID`	No	Ignored.	Digits, max 10.

Example request

GET https://api.moleant.com/v2/logtypes
X-Api-Key: c9c42981ebf50a4749c2

Response

A SystemLogTypes array.

Attribute	Description	Example
`SystemLogTypes[].LogType`	Log type code. Send it as `LogType`.	4
`SystemLogTypes[].LogDescription`	Display name.	Configuration change

Example response

{"SystemLogTypes":[{"LogType":4,"LogDescription":"Configuration change"}]}

Empty result: HTTP 200 with {"SystemLogTypes":["No logtypes were found for this system."]}.

Failures are the common failures only.

Systems

A system groups assets that together deliver a service or application. Active Directory domains and Microsoft 365 tenants are systems too.

ListSystems

Lists the systems of one organization, or of several through a multi-organization query. This handler also serves v2 systems.

GET https://api.moleant.com/v2/organizations/{CGuid}/systems

POST https://api.moleant.com/v2/systems/search

v1 alias: POST https://api.moleant.com/discover/ListSystems/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID for a single-organization query. Required with a user token unless `Organizations` is sent; ignored with a key.	Alphanumeric, max 50.
`Organizations`	Conditional	Array of organization objects for a multi-organization query. User token only.
`IncludeOrgName`	No	`"TRUE"` fills `OrganizationName`.	Case-sensitive.
`IncludeDetails`	No	`"TRUE"` also fills `OrganizationName`.	Case-sensitive.
`Skip`	No	Rows to skip. Applied only together with `Count`.	Digits, 0–1000000.
`Count`	No	Rows to return. Applied only together with `Skip`.	Digits, 0–1000000.
`ServerID`	No	Array of asset ids: return only systems containing one of them.	Digits, max 10 each.
`SystemID`	No	Array of system ids to return. Must be an array.	Digits, max 10 each.
`UserID`	No	Array of user ids: return only systems with one of these users on a member asset.	Alphanumeric, max 50 each.
`ComputerSoftware`	No	Array of applications (`Name` or `Name-.-Version`) installed on a member asset.	Text, max 1024 each.
`issueNo`	No	Array of issue numbers found on a member asset.	Digits, max 4 each.
`Search`	No	Substring match on the system name.	Text, max 120.

The filter fields apply to a single-organization query. In a multi-organization query each Organizations element carries its own filters.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems?Skip=0&Count=25&IncludeOrgName=TRUE
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

An object with a Query header array and a Systems array, ordered by system name.

Attribute	Description	Example
`Query[].ResultCount`	Number of rows in `Systems`. A number.	7
`Query[].TotalCount`	Total matching rows before paging. A number.	7
`Systems[].SystemName`	System name. Results are ordered by this field.	Payroll
`Systems[].SystemID`	Numeric system id. A number.	12
`Systems[].SystemDescription`	Full description, HTML-entity encoded.	Payroll and HR processing
`Systems[].SystemDescriptionCut`	The description truncated to 40 characters, with a trailing ellipsis when it was cut.	Payroll and HR processing
`Systems[].SystemTypeMask`	32-bit system-type bitmask as a string: `1000…` general, `0100…` Active Directory, `0010…` Microsoft 365.	10000000000000000000000000000000
`Systems[].SystemTypeMaskHR`	Human-readable form of the mask: `General`, `Active Directory`, `Microsoft M365` or `Unknown`.	General
`Systems[].OrganizationName`	Customer name when `IncludeOrgName` or `IncludeDetails` is `"TRUE"`, otherwise empty.	Contoso AB
`Systems[].CGUID`	Organization GUID.	7a8b26724e508ade
`Systems[].SystemType`	Always the literal string `Not implemented`.	Not implemented
`Systems[].SystemTypeID`	Always the literal string `Not implemented`.	Not implemented

Example response

{"Query":[{"ResultCount":1,"TotalCount":1}],"Systems":[
  {"SystemName":"Payroll","SystemID":12,"SystemDescription":"Payroll and HR processing",
   "SystemDescriptionCut":"Payroll and HR processing","SystemTypeID":"Not implemented",
   "SystemType":"Not implemented","OrganizationName":"Contoso AB",
   "SystemTypeMask":"10000000000000000000000000000000","SystemTypeMaskHR":"General",
   "CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Systems":["No System information was found."]} and no Query object.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	A user-token call sent neither `CGuid` nor `Organizations`.
`Invalid count range.`	`Count` was out of range.
`Invalid skip range.`	`Skip` was out of range.
`You have selected too many … for this query.`	A filter cap was exceeded; see Multi-organization queries.
`Request is malformed.`	`SystemID` was not an array.
`No organizations specified.`	An `Organizations` element had no `OrgName`.
`User does not have permission to list systems for this customer.`	The caller lacks Read on a requested organization.

Changes in this version: Filters accept a single value as well as an array, and query-string values are URL-decoded.

ListSystemsForReport

A variant of ListSystems for the report pages: multi-organization only, without the type-mask fields.

POST https://api.moleant.com/v2/reports/systems

v1 alias: POST https://api.moleant.com/discover/ListSystemsForReport/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`Organizations`	Yes	Array of organization objects; see Multi-organization queries.
`IncludeOrgName`	No	`"TRUE"` fills `OrganizationName`.	Case-sensitive.
`IncludeDetails`	No	`"TRUE"` also fills `OrganizationName`.	Case-sensitive.
`Skip`	No	Rows to skip. Applied only together with `Count`.	Digits, 0–1000000.
`Count`	No	Rows to return. Applied only together with `Skip`.	Digits, 0–1000000.

Search does not work on this endpoint. It filters on an installed-application column that exists only when the same organization also carries a ComputerSoftware filter; without one the call ends in a database error.

Example request

POST https://api.moleant.com/v2/reports/systems
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Organizations":[{"OrgName":"7a8b26724e508ade","ServerID":["38"]},{"OrgName":"4f0e9b2ac1d37e55"}]}

Response

An object with a Query header array and a Systems array.

Attribute	Description	Example
`Query[].ResultCount`	Number of rows in `Systems`. A number.	7
`Query[].TotalCount`	Total matching rows before paging. A number.	7
`Systems[].SystemName`	System name. Results are ordered by this field.	Payroll
`Systems[].SystemID`	Numeric system id. A number.	12
`Systems[].SystemDescription`	Full description, HTML-entity encoded.	Payroll and HR processing
`Systems[].OrganizationName`	Customer name when requested, otherwise empty.	Contoso AB
`Systems[].CGUID`	Organization GUID.	7a8b26724e508ade
`Systems[].SystemType`	Always `Not implemented`.	Not implemented
`Systems[].SystemTypeID`	Always `Not implemented`.	Not implemented

Example response

{"Query":[{"ResultCount":1,"TotalCount":1}],"Systems":[
  {"SystemName":"Payroll","SystemID":12,"SystemDescription":"Payroll and HR processing",
   "SystemTypeID":"Not implemented","SystemType":"Not implemented","OrganizationName":"",
   "CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Systems":["No System information was found."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Invalid count range.`	`Count` was out of range.
`Invalid skip range.`	`Skip` was out of range.
`You have selected too many … for this query.`	A filter cap was exceeded.
`Request is malformed.`	`SystemID` was not an array.
`User does not have permission to list one or more systems specified for this call.`	The caller lacks Read on a requested organization.
`No organizations specified.`	`Organizations` was missing, or an element had no `OrgName`.

Changes in this version: OrganizationName is "" rather than null when the name is not requested.

ListSystemDetails

Returns the descriptive fields of one system.

GET https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}

v1 alias: POST https://api.moleant.com/discover/ListSystemDetails/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID. Ignored with a key.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12
X-Api-Key: c9c42981ebf50a4749c2

Response

A SystemDetails array with one element.

Attribute	Description	Example
`SystemDetails[].status`	`OK` on success. Check it: the empty result uses the same array.	OK
`SystemDetails[].systemname`	System name.	Payroll
`SystemDetails[].systemdescription`	Description, HTML-entity encoded.	Payroll and HR processing
`SystemDetails[].systemPermissionSetting`	Free-text permission notes.
`SystemDetails[].systemVerification`	Free-text verification notes.
`SystemDetails[].systemBackupRestore`	Free-text backup and restore notes.
`SystemDetails[].systemother`	Other notes; set with `Other` in ModifySystemDetails.
`SystemDetails[].SystemTypeMask`	System-type bitmask; see ListSystems.	01000000000000000000000000000000
`SystemDetails[].DomainDNSRoot`	AD domain of an Active Directory system, otherwise empty.	corp.example.com
`SystemDetails[].DomainObjectGUID`	Object GUID of that domain.	5b1e...

Example response

{"SystemDetails":[
  {"status":"OK","systemname":"Payroll","systemdescription":"Payroll and HR processing",
   "systemPermissionSetting":"","systemVerification":"","systemBackupRestore":"",
   "systemother":"","SystemTypeMask":"10000000000000000000000000000000",
   "DomainDNSRoot":"","DomainObjectGUID":""}
]}

Empty result: HTTP 200 with {"SystemDetails":[{"status":"No SystemDetails was found for this system."}]} — an object, not a string, so tell the two apart by status. This is also the answer for a system id that does not exist.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`System ID missing or invalid.`	`SystemID` was missing or not numeric.
`User does not have permission to get system details.`	The caller lacks Read.

AddSystem

Creates an empty system and logs the event.

POST https://api.moleant.com/v2/organizations/{CGuid}/systems

v1 alias: POST https://api.moleant.com/discover/AddSystem/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemName`	Yes	Name of the new system.	Text, max 255.

Example request

POST https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"SystemName":"Payroll"}

Response

A status message. On success the subcode is Successfully add the system. (sic). The new SystemID is returned in the status message.

Returned ids: on success the status message also carries SystemID for the new record.

Failures, in addition to the common failures:

`subcode`	Cause
`SystemName invalid.`	`SystemName` was missing or too long.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to change the system data for this customer.`	The caller lacks Write.
`Cannot add empty system.`	The name was blank.
`System could not be created.`	The write failed.

ModifySystemDetails

Updates a system's name, description and other notes. Only the fields you send are changed.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}

v1 alias: POST https://api.moleant.com/discover/ModifySystemDetails/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`Hostname`	No	The new system name — despite the field name.	Text, max 255. Must not be blank.
`Description`	No	New description.	Text, max 4096.
`Other`	No	New other notes (`systemother`).	Text, max 4096.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Hostname":"Payroll 2","Description":"Payroll and HR processing"}

Response

A status message. On success the subcode is Successfully modified data to the system..

Failures, in addition to the common failures:

`subcode`	Cause
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to change the system data for this customer.`	The caller lacks Write.
`System does not exist and cannot be modified.`	No system has that id.
`SystemName cannot be empty.`	`Hostname` was blank.
`Failed to modify the system.`	The write failed.

DeleteSystem

Deletes a system together with its attachments, licences and log entries other than those classed as System Event. For a Microsoft 365 system it also removes the stored tenant and licence data, and for an Active Directory system the stored directory data of its domain. Member assets are not deleted.

Irreversible. There is no soft-delete and no undo.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}

v1 alias: POST https://api.moleant.com/discover/DeleteSystem/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 6.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Successfully deleted the system..

Failures, in addition to the common failures:

`subcode`	Cause
`SystemID missing or invalid.`	`SystemID` was missing or too long.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to change the system data for this customer.`	The caller lacks Write.
`System does not exist.`	No system has that id.
`System could not be deleted.`	The delete failed.

Changes in this version: Also removes the system's asset memberships, RACI tasks, attribute values, SBOM and VEX data and stored files.

ListServersInSystem

Lists the assets that are members of a system, the assets that are not, or all assets.

GET https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/assets

v1 alias: POST https://api.moleant.com/discover/ListServersInSystem/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`ServerList`	Yes	`Members`, `Nonmembers` or `Both` (all assets, regardless of membership).	Case-sensitive.
`SystemID`	Yes	Path segment. Numeric system id. Required unless `ServerList` is `Both`.	Digits, max 10.
`ServerID`	No	Ignored, except that it satisfies the presence check when `SystemID` is missing.	Digits, max 10.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/assets
X-Api-Key: c9c42981ebf50a4749c2

Response

A Servers array. Which fields carry values depends on ServerList.

Attribute	Description	Example
`Servers[].ServerID`	Numeric asset id. A number.	38
`Servers[].Description`	Asset-card description; empty for `Nonmembers`.	Primary file server
`Servers[].Environment`	Environment id, a number — `Members` only, otherwise an empty string.	2
`Servers[].EnvironmentName`	Environment name — `Members` only.	Production
`Servers[].EnvironmentDescription`	Environment description — `Members` only.
`Servers[].Hostname`	Asset hostname.	SRV-FILE01

Example response

{"Servers":[
  {"ServerID":38,"Description":"Primary file server","Environment":2,
   "EnvironmentName":"Production","EnvironmentDescription":"","Hostname":"SRV-FILE01"}
]}

Empty result: HTTP 200 with {"Servers":[]} — an empty array, not a placeholder.

Failures, in addition to the common failures:

`subcode`	Cause
`ServerList is missing or invalid.`	`ServerList` was missing or not one of the three values.
`SystemID and ServerID is invalid or missing..`	Neither id was sent and `ServerList` is not `Both`.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to list servers for this system.`	The caller lacks Read.

AddServerToSystem

Adds an asset to a system. AddSystemToServer does the same from the asset's side.

PUT https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/assets/{ServerID}

v1 alias: POST https://api.moleant.com/discover/AddServerToSystem/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`ServerID`	Yes	Path segment. Numeric asset id.	Digits, max 10.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/assets/38
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Successfully added the server to the system.. If the asset is already a member, the call succeeds with Server already present in system. No change was made.

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID is missing or invalid.`	`ServerID` was missing or not numeric.
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to server to the system for this customer.`	The caller lacks Write.
`System does not exist.`	No system has that id.
`Server does not exist and cannot be added.`	No asset has that id.
`Failed to add server to system.`	The write failed.

RemoveServerFromSystem

Removes an asset's membership of a system. RemoveSystemFromServer does the same from the asset's side.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/assets/{ServerID}

v1 alias: POST https://api.moleant.com/discover/RemoveServerFromSystem/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`ServerID`	Yes	Path segment. Numeric asset id.	Digits, max 10.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/assets/38
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Successfully removed the server from the system.. If the asset was not a member, the call succeeds with Server not present in system. No change was made.

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID is missing or invalid.`	`ServerID` was missing or not numeric.
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to server to the system for this customer.`	The caller lacks Write.
`Server does not exist and cannot be removed.`	No asset has that id.
`Failed to remove the server from the system.`	The delete failed.

ListSystemsForServer

Lists the systems an asset is a member of, the systems it is not in, or all systems.

GET https://api.moleant.com/v2/organizations/{CGuid}/assets/{ServerID}/systems

v1 alias: POST https://api.moleant.com/discover/ListSystemsForServer/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`ServerID`	Yes	Path segment. Numeric asset id. Required unless `ServerList` is `Both`.	Digits, max 10.
`ServerList`	Yes	`Members`, `Nonmembers` or `Both` (all systems).	Case-sensitive.
`SystemID`	No	Ignored.	Digits, max 10.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/assets/38/systems
X-Api-Key: c9c42981ebf50a4749c2

Response

A Systems array.

Attribute	Description	Example
`Systems[].SystemID`	Numeric system id. A number.	12
`Systems[].SystemDescription`	Description, HTML-entity encoded.	Payroll and HR processing
`Systems[].SystemName`	System name.	Payroll

Example response

{"Systems":[{"SystemID":12,"SystemDescription":"Payroll and HR processing","SystemName":"Payroll"}]}

Empty result: HTTP 200 with {"Systems":["No system member information was found for this server."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`ServerList is missing or invalid.`	`ServerList` was missing.
`SystemList is missing or invalid.`	`ServerList` was not one of the three values (sic).
`User does not have permission to list systems for this server.`	The caller lacks Read.

AddSystemToServer

Identical to AddServerToSystem — same fields, same messages — for use from the asset view.

PUT https://api.moleant.com/v2/organizations/{CGuid}/assets/{ServerID}/systems/{SystemID}

v1 alias: POST https://api.moleant.com/discover/AddSystemToServer/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`ServerID`	Yes	Path segment. Numeric asset id.	Digits, max 10.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/assets/38/systems/12
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Successfully added the server to the system., or Server already present in system. No change was made.

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID is missing or invalid.`	`ServerID` was missing or not numeric.
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to server to the system for this customer.`	The caller lacks Write.
`System does not exist.`	No system has that id.
`Server does not exist and cannot be added.`	No asset has that id.
`Failed to add server to system.`	The write failed.

RemoveSystemFromServer

Identical to RemoveServerFromSystem, for use from the asset view.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/assets/{ServerID}/systems/{SystemID}

v1 alias: POST https://api.moleant.com/discover/RemoveSystemFromServer/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`ServerID`	Yes	Path segment. Numeric asset id.	Digits, max 10.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/assets/38/systems/12
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Successfully removed the server from the system., or Server not present in system. No change was made.

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID is missing or invalid.`	`ServerID` was missing or not numeric.
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to server to the system for this customer.`	The caller lacks Write.
`Server does not exist and cannot be removed.`	No asset has that id.
`Failed to remove the server from the system.`	The delete failed.

System licences

Licence records attached to a system.

ListSystemLicenseTypes

Returns the global list of licence types used by LicModel. The same for every organization.

GET https://api.moleant.com/v2/licensetypes

v1 alias: POST https://api.moleant.com/discover/ListSystemLicenseTypes/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	No	Ignored.
`SystemID`	No	Ignored.	Digits, max 10.

Example request

GET https://api.moleant.com/v2/licensetypes
X-Api-Key: c9c42981ebf50a4749c2

Response

A SystemLicenseTypes array.

Attribute	Description	Example
`SystemLicenseTypes[].LicenseType`	Licence type id. Send it as `LicModel`.	2
`SystemLicenseTypes[].LicenseDescription`	Display name.	Per server

Example response

{"SystemLicenseTypes":[{"LicenseType":1,"LicenseDescription":"Per user"},{"LicenseType":2,"LicenseDescription":"Per server"}]}

Empty result: HTTP 200 with {"SystemLicenseTypes":["No licensetypes were found for this system."]}.

Failures are the common failures only.

ListSystemLicenses

Lists a system's licence records, newest first.

GET https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/licenses

v1 alias: POST https://api.moleant.com/discover/ListSystemLicenses/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/licenses
X-Api-Key: c9c42981ebf50a4749c2

Response

A SystemLicenses array.

Attribute	Description	Example
`SystemLicenses[].LicenseDescription`	Display name of the licence type.	Per server
`SystemLicenses[].LicenseModel`	Licence model of the type.	Server
`SystemLicenses[].LicName`	Licence name.	Payroll Server 2026
`SystemLicenses[].LicKey`	Licence key.	XXXXX-XXXXX
`SystemLicenses[].guid`	Licence GUID.	b7f0...
`SystemLicenses[].LicExp`	Expiry date.	2027-01-31

Example response

{"SystemLicenses":[
  {"LicenseDescription":"Per server","LicenseModel":"Server","LicName":"Payroll Server 2026",
   "LicKey":"XXXXX-XXXXX","guid":"b7f0...","LicExp":"2027-01-31"}
]}

Empty result: HTTP 200 with {"SystemLicenses":["No licenses were found for this system."]}.

Failures are the common failures only.

Changes in this version: Read permission on the organization is required; earlier versions did not check it.

AddSystemLicense

Adds a licence record to a system.

POST https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/licenses

v1 alias: POST https://api.moleant.com/discover/AddSystemLicense/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`LicModel`	Yes	Licence type id, `LicenseType` from ListSystemLicenseTypes.	Digits, max 3.
`LicName`	Yes	Licence name.	Text, max 255.
`LicKey`	Yes	Licence key.	Text, max 255.
`LicExp`	Yes	Expiry date.	Date, max 60.

Example request

POST https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/licenses
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"LicModel":"2","LicName":"Payroll Server 2026","LicKey":"XXXXX-XXXXX","LicExp":"2027-01-31"}

Response

A status message. On success the subcode is Successfully added system license entry..

Returned ids: on success the status message also carries guid for the new record.

Failures, in addition to the common failures:

`subcode`	Cause
`LicModel invalid or empty.`	`LicModel` was missing or not numeric.
`LicName invalid or empty.`	`LicName` was missing.
`LicKey invalid or empty.`	`LicKey` was missing.
`LicExp invalid or empty.`	`LicExp` was missing or not a date.
`User does not have permission to add system license data for this customer.`	The caller lacks Write.

ModifySystemLicense

Updates a licence record. Only the fields you send are changed; at least one is required.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/licenses/{guid}

v1 alias: POST https://api.moleant.com/discover/ModifySystemLicense/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`guid`	Yes	Path segment. Licence GUID.	Alphanumeric, max 50.
`LicModel`	No	New licence type id.	Digits, max 3.
`LicName`	No	New licence name.	Text, max 255.
`LicKey`	No	New licence key.	Text, max 255.
`LicExp`	No	New expiry date.	Date, max 60.
`SystemID`	Yes	Path segment. Ignored.	Digits, max 10.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/licenses/b7f0...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"LicExp":"2028-01-31"}

Response

A status message. On success the subcode is Successfully modified system license entry..

Failures, in addition to the common failures:

`subcode`	Cause
`User does not have permission to add system license data for this customer.`	The caller lacks Write.
`The licensed software does not exist.`	No licence has that GUID.
`All necessary fields are empty. Modification failed.`	No field to change was sent.
`Failed to modify License.`	The write failed.

DeleteSystemLicense

Deletes a licence record. The call succeeds even when no record has that GUID.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/licenses/{guid}

v1 alias: POST https://api.moleant.com/discover/DeleteSystemLicense/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`guid`	Yes	Path segment. Licence GUID, `SystemLicenses[].guid`.	Hex, max 50.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/licenses/b7f0...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Successfully deleted system license entry..

Failures, in addition to the common failures:

`subcode`	Cause
`User does not have permission to deleted system license data for this customer.`	The caller lacks Write.

RACI tasks

Responsibility assignments for a system.

ListRACITasks

Lists the RACI tasks of a system.

GET https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/raci

v1 alias: POST https://api.moleant.com/discover/ListRACITasks/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/raci
X-Api-Key: c9c42981ebf50a4749c2

Response

A RACI array.

Attribute	Description	Example
`RACI[].guid`	Task GUID.	a90c...
`RACI[].task`	The task.	Monthly payroll run
`RACI[].Responsible / Accountable / Consulted / Informant`	Address-book entry GUIDs, or empty.	e41f... / 77b2... / /
`RACI[].Notes`	Notes.

Example response

{"RACI":[{"guid":"a90c...","Responsible":"e41f...","Accountable":"77b2...","Consulted":"",
  "task":"Monthly payroll run","Informant":"","Notes":""}]}

Empty result: HTTP 200 with {"RACI":["No RACI information was found for this system."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to list RACI for this customer.`	The caller lacks Read.

AddRACITask

Adds a task to a system's RACI matrix and returns its GUID.

POST https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/raci

v1 alias: POST https://api.moleant.com/discover/AddRACITask/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`Task`	Yes	The task.	Text, max 250.
`R`	No	Responsible: an address-book entry `Guid`.	Text, max 250. Must exist when sent.
`A`	No	Accountable.	As `R`.
`C`	No	Consulted.	As `R`.
`I`	No	Informed.	As `R`.
`N`	No	Notes.	Text, max 2500.

Example request

POST https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/raci
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Task":"Monthly payroll run","R":"e41f...","A":"77b2..."}

Response

A status message. On success it carries the new task's GUID as an extra field:

Returned ids: on success the status message also carries guid for the new record.

{ "message": "Success", "subcode": "RACI task was added.", "submessage": "None", "guid": "a90c..." }

Failures, in addition to the common failures:

`subcode`	Cause
`Task not specified or invalid.`	`Task` was missing.
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to add RACI to this customer.`	The caller lacks Write.
`The system selected for RACI does not exist`	No system has that id.
`The user selected for responsible does not exist`	`R` is not an address-book entry. The same message exists for accountable, consulted and informant.
`Failed to add RACI.`	The write failed.

ModifyRACITask

Rewrites a RACI task, and can move it to another system. Every field is replaced, including Task and N: send the complete task. At least one of R, A, C and I is required.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/raci/{guid}

v1 alias: POST https://api.moleant.com/discover/ModifyRACITask/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. The system the task belongs to afterwards.	Digits, max 10.
`guid`	Yes	Path segment. Task GUID.	Hex, max 250.
`Task`	No	The task.	Text, max 250.
`R`	No	Responsible: an address-book entry `Guid`.	Text, max 250. Must exist when sent.
`A`	No	Accountable.	As `R`.
`C`	No	Consulted.	As `R`.
`I`	No	Informed.	As `R`.
`N`	No	Notes.	Text, max 2500.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/raci/a90c...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Task":"Monthly payroll run","R":"e41f...","A":"77b2...","I":"3d5e..."}

Response

A status message. On success the subcode is RACI task was modified..

Failures, in addition to the common failures:

`subcode`	Cause
`You most specify one of the following: r,a,c,i.`	None of `R`, `A`, `C`, `I` was sent (sic).
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to modify RACI to this customer.`	The caller lacks Write.
`This RACI-task does not exist.`	No task has that GUID.
`Failed to modify RACI.`	The write failed.

DeleteRACITask

Deletes a task from a system's RACI matrix.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/raci/{guid}

v1 alias: POST https://api.moleant.com/discover/DeleteRACITask/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`guid`	Yes	Path segment. Task GUID.	Hex, max 250.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/raci/a90c...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is RACI task was deleted..

Failures, in addition to the common failures:

`subcode`	Cause
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to delete RACI for this customer.`	The caller lacks Write.
`This RACI-task does not exist.`	No task has that GUID.
`Failed to delete RACI.`	The delete failed.

Assets

Assets (servers, workstations) are what Moleant Engine reports. The engine writes them; the API reads, edits the descriptive card, and deletes.

ListComputers

Lists the assets of one organization, with filters and paging. This handler also serves v2 assets, and the response is documented in detail there.

GET https://api.moleant.com/v2/organizations/{CGuid}/assets

v1 alias: POST https://api.moleant.com/discover/ListComputers/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID. Ignored with a key.	Alphanumeric, max 50.
`IncludeDetails`	No	`"TRUE"` adds the asset card: `Description`, `DescriptionCut`, `Environment`, `EnvironmentName` and `OrganizationName`.	Case-sensitive.
`CreateTotalCount`	No	`"1"` computes `TotalCount`.	Digits, max 2.
`Search`	No	Substring match on hostname.	Plain text, max 30.
`ServerID, SystemID, UserID, ComputerSoftware, issueNo`	No	Filter arrays, as in a multi-organization query but at the top level. `UserID` values are Alphanumeric, max 50.	Arrays.
`Skip`	No	Rows to skip. Applied only together with `Count`.	Digits, 0–1000000.
`Count`	No	Rows to return. Applied only together with `Skip`.	Digits, 0–1000000.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/assets?IncludeDetails=TRUE&CreateTotalCount=1&Skip=0&Count=50
X-Api-Key: c9c42981ebf50a4749c2

Response

An object with a Query header array and a Computers array.

Attribute	Description	Example
`Query[].ResultCount`	Number of rows returned. A number.	1
`Query[].TotalCount`	Unpaged total, or `-1` when not computed. A number.	-1
`Computers[].Hostname`	Asset hostname.	SRV-FILE01
`Computers[].ServerID`	Numeric asset id. A number.	38
`Computers[].OperatingSystem`	Reported operating system.	Windows Server 2022 Standard
`Computers[].DateRebooted`	Last recorded reboot.	2026-07-14 03:12:08
`Computers[].DateCreated`	When the asset record was created.	2025-02-02 09:41:11
`Computers[].Updated`	When the asset last checked in.	2026-08-18 22:05:53
`Computers[].Description`	Asset-card description. Empty unless `IncludeDetails` is `"TRUE"`.	Primary file server
`Computers[].DescriptionCut`	The description truncated to 40 characters.	Primary file server
`Computers[].Environment`	Environment id from the asset card, as stored (a numeric string). Empty without details.	2
`Computers[].EnvironmentName`	Environment name. Empty without details.	Production
`Computers[].OrganizationName`	Customer name. Empty unless requested with `IncludeDetails`.	Contoso AB
`Computers[].CGUID`	Organization GUID.	7a8b26724e508ade
`Computers[].UserLoginName, Computers[].UserID`	Placeholders, regenerated at random on every request.

Example response

{"Query":[{"ResultCount":1,"TotalCount":42}],"Computers":[
  {"Hostname":"SRV-FILE01","ServerID":38,"OperatingSystem":"Windows Server 2022 Standard",
   "UserLoginName":"3f0c...","UserID":"a71b...","DateRebooted":"2026-07-14 03:12:08",
   "DateCreated":"2025-02-02 09:41:11","Updated":"2026-08-18 22:05:53",
   "Description":"Primary file server","DescriptionCut":"Primary file server","Environment":"2",
   "EnvironmentName":"Production","OrganizationName":"Contoso AB","CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Computers":["No computer information was found."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to list computers for this customer.`	The caller lacks Read.
`Invalid count range.`	`Count` was out of range.
`Invalid skip range.`	`Skip` was out of range.
`You have selected too many … for this query.`	A filter cap was exceeded; see Multi-organization queries.

Changes in this version: Filters accept a single value as well as an array, and query-string values are URL-decoded. Query parameters of the v2 routes reach the API again: the rewrite rule had dropped them, so IncludeDetails, filters, paging and ?Key= were ignored on the server. With IncludeDetails, an asset whose card has no description still reports its Environment and EnvironmentName.

ListServerDetails

Returns the inventory sections you ask for, for one asset. v2 assetdetails returns the same sections for every asset at once.

GET https://api.moleant.com/v2/organizations/{CGuid}/assets/{ServerID}

v1 alias: POST https://api.moleant.com/discover/ListServerDetails/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`ServerID`	Yes	Path segment. Numeric asset id.	Digits, max 10.
`ServerDetailBasic, ServerDetailCertificates, ServerDetailRoles, ServerDetailCard, ServerDetailHardware, ServerDetailStorage, ServerDetailNetwork, ServerDetailCPU, ServerDetailMemory, ServerDetailShares, ServerDetailSoftware, ServerDetailServices, ServerDetailListeningPorts, ServerDetailLogins, ServerDetailGroups`	At least one	Send `"1"` for each section to include.	Digits, max 2 each.
`ServerDetailPrimaryUser`	No	`"1"` resolves the primary user inside `ServerDetailBasic`.	Digits, max 2.
`ServerDetailApplications`	No	Accepted but produces no section; installed software is `ServerDetailSoftware`.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/assets/38?ServerDetailBasic=1&ServerDetailPrimaryUser=1&ServerDetailCard=1&ServerDetailStorage=1
X-Api-Key: c9c42981ebf50a4749c2

Response

An object with one array per requested section. A section with no data is []. Text reported by the agent is entity-encoded, so a backslash arrives as \.

Attribute	Description	Example
`ServerDetailBasic`	Identity and lifecycle: `HostName`, `IPAddress`, `whenCardCreated` (ISO 8601), `id` (number), `Memory` (bytes, as a numeric string), `operatingsystem`, `servicePrincipalName`, `operatingSystemServicePack`, `Vendor`, `SerialNumber`, `Updated`, `DateCreated`, `DateRebooted`, `PrimaryUserResolvedUser`, `PrimaryUser`, `PossibleDomains`, `guid`. The primary-user fields are filled only when `ServerDetailPrimaryUser` is also `"1"`; `PossibleDomains` is then `[["corp.example.com",…]]` (nested), otherwise `[]`.
`ServerDetailCertificates`	`DNSNames`, `FriendlyNames`, `Oid`, `HasPrivateKey`, `NotAfter`, `NotBefore` (Unix timestamps), `SerialNumber`, `ThumbPrint`, `Subject`, `SubjectName`.
`ServerRoles`	Installed roles: `Name`, `InstallState`, `DisplayName`. Requested with `ServerDetailRoles`.
`ServerDetailCard`	`Description`, `EnvironmentDescription`, `AssetState` (number), `Environment` (number).
`ServerEnvironments`	Sent with `ServerDetailCard`: the organization's environments, `{EnvironmentID (number), EnvironmentName}`.
`AssetStates`	Sent with `ServerDetailCard`: the asset states, `{ID (number), State}`.
`ServerDetailHardware`	Always an empty array.
`ServerDetailStorage`	`MountPoint`, `FreeBytes`, `TotalBytes` (numbers), `FreePCT` (number, one decimal).
`ServerDetailNetwork`	`Name`, `MAC`, `IPAdresses` (array of `{IPaddress, Subnetmask}`; note the spelling), `DNS` (array of `{DNS}`), `Gateway`.
`ServerDetailCPU`	`Model`, `Speed`, `Cores` (number).
`ServerDetailMemory`	`PhysicalMemory`, the same value as `Memory`.
`ServerDetailShares`	`Share`, `Path`.
`ServerDetailSoftware`	`ApplicationName`, `Version`, `Publisher`, `InstallDate`.
`ServerDetailServices`	`Name`, `Displayname`, `StartType`, `Context`.
`ServerDetailListeningPorts`	TCP only: `LocalAddress`, `ListeningPort` (number), `PortType`, `IPVersion`.
`ServerDetailLogins`	`User` — local accounts.
`LastLoggedin`	Sent with `ServerDetailLogins`: `Name`, `Timestamp` (Unix timestamp), newest first.
`ServerDetailGroups`	`LocalGroupName`.

Example response

{"ServerDetailBasic":[{"HostName":"SRV-FILE01","IPAddress":"10.0.4.21",
   "whenCardCreated":"2025-02-02T09:41:11+01:00","id":38,"Memory":"34359738368",
   "operatingsystem":"Windows Server 2022 Standard","servicePrincipalName":"",
   "operatingSystemServicePack":"","Vendor":"Dell Inc.","SerialNumber":"7XK2QP3",
   "Updated":"2026-08-18 22:05:53","DateCreated":"2025-02-02 09:41:11",
   "DateRebooted":"2026-07-14 03:12:08","PrimaryUserResolvedUser":"Ada Lovelace (alovelace)",
   "PrimaryUser":"alovelace","PossibleDomains":[["corp.example.com"]],"guid":"b13f7d0e5a2c"}],
 "ServerDetailCard":[{"Description":"Primary file server","EnvironmentDescription":"Production",
   "AssetState":1,"Environment":2}],
 "ServerEnvironments":[{"EnvironmentID":1,"EnvironmentName":"Test"},{"EnvironmentID":2,"EnvironmentName":"Production"}],
 "AssetStates":[{"ID":1,"State":"In use"}],
 "ServerDetailStorage":[{"MountPoint":"C:","FreeBytes":48318382080,"TotalBytes":137438953472,"FreePCT":35.2}]}

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Server ID missing or invalid.`	`ServerID` was missing or not numeric.
`No server details were specified.`	No section flag was sent.
`No server details were enabled.`	No section flag was `"1"`.
`User does not have permission to get server details.`	The caller lacks Read.
`Server does not exist.`	No asset has that id.
`Server details does not exist.`	The asset has no asset card.
`Execution failed.`	The asset could not be read.

AllServerDetails

Returns the full inventory record — hardware, storage, network, software, services, certificates, logins and more — for every asset in the organization, in one response. For one asset use ListServerDetails.

GET https://api.moleant.com/v2/organizations/{CGuid}/assetdetails

GET https://api.moleant.com/v2/assetdetails (previous v2 form, ?Key=)

Request

Authentication: User token or API key. No parameters.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/assetdetails
X-Api-Key: c9c42981ebf50a4749c2

Response

A bare JSON array — not an object — with one element per asset. Each element carries the sections below. Every section is an array, and a section with no data is an empty array []. An organization without assets returns [].

Section	Contents
`ServerDetailBasic`	Identity and lifecycle: `HostName`, `IPAddress`, `whenCardCreated` (ISO 8601), `id` (number), `Memory` (bytes, as a numeric string), `operatingsystem`, `servicePrincipalName`, `operatingSystemServicePack`, `Vendor`, `SerialNumber`, `Updated`, `DateCreated`, `DateRebooted`, `PrimaryUserResolvedUser` (GivenName SurName (Name)), `PrimaryUser` (SamAccountName), `PossibleDomains`, `guid`.
`ServerDetailCertificates`	`DNSNames`, `FriendlyNames`, `Oid`, `HasPrivateKey`, `NotAfter`, `NotBefore` (both Unix timestamps), `SerialNumber`, `ThumbPrint`, `Subject`, `SubjectName`.
`ServerRoles`	Installed roles only: `Name`, `InstallState`, `DisplayName`.
`ServerDetailCard`	The editable card fields: `Description`, `EnvironmentDescription`, `AssetState` (number), `Environment` (number). These are what Modify Asset writes.
`ServerDetailHardware`	Always an empty array — the section is queried but no fields are written to the response. Read hardware identity from `ServerDetailBasic` instead.
`ServerDetailStorage`	One entry per volume: `MountPoint`, `FreeBytes`, `TotalBytes` (numbers), `FreePCT` (a number with one decimal). Ordered by mount point.
`ServerDetailNetwork`	One entry per adapter: `Name`, `MAC`, `IPAdresses` (array of `{IPaddress, Subnetmask}`), `DNS` (array of `{DNS}`), `Gateway`. Note the spelling of `IPAdresses`.
`ServerDetailCPU`	`Model`, `Speed`, `Cores` (number).
`ServerDetailMemory`	`PhysicalMemory` — the same value as `Memory` in `ServerDetailBasic`.
`ServerDetailShares`	`Share`, `Path`.
`ServerDetailSoftware`	Installed applications: `ApplicationName`, `Version`, `Publisher`, `InstallDate`.
`ServerDetailServices`	`Name`, `Displayname`, `StartType`, `Context`.
`ServerDetailListeningPorts`	TCP ports only: `LocalAddress`, `ListeningPort` (number), `PortType`, `IPVersion`.
`ServerDetailLogins`	`User` — local user accounts on the asset.
`LastLoggedin`	`Name`, `Timestamp` (Unix timestamp). Newest first.
`ServerDetailGroups`	`LocalGroupName`.

PossibleDomains is a nested array: the list of AD domain names is itself wrapped in an outer array, so the value looks like [["corp.example.com","lab.example.com"]]. It is an empty array when the asset has no resolved primary user. There is no ServerDetailApplications section despite the flag of that name existing internally — installed software is under ServerDetailSoftware. Paths and other text reported by the agent are entity-encoded as described in Conventions, so a backslash arrives as \.

Example response

[
  {
    "ServerDetailBasic":[{"HostName":"SRV-FILE01","IPAddress":"10.0.4.21",
      "whenCardCreated":"2025-02-02T09:41:11+01:00","id":38,"Memory":"34359738368",
      "operatingsystem":"Windows Server 2022 Standard","servicePrincipalName":"",
      "operatingSystemServicePack":"","Vendor":"Dell Inc.","SerialNumber":"7XK2QP3",
      "Updated":"2026-08-18 22:05:53","DateCreated":"2025-02-02 09:41:11",
      "DateRebooted":"2026-07-14 03:12:08","PrimaryUserResolvedUser":"Ada Lovelace (alovelace)",
      "PrimaryUser":"alovelace","PossibleDomains":[["corp.example.com"]],"guid":"b13f..."}],
    "ServerDetailCertificates":[],
    "ServerRoles":[{"Name":"FS-FileServer","InstallState":"Installed","DisplayName":"File Server"}],
    "ServerDetailCard":[{"Description":"Primary file server","EnvironmentDescription":"Production",
      "AssetState":1,"Environment":2}],
    "ServerDetailHardware":[],
    "ServerDetailStorage":[{"MountPoint":"C:","FreeBytes":48318382080,
      "TotalBytes":137438953472,"FreePCT":35.2}],
    "ServerDetailNetwork":[{"Name":"Ethernet0","MAC":"00:50:56:9A:11:22",
      "IPAdresses":[{"IPaddress":"10.0.4.21","Subnetmask":"255.255.255.0"}],
      "DNS":[{"DNS":"10.0.1.10"}],"Gateway":"10.0.4.1"}],
    "ServerDetailCPU":[{"Model":"Intel Xeon Silver 4310","Speed":"2100","Cores":12}],
    "ServerDetailMemory":[{"PhysicalMemory":"34359738368"}],
    "ServerDetailShares":[{"Share":"Finance","Path":"D:&#92;Shares&#92;Finance"}],
    "ServerDetailSoftware":[{"ApplicationName":"7-Zip","Version":"23.01",
      "Publisher":"Igor Pavlov","InstallDate":"20250310"}],
    "ServerDetailServices":[{"Name":"LanmanServer","Displayname":"Server",
      "StartType":"Automatic","Context":"LocalSystem"}],
    "ServerDetailListeningPorts":[{"LocalAddress":"0.0.0.0","ListeningPort":445,
      "PortType":"TCP","IPVersion":"IPv4"}],
    "ServerDetailLogins":[{"User":"Administrator"}],
    "LastLoggedin":[{"Name":"alovelace","Timestamp":1786954442}],
    "ServerDetailGroups":[{"LocalGroupName":"Administrators"}]
  }
]

Changes in this version: Every detail table is read once for all assets instead of once per asset.

ModifyServerDetails

Updates the editable fields on an asset card: description, environment, asset state and primary user. Only the fields you send are touched. This handler also serves v2 PUT assets/<ServerID>.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}/assets/{ServerID}

v1 alias: POST https://api.moleant.com/discover/ModifyServerDetails/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID. Ignored with a key.	Alphanumeric, max 50.
`ServerID`	Yes	Path segment. Numeric asset id.	Digits, max 10.
`Description`	No	Free-text description. Creates the card row if it does not exist yet.	Text, max 4096.
`Environment`	No	Environment id, from `ServerEnvironments` in ListServerDetails.	Digits, max 2.
`AssetState`	No	Asset-state id, from `AssetStates`.	Digits, max 2.
`PrimaryUser`	No	SamAccountName of the primary user. The user must exist in the organization's Active Directory data for `Domain`.	SamAccountName, max 250. Requires `Domain`.
`Domain`	Conditional	Root DNS domain of `PrimaryUser`. Mandatory whenever `PrimaryUser` is sent.	DNS name, max 255.

Setting PrimaryUser replaces the asset's existing primary-user record and links the AD user to the asset. An empty PrimaryUser is a no-op, not a way to clear the assignment.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/assets/38
X-Api-Key: c9c42981ebf50a4749c2
Content-Type: application/json

{"Environment":"2","AssetState":"1","PrimaryUser":"alovelace","Domain":"corp.example.com"}

Response

A status message. On success the subcode is Successfully modified the server details..

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID invalid.`	`ServerID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to delete the server data for this customer.`	The caller lacks Write (sic: the message says delete).
`Asset does not exist and cannot be modified.`	No asset has that id.
`When primary user is specified, the Domain must be included as well.`	`PrimaryUser` was sent without `Domain`.
`The user does not exist in the specified Active Directory.`	No AD user matches that SamAccountName in that domain.
`Failed to modify the server.`	The write failed.

Changes in this version: Setting Environment on an asset without a card creates the card correctly (it used to create an orphan row).

DeleteServer

Permanently removes an asset and everything collected about it. This handler also serves v2 DELETE assets/<ServerID>.

Irreversible and wide-reaching. The call deletes the asset row plus its CPU, disk, DNS, installed-application, IP, last-logged-in-user, certificate, role, local-group, local-user, NIC, share, static-route and Windows-service records, its asset-card row, its attachments including the stored blobs, and its log entries other than those classed as System Event.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/assets/{ServerID}

v1 alias: POST https://api.moleant.com/discover/DeleteServer/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID. Ignored with a key.	Alphanumeric, max 50.
`ServerID`	Yes	Path segment. Numeric asset id.	Digits, max 10.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/assets/38
X-Api-Key: c9c42981ebf50a4749c2

Response

A status message. On success the subcode is Successfully deleted the server..

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID invalid.`	`ServerID` was missing or not numeric.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to delete the server data for this customer.`	The caller lacks Write.
`Server does not exist and cannot be modified.`	No asset has that id.
`Server could not be deleted.`	The delete failed.

Changes in this version: Server KB links are deleted only within the caller's organization (an API key of another organization could delete them before). The deletion now also removes the asset's system memberships, listening ports, issues, attribute values, entitlement links and stored files, and the asset card is looked up by asset id (it was looked up by the wrong column).

Knowledge articles (files)

Files attached to an organization, a system or an asset. The file is kept in blob storage; the API stores its name, description and a download reference.

ListOrganizationKBs

Lists the files in the organization's knowledge base.

GET https://api.moleant.com/v2/organizations/{CGuid}/kbs

v1 alias: POST https://api.moleant.com/discover/ListOrganizationKBs/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/kbs
X-Api-Key: c9c42981ebf50a4749c2

Response

A Files array.

Attribute	Description	Example
`Files[].FileName`	Original file name.	network-diagram.pdf
`Files[].Icon`	Icon name for the file type; `kb.svg` when none is known.	pdf.svg
`Files[].Description`	Description, HTML-entity encoded. An empty string, never `null`, when the file has none.	Rack layout
`Files[].RandomNo`	Storage id of the file. Pass it to downloadkb.	3c1f9e0a7b...
`Files[].guid`	Attachment GUID. Pass it to the matching Modify and Delete calls.	9d2e41ab...
`Files[].FileLength`	Size in bytes. A number.	48213

Example response

{"Files":[
  {"FileName":"network-diagram.pdf","Icon":"pdf.svg","Description":"Rack layout",
   "RandomNo":"3c1f9e0a7b...","guid":"9d2e41ab...","FileLength":48213}
]}

Empty result: HTTP 200 with {"Files":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to see the organization KBs.`	The caller lacks Read.

AddOrganizationKBs

Uploads a file to the organization's knowledge base. The file is stored in blob storage and listed by ListOrganizationKBs.

POST https://api.moleant.com/v2/organizations/{CGuid}/kbs

v1 alias: POST https://api.moleant.com/discover/AddOrganizationKBs/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`Filename`	Yes	File name, used for display and to pick the file type.	File name, max 241. The extension must be an allowed upload type.
`Description`	No	Description of the file. May be empty or left out.	Text, max 4096.
`FileData`	Yes	The file content, Base64-encoded.	Base64, max 16,777,216 characters.

Example request

POST https://api.moleant.com/v2/organizations/7a8b26724e508ade/kbs
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Filename":"network-diagram.pdf","Description":"Rack layout","FileData":"JVBERi0xLjcK..."}

Response

A status message. On success the subcode is Upload was successful..

Returned ids: on success the status message also carries guid, RandomNo for the new record.

Failures, in addition to the common failures:

`subcode`	Cause
`Filename missing or invalid.`	`Filename` was missing or contained a forbidden character.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Submitted file is too large, invalid or missing.`	`FileData` was missing, too long or not Base64.
`Extension is not allowed for upload.`	The file type is not on the allowed list.
`User does not have permission to upload to this organization.`	The caller lacks Write.
`Failed to upload file.`	Blob storage or the database write failed.

Changes in this version: Description is optional, as it always was for uploadkb.

ModifyOrganizationKBs

Replaces the description of a file in the organization's knowledge base.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}/kbs/{guid}

v1 alias: POST https://api.moleant.com/discover/ModifyOrganizationKBs/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`guid`	Yes	Path segment. Attachment GUID, `Files[].guid`.	Hex, max 250.
`Description`	Yes	New description.	Text, max 250.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/kbs/9d2e41ab...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Description":"Rack layout, 2026"}

Response

A status message. On success the subcode is Successful modified KB..

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to modify KBs for this customer.`	The caller lacks Write.
`Failed to modify KB.`	The write failed.

DeleteOrganizationKBs

Deletes a file from the organization's knowledge base, including the stored blob.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/kbs/{guid}

v1 alias: POST https://api.moleant.com/discover/DeleteOrganizationKBs/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`guid`	Yes	Path segment. Attachment GUID, `Files[].guid` from ListOrganizationKBs.	Hex, max 250.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/kbs/9d2e41ab...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Successfully deleted the organization KB..

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to delete system kb for this organization.`	The caller lacks Write.
`Failed to delete Organization KB.`	The attachment row could not be removed.
`Failed to delete System KBs`	The stored file could not be removed.

ListSystemKBs

Lists the files in a system's knowledge base, including SBOM and VEX files stored by the uploads.

GET https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/kbs

v1 alias: POST https://api.moleant.com/discover/ListSystemKBs/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/kbs
X-Api-Key: c9c42981ebf50a4749c2

Response

A Files array.

Attribute	Description	Example
`Files[].FileName`	Original file name.	network-diagram.pdf
`Files[].Icon`	Icon name for the file type; `kb.svg` when none is known.	pdf.svg
`Files[].Description`	Description, HTML-entity encoded. An empty string, never `null`, when the file has none.	Rack layout
`Files[].RandomNo`	Storage id of the file. Pass it to downloadkb.	3c1f9e0a7b...
`Files[].guid`	Attachment GUID. Pass it to the matching Modify and Delete calls.	9d2e41ab...
`Files[].FileLength`	Size in bytes. A number.	48213

Example response

{"Files":[
  {"FileName":"runbook.docx","Icon":"docx.svg","Description":"Restore procedure",
   "RandomNo":"3c1f9e0a7b...","guid":"9d2e41ab...","FileLength":184320}
]}

Empty result: HTTP 200 with {"Files":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`System ID missing or invalid.`	`SystemID` was missing or not numeric.
`User does not have permission to download the kb-list.`	The caller lacks Read.

AddSystemKBs

Uploads a file to a system's knowledge base.

POST https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/kbs

v1 alias: POST https://api.moleant.com/discover/AddSystemKBs/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`Filename`	Yes	File name, used for display and to pick the file type.	File name, max 241. The extension must be an allowed upload type.
`Description`	No	Description of the file. May be empty or left out.	Text, max 4096.
`FileData`	Yes	The file content, Base64-encoded.	Base64, max 16,777,216 characters.

Example request

POST https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/kbs
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Filename":"runbook.docx","Description":"Restore procedure","FileData":"UEsDBBQABgAIAAAAIQ..."}

Response

A status message. On success the subcode is Upload was successful..

Returned ids: on success the status message also carries guid, RandomNo for the new record.

Failures, in addition to the common failures:

`subcode`	Cause
`Filename missing or invalid.`	`Filename` was missing or contained a forbidden character.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Submitted file is too large, invalid or missing.`	`FileData` was missing, too long or not Base64.
`Submitted SystemID is too large, invalid or missing.`	`SystemID` was missing or not numeric.
`Extension is not allowed for upload.`	The file type is not on the allowed list.
`User does not have permission to upload to this customer.`	The caller lacks Write.
`Failed to upload file.`	Blob storage or the database write failed.

Changes in this version: Description is optional, as it always was for uploadkb.

ModifySystemKBs

Replaces the description of a file in a system's knowledge base.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/kbs/{guid}

v1 alias: POST https://api.moleant.com/discover/ModifySystemKBs/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`guid`	Yes	Path segment. Attachment GUID, `Files[].guid`.	Hex, max 250.
`Description`	Yes	New description.	Text, max 250.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/kbs/9d2e41ab...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Description":"Restore procedure, v2"}

Response

A status message. On success the subcode is Successful modified KB..

Failures, in addition to the common failures:

`subcode`	Cause
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to modify KBs for this customer.`	The caller lacks Write.
`Failed to modify KB.`	The write failed.

DeleteSystemKBs

Deletes a file from a system's knowledge base, including the stored blob.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/kbs/{guid}

v1 alias: POST https://api.moleant.com/discover/DeleteSystemKBs/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`guid`	Yes	Path segment. Attachment GUID, `Files[].guid` from ListSystemKBs.	Hex, max 250.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/kbs/9d2e41ab...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Successfully deleted the system KB..

Failures, in addition to the common failures:

`subcode`	Cause
`SystemID invalid.`	`SystemID` was missing or not numeric.
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to delete system kb for this customer.`	The caller lacks Write.
`Failed to delete System KB.`	The attachment row could not be removed.
`Failed to remove data from table`	A related row could not be removed.
`Failed to delete System KBs`	The stored file could not be removed.

listkbs

Lists the files attached to an asset.

GET https://api.moleant.com/v2/organizations/{CGuid}/assets/{ServerID}/kbs

v1 alias: POST https://api.moleant.com/discover/listkbs/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`ServerID`	Yes	Path segment. Numeric asset id.	Digits, max 10.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/assets/38/kbs
X-Api-Key: c9c42981ebf50a4749c2

Response

A Files array.

Attribute	Description	Example
`Files[].FileName`	Original file name.	network-diagram.pdf
`Files[].Icon`	Icon name for the file type.	pdf.svg
`Files[].Description`	Description, HTML-entity encoded. An empty string, never `null`, when the file has none.	Rack layout
`Files[].RandomNo`	Storage id of the file. Pass it to downloadkb.	3c1f9e0a7b...
`Files[].guid`	Attachment GUID. Pass it to the matching Modify and Delete calls.	9d2e41ab...
`Files[].FileLength`	Size in bytes. A number.	48213

Example response

{"Files":[
  {"FileName":"warranty.pdf","Icon":"pdf.svg","Description":"Warranty certificate",
   "RandomNo":"3c1f9e0a7b...","guid":"9d2e41ab...","FileLength":48213}
]}

Empty result: HTTP 200 with {"Files":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Server ID missing or invalid.`	`ServerID` was missing or not numeric.
`User does not have permission to download the kb-list.`	The caller lacks Read.

uploadkb

Uploads a file and attaches it to an asset.

POST https://api.moleant.com/v2/organizations/{CGuid}/assets/{ServerID}/kbs

v1 alias: POST https://api.moleant.com/discover/uploadkb/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`ServerID`	Yes	Path segment. Numeric asset id.	Digits, max 10.
`Filename`	Yes	File name, used for display and to pick the file type.	File name, max 241. The extension must be an allowed upload type.
`Description`	No	Description of the file.	Text, max 4096.
`FileData`	Yes	The file content, Base64-encoded.	Base64, max 16,777,216 characters.

Example request

POST https://api.moleant.com/v2/organizations/7a8b26724e508ade/assets/38/kbs
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Filename":"warranty.pdf","Description":"Warranty certificate","FileData":"JVBERi0xLjcK..."}

Response

A status message. On success the subcode is Upload was successful..

Returned ids: on success the status message also carries guid, RandomNo for the new record.

Failures, in addition to the common failures:

`subcode`	Cause
`Filename missing or invalid.`	`Filename` was missing or contained a forbidden character.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Submitted file is too large, invalid or missing.`	`FileData` was missing, too long or not Base64.
`Submitted serverid is too large, invalid or missing.`	`ServerID` was missing or not numeric.
`Extension is not allowed for upload.`	The file type is not on the allowed list.
`User does not have permission to upload to this customer.`	The caller lacks Write.
`Failed to upload file.`	Blob storage or the file record failed.
`2Failed to upload file.`	The file could not be linked to the asset (sic).

ModifyServerKBs

Replaces the description of a file attached to an asset.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}/assets/{ServerID}/kbs/{guid}

v1 alias: POST https://api.moleant.com/discover/ModifyServerKBs/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`ServerID`	Yes	Path segment. Numeric asset id.	Digits, max 10.
`guid`	Yes	Path segment. Attachment GUID, `Files[].guid`.	Hex, max 250.
`Description`	Yes	New description.	Text, max 250.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/assets/38/kbs/9d2e41ab...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Description":"Warranty certificate"}

Response

A status message. On success the subcode is Successful modified KB..

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID invalid.`	`ServerID` was missing or not numeric.
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to modify KBs for this customer.`	The caller lacks Write.
`Failed to modify KB.`	The write failed.

DeleteServerKBs

Deletes a file attached to an asset, including the stored blob.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/assets/{ServerID}/kbs/{guid}

v1 alias: POST https://api.moleant.com/discover/DeleteServerKBs/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`ServerID`	Yes	Path segment. Numeric asset id.	Digits, max 10.
`guid`	Yes	Path segment. Attachment GUID, `Files[].guid` from listkbs.	Hex, max 250.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/assets/38/kbs/9d2e41ab...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Successfully deleted the server KB..

Failures, in addition to the common failures:

`subcode`	Cause
`ServerID invalid.`	`ServerID` was missing or not numeric.
`Customer guid is missing or invalid.`	`CGuid` was missing or malformed.
`guid is missing or invalid.`	`guid` was missing or not hex.
`User does not have permission to delete system kb for this customer.`	The caller lacks Write.
`Failed to delete Server KB.`	The attachment row could not be removed.
`Failed to delete System KBs`	The stored file could not be removed.

Changes in this version: The article is deleted only when it belongs to the caller's organization.

downloadkb

Streams an attached file — of an organization, a system or an asset — from blob storage.

GET https://api.moleant.com/v2/organizations/{CGuid}/files/{RandomNo}

v1 alias: POST https://api.moleant.com/discover/downloadkb/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`RandomNo`	Yes	Path segment. Storage id of the file, `Files[].RandomNo` from a listing.	Hex, max 40.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/files/3c1f9e0a7b...
X-Api-Key: c9c42981ebf50a4749c2

Response

On success the body is the file's raw bytes, not JSON. The response still declares Content-Type: application/json and carries no file name, so save the body under the FileName from the listing. Failures are status messages.

An unknown RandomNo is not detected: the body is then blob storage's XML error document, at HTTP 200.

Failures, in addition to the common failures:

`subcode`	Cause
`File identifier is missing or invalid.`	`RandomNo` was missing or not hex.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to download from this customer.`	The caller lacks Read.
`Transport error contacting blob storage.`	Blob storage could not be reached; `submessage` has the transport error.

Changes in this version: The file must belong to the caller's organization, and it is served with its stored MIME type and a Content-Disposition file name.

PopulateKBCarousel

Returns up to five of the most recently uploaded images (.jpg, .jpeg, .png, .gif) attached to a system, an asset or the organization, with their content inline.

GET https://api.moleant.com/v2/organizations/{CGuid}/kbs/images

GET https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/kbs/images

GET https://api.moleant.com/v2/organizations/{CGuid}/assets/{ServerID}/kbs/images

v1 alias: POST https://api.moleant.com/discover/PopulateKBCarousel/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Return the system's images. Takes precedence over `ServerID`.	Digits, max 10.
`ServerID`	Yes	Path segment. Return the asset's images.	Digits, max 10.

With neither id the organization's images are returned.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/kbs/images?ServerID=38
X-Api-Key: c9c42981ebf50a4749c2

Response

A Files array, newest first.

Attribute	Description	Example
`Files[].FileName`	Original file name.	rack-front.jpg
`Files[].Description`	Description, HTML-entity encoded. An empty string, never `null`, when the file has none.	Front of rack A
`Files[].RandomNo`	Storage id of the file.	3c1f9e0a7b...
`Files[].FileData`	The image, Base64-encoded.	/9j/4AAQSkZJRgABAQ...
`Files[].FileLength`	Size in bytes. A number.	284113

Example response

{"Files":[{"FileName":"rack-front.jpg","Description":"Front of rack A","RandomNo":"3c1f9e0a7b...",
  "FileData":"/9j/4AAQSkZJRgABAQ...","FileLength":284113}]}

Empty result: HTTP 200 with {"Files":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`User does not have permission to get imagedata from this customer.`	The caller lacks Read.

Reports

Queries across one or more organizations with filters and paging; see Multi-organization queries. The per-organization GET forms take the same filters as query parameters.

ListAssets

Lists assets across one or more organizations through a multi-organization query. ListComputers is the single-organization equivalent.

POST https://api.moleant.com/v2/reports/assets

v1 alias: POST https://api.moleant.com/discover/ListAssets/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`Organizations`	Yes	Array of organization objects. `Search` matches the hostname.
`IncludeDetails`	No	`"TRUE"` adds the asset-card description and the organization name.	Case-sensitive.
`IncludeOrgName`	No	`"TRUE"` adds the organization name.	Case-sensitive.
`Skip`	No	Rows to skip. Applied only together with `Count`.	Digits, 0–1000000.
`Count`	No	Rows to return. Applied only together with `Skip`.	Digits, 0–1000000.

Example request

POST https://api.moleant.com/v2/reports/assets
X-Api-Key: c9c42981ebf50a4749c2
Content-Type: application/json

{"Organizations":[{"OrgName":"7a8b26724e508ade","ComputerSoftware":["7-Zip-.-23.01"]}],"IncludeOrgName":"TRUE"}

Response

An object with a Query header array and an Assets array.

Attribute	Description	Example
`Query[].ResultCount`	Number of rows returned. A number.	1
`Query[].TotalCount`	Unpaged total, or `-1` when not computed. A number.	-1
`Assets[].Hostname`	Asset hostname.	SRV-FILE01
`Assets[].ServerID`	Numeric asset id. A number.	38
`Assets[].OperatingSystem`	Reported operating system.	Windows Server 2022 Standard
`Assets[].DateRebooted`	Last recorded reboot.	2026-07-14 03:12:08
`Assets[].DateCreated`	When the asset record was created.	2025-02-02 09:41:11
`Assets[].Updated`	When the asset last checked in.	2026-08-18 22:05:53
`Assets[].Description`	Asset-card description. Empty unless `IncludeDetails` is `"TRUE"`.	Primary file server
`Assets[].OrganizationName`	Customer name. Empty unless requested with `IncludeOrgName` or `IncludeDetails`.	Contoso AB
`Assets[].CGUID`	Organization GUID.	7a8b26724e508ade
`Assets[].UserLoginName, Assets[].UserID`	Placeholders, regenerated at random on every request.

Example response

{"Query":[{"ResultCount":1,"TotalCount":1}],"Assets":[
  {"Hostname":"SRV-FILE01","ServerID":38,"OperatingSystem":"Windows Server 2022 Standard",
   "UserLoginName":"3f0c...","UserID":"a71b...","DateRebooted":"2026-07-14 03:12:08",
   "DateCreated":"2025-02-02 09:41:11","Updated":"2026-08-18 22:05:53","Description":"",
   "OrganizationName":"Contoso AB","CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Assets":["No asset information was found."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Invalid count range.`	`Count` was out of range.
`Invalid skip range.`	`Skip` was out of range.
`You have selected too many … for this query.`	A filter cap was exceeded; see Multi-organization queries.
`No organizations specified.`	`Organizations` was missing, or an element had no `OrgName`.

ListSoftware

Lists installed applications with their installation counts, across one or more organizations, most installed first.

GET https://api.moleant.com/v2/organizations/{CGuid}/software

POST https://api.moleant.com/v2/reports/software

v1 alias: POST https://api.moleant.com/discover/ListSoftware/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`Organizations`	Yes	Array of organization objects. `Search` matches the application name or publisher.
`StackSoftware`	No	`"1"` groups by application and publisher, ignoring versions. `"0"` (default) groups by application and version.	Digits, max 2.
`CreateTotalCount`	No	`"1"` computes `TotalCount`.	Digits, max 2.
`Skip`	No	Rows to skip. Applied only together with `Count`.	Digits, 0–1000000.
`Count`	No	Rows to return. Applied only together with `Skip`.	Digits, 0–1000000.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/software?StackSoftware=1&Skip=0&Count=100
X-Api-Key: c9c42981ebf50a4749c2

Response

An object with a Query header array and a Software array.

Attribute	Description	Example
`Query[].ResultCount / TotalCount`	Rows returned, and the unpaged total or `-1`. Numbers.	1 / -1
`Software[].Name`	Application name.	7-Zip
`Software[].Vendor`	Publisher.	Igor Pavlov
`Software[].StackSoftware`	The grouping used, `0` or `1`. A number.	1
`Software[].Version`	Version; `-` when grouped by publisher.	-
`Software[].NumberOfInstalls`	Installations found. A number.	14
`Software[].CGUID`	Organization GUID.	7a8b26724e508ade

Example response

{"Query":[{"ResultCount":1,"TotalCount":-1}],"Software":[
  {"Name":"7-Zip","Vendor":"Igor Pavlov","StackSoftware":1,"Version":"-","NumberOfInstalls":14,
   "CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Software":["No Software information was found."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Invalid count range.`	`Count` was out of range.
`Invalid skip range.`	`Skip` was out of range.
`You have selected too many … for this query.`	A filter cap was exceeded; see Multi-organization queries.
`No organizations specified.`	`Organizations` was missing, or an element had no `OrgName`.

Changes in this version: Applications with the same install count are listed by name and version.

ListIssues

Lists the issues Moleant Discover has found on assets, across one or more organizations.

GET https://api.moleant.com/v2/organizations/{CGuid}/issues

POST https://api.moleant.com/v2/reports/issues

v1 alias: POST https://api.moleant.com/discover/ListIssues/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`Organizations`	Yes	Array of organization objects. `Search` matches the issue text.
`Skip`	No	Rows to skip. Applied only together with `Count`.	Digits, 0–1000000.
`Count`	No	Rows to return. Applied only together with `Skip`.	Digits, 0–1000000.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/issues
X-Api-Key: c9c42981ebf50a4749c2

Response

An object with a Query header array and an Issues array.

Attribute	Description	Example
`Query[].ResultCount / TotalCount`	Rows returned, and the unpaged total. Numbers.	1 / 1
`Issues[].IssueNo`	Issue number. A number.	17
`Issues[].IssueText`	Description of the issue.	Disk C: has less than 10% free space
`Issues[].issueSeverity`	Severity code.	2
`Issues[].SystemID`	System concerned, or `0`. A number.	0
`Issues[].ServerID`	Asset concerned, or `0`. A number.	38
`Issues[].CGUID`	Organization GUID.	7a8b26724e508ade

Example response

{"Query":[{"ResultCount":1,"TotalCount":1}],"Issues":[
  {"IssueNo":17,"IssueText":"Disk C: has less than 10% free space","issueSeverity":2,
   "SystemID":0,"ServerID":38,"CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Issues":["No issue information was found."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`No organizations are set.`	`Organizations` was missing.
`Invalid count range.`	`Count` was out of range.
`Invalid skip range.`	`Skip` was out of range.
`You have selected too many … for this query.`	A filter cap was exceeded; see Multi-organization queries.
`User does not have permission to list computers for this customer.`	The caller lacks Read on a requested organization.
`No organizations specified.`	An element had no `OrgName`.

ListUsers

Lists the local user accounts found on assets, plus the organization's Active Directory users when no filter is set, across one or more organizations.

GET https://api.moleant.com/v2/organizations/{CGuid}/users

POST https://api.moleant.com/v2/reports/users

v1 alias: POST https://api.moleant.com/discover/ListUsers/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`Organizations`	Yes	Array of organization objects; see Multi-organization queries. `Search` matches the account name.
`Skip`	No	Rows to skip. Applied only together with `Count`.	Digits, 0–1000000.
`Count`	No	Rows to return. Applied only together with `Skip`.	Digits, 0–1000000.
`UserType`	No	Read, never used.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/users
X-Api-Key: c9c42981ebf50a4749c2

Response

An object with a Query header array and a Users array, ordered by host name.

Attribute	Description	Example
`Query[].ResultCount / TotalCount`	Rows returned, and the unpaged total. Numbers.	1 / 1
`Users[].UserGivenName`	Given name; the account name for a local account.	Ada
`Users[].UserSurName`	Surname.	Lovelace
`Users[].UserLoginName`	Account name.	alovelace
`Users[].UserID`	User id: for a local account the account name followed by the asset's `ServerGuid`, for an AD user `SamAccountName:domain`. Use it in `UserID` filters.	alovelace:corp.example.com
`Users[].UserDomain`	The asset's host name for a local account, the domain for an AD user.	corp.example.com
`Users[].UserEmail`	E-mail address, when known.	ada@contoso.com
`Users[].AccountType`	`Local user`, `Domain user` or `Primary user`.	Domain user
`Users[].CGUID`	Organization GUID.	7a8b26724e508ade
`Users[].UserAddress, UserDepartment, UserLastLogin`	Placeholders: the account name with the field name appended.	alovelaceUserAddress
`Users[].ServerID`	Placeholder: repeats `UserID`, not an asset id.

Example response

{"Query":[{"ResultCount":1,"TotalCount":1}],"Users":[
  {"UserGivenName":"Ada","UserSurName":"Lovelace","UserLoginName":"alovelace",
   "UserID":"alovelace:corp.example.com","UserDomain":"corp.example.com",
   "UserAddress":"alovelaceUserAddress","UserEmail":"ada@contoso.com",
   "UserDepartment":"alovelaceUserDepartment","UserLastLogin":"alovelaceUserLastLogon",
   "AccountType":"Domain user","ServerID":"alovelace:corp.example.com","CGUID":"7a8b26724e508ade"}
]}

Empty result: HTTP 200 with {"Users":["No user information was found."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`Invalid count range.`	`Count` was out of range.
`Invalid skip range.`	`Skip` was out of range.
`You have selected too many … for this query.`	A filter cap was exceeded.
`User does not have permission for this organization.`	The caller lacks Read on a requested organization.
`No organizations specified.`	`Organizations` was missing, or an element had no `OrgName`.

Changes in this version: Users on the same host are listed by login name.

SBOM and VEX

Software bills of materials (CycloneDX XML) and vulnerability exploitability documents (CycloneDX JSON or OpenVEX) attached to a system.

ListSbom

Returns the SBOM documents recorded for a system and the components they declare. This handler also serves v2 sbom.

GET https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/sbom

v1 alias: POST https://api.moleant.com/discover/ListSbom/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID. Required with a user token; ignored with a key.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`Filename, Description`	No	Read, never used.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/sbom
X-Api-Key: c9c42981ebf50a4749c2

Response

Two arrays.

Attribute	Description	Example
`SBOM[].Name`	Name of the SBOM document.	Acme Product
`SBOM[].Version`	Document version. Capitalised `V`.	2.4.0
`SBOMFiles[].Name`	Component name.	openssl
`SBOMFiles[].version`	Component version. Lower-case `v`.	3.0.13
`SBOMFiles[].Purl`	Package URL of the component.	pkg:generic/openssl@3.0.13

Example response

{"SBOM":[{"Version":"2.4.0","Name":"Acme Product"}],
 "SBOMFiles":[{"version":"3.0.13","Name":"openssl","Purl":"pkg:generic/openssl@3.0.13"}]}

A system without an SBOM answers HTTP 200 with the placeholder {"SBOM":["This system does not have any SBOM data uploaded."],"SBOMFiles":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`User's CGud is invalid or empty.`	`CGuid` was missing or malformed (user token only).
`User does not have permission to list SBOM for this customer.`	The caller lacks Read.

Changes in this version: A system without an SBOM answers HTTP 200 with a placeholder; it was a failure at HTTP 400.

UploadSBOM

Uploads a CycloneDX SBOM in XML. The system's component list is replaced by the file's components, the document is added to its SBOM list, and the file is stored as a system attachment.

PUT https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/sbom

v1 alias: POST https://api.moleant.com/discover/UploadSBOM/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`Filename`	Yes	File name; the extension must be an allowed upload type.	File name, max 241.
`Description`	No	Description of the attachment.	Text, max 4096.
`FileData`	Yes	The XML document, Base64-encoded.	Base64, max 16,777,216 characters.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/sbom
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Filename":"acme-sbom.xml","FileData":"PD94bWwgdmVyc2lvbj0iMS4wIj8+..."}

Response

A status message. On success the subcode is Upload was successful..

Failures, in addition to the common failures:

`subcode`	Cause
`Filename missing or invalid.`	`Filename` was missing or contained a forbidden character.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Submitted file is too large, invalid or missing.`	`FileData` was missing, too long or not Base64.
`Submitted SystemID is too large, invalid or missing.`	`SystemID` was missing or not numeric.
`Extension is not allowed for upload.`	The file type is not on the allowed list.
`User does not have permission to upload to this customer.`	The caller lacks Write.
`The uploaded SBOM file is not valid XML.`	The decoded file did not parse as XML.
`Failed to upload file.`	Blob storage or the database write failed.
`An unexpected error occurred while processing this request.`	Any other error.

ListVex

Returns the system's VEX data as a CycloneDX-style document. This handler also serves v2 vex, where every field is described; DownloadVex returns the same document as a file.

GET https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/vex

v1 alias: POST https://api.moleant.com/discover/ListVex/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID. Required with a user token; ignored with a key.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`Filename, Description`	No	Read, never used.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/vex
X-Api-Key: c9c42981ebf50a4749c2

Response

The document. version and ratings[].score are numbers; a missing score or justification is null.

Attribute	Description	Example
`bomFormat, specVersion, version`	Document header.	CycloneDX, 1.4, 1
`metadata.timestamp, metadata.component.{name, version, type, bom-ref}`	The subject component.	Acme Product
`vulnerabilities[]`	`id`, `source{name, url}`, `comments[]{cve, comment, created_at}`, `ratings[]{source, score, severity, method, vector}`, `analysis{state, justification, response[], detail}`, `affects[]{ref}`.

Example response

{
  "bomFormat":"CycloneDX","specVersion":"1.4","version":1,
  "metadata":{"timestamp":"2026-01-13T00:00:00Z",
    "component":{"name":"Acme Product","version":"2.4.0","type":"application","bom-ref":"acme-product"}},
  "vulnerabilities":[
    {"id":"CVE-2025-12345",
     "source":{"name":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12345"},
     "comments":[{"cve":"CVE-2025-12345","comment":"Reviewed 2026-02-01","created_at":"2026-02-01 10:02:11"}],
     "ratings":[{"source":{"name":"NVD","url":"https://nvd.nist.gov/"},"score":7.5,"severity":"high",
                 "method":"CVSSv31","vector":"AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],
     "analysis":{"state":"not_affected","justification":"code_not_reachable",
                 "response":["will_not_fix"],"detail":"Component ships disabled."},
     "affects":[{"ref":"acme-product"}]}
  ]
}

A system without VEX data answers HTTP 200 with the placeholder {"vulnerabilities":["This system does not have any VEX data uploaded."]}: check the type of the first element, as with every list.

Failures, in addition to the common failures:

`subcode`	Cause
`User's CGud is invalid or empty.`	`CGuid` was missing or malformed (user token only).
`User does not have permission to list SBOM for this customer.`	The caller lacks Read.

Changes in this version: The document is assembled from one query per table instead of one per vulnerability. A system without VEX data answers HTTP 200 with a placeholder; it was a failure at HTTP 400.

UploadVEX

Uploads a VEX document in JSON, either CycloneDX (bomFormat CycloneDX, spec 1.4 or later) or OpenVEX (an @context on openvex.dev). Its metadata, vulnerabilities, ratings, responses and affected components become the system's VEX data, and the file is stored as a system attachment.

An upload replaces all of the system's VEX data, analyst comments included, and the old data is deleted before the new file is validated. A rejected file therefore leaves the system with no VEX data at all.

PUT https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/vex

v1 alias: POST https://api.moleant.com/discover/UploadVEX/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`Filename`	Yes	File name; the extension must be an allowed upload type.	File name, max 241.
`Description`	No	Description of the attachment.	Text, max 4096.
`FileData`	Yes	The JSON document, Base64-encoded.	Base64, max 16,777,216 characters.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/vex
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Filename":"acme-vex.json","FileData":"eyJib21Gb3JtYXQiOiJDeWNsb25lRFgiLC..."}

Response

A status message. On success the subcode is Upload was successful..

Failures, in addition to the common failures:

`subcode`	Cause
`Filename missing or invalid.`	`Filename` was missing or contained a forbidden character.
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`Submitted file is too large, invalid or missing.`	`FileData` was missing, too long or not Base64.
`Submitted SystemID is too large, invalid or missing.`	`SystemID` was missing or not numeric.
`Extension is not allowed for upload.`	The file type is not on the allowed list.
`User does not have permission to upload to this customer.`	The caller lacks Write.
`The uploaded VEX/SBOM file is not valid JSON.`	The decoded file did not parse as JSON.
`The uploaded VEX/SBOM file is invalid: reason`	The document failed validation, e.g. `Missing required CycloneDX field: specVersion`.
`Failed to remove data from table`	The previous VEX data could not be deleted.
`Failed to upload file.`	Blob storage or the database write failed.
`An unexpected error occurred while processing this request.`	Any other error.

ModifyVex

Updates the analysis of one vulnerability in a system's VEX data, and can add an analyst comment. Only the fields you send are changed.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/vex/{id}

v1 alias: POST https://api.moleant.com/discover/ModifyVex/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID. Ignored with a key.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.
`id`	Yes	Path segment. The vulnerability id, e.g. a CVE.	Text, max 20.
`State`	No	New analysis state.	Text, max 30.
`Justification`	No	New justification. Also accepted as `justification`.	Text, max 30.
`Response`	No	A response or an array of responses; replaces all existing responses. Also accepted as `responses`.	Text, max 30 each.
`Detail`	No	New analysis detail. Also accepted as `detail`.	Text, max 4096.
`Comment`	No	A comment to append to the vulnerability's comments. Also accepted as `comments`.	Text, max 4096.
`Filename, Description`	No	Read, never used.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/vex/CVE-2025-12345
X-Api-Key: c9c42981ebf50a4749c2
Content-Type: application/json

{"State":"not_affected","Justification":"code_not_reachable","Response":["will_not_fix"],"Comment":"Reviewed by the platform team"}

Response

A status message. On success the subcode is VEX entry updated successfully..

Failures, in addition to the common failures:

`subcode`	Cause
`User's CGud is invalid or empty.`	`CGuid` was missing or malformed (user token only).
`User does not have permission to modify VEX for this customer.`	The caller lacks Write.
`Vulnerability ID is invalid or empty.`	`id` was missing.
`Submitted SystemID is too large, invalid or missing.`	`SystemID` was missing or not numeric.
`No matching vulnerability found for this system.`	The system has no vulnerability with that id.

Changes in this version: The lowercase field names justification, responses, detail and comments are accepted as aliases. A comment that repeats the vulnerability's latest comment word for word is not added again.

DownloadVex

Returns the same document as ListVex, as a file download.

GET https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/vex/download

v1 alias: POST https://api.moleant.com/discover/DownloadVex/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. Numeric system id.	Digits, max 10.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/12/vex/download
X-Api-Key: c9c42981ebf50a4749c2

Response

On success the body is the VEX document, exactly as ListVex returns it, with these headers:

Content-Type: application/json
Content-Disposition: attachment; filename="vex_data_<CGuid>_<SystemID>_<YYYY-MM-DD_HH-MM-SS>.json"
Cache-Control: no-cache, must-revalidate

Failures are status messages.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`User does not have permission to download from this customer.`	The caller lacks Read.
`This system does not have any VEX data uploaded.`	No VEX data for the system. Answered with HTTP 404.

Changes in this version: A system without VEX data answers HTTP 404 instead of 400.

Microsoft 365

A Microsoft 365 system is bound to an app registration in the customer's tenant; licence data is read from Microsoft Graph on demand.

AddM365App

Checks the app registration by requesting a Graph token with it, then creates a Microsoft 365 system named after the tenant, stores the app's settings and logs the event.

POST https://api.moleant.com/v2/organizations/{CGuid}/m365

v1 alias: POST https://api.moleant.com/discover/AddM365App/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Hex, max 100.
`TenantName`	Yes	Name for the tenant; becomes the system name.	Plain text, max 450.
`TenantID`	Yes	Directory (tenant) id.	GUID, max 300.
`AppID`	Yes	Application (client) id of the app registration.	GUID, max 100.
`ClientSecret`	Yes	Client secret of the app registration.	Tolerant text, max 300.

Example request

POST https://api.moleant.com/v2/organizations/7a8b26724e508ade/m365
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"TenantName":"Contoso Tenant","TenantID":"72f988bf-86f1-41af-91ab-2d7cd011db47","AppID":"0f3c8a2d-5b6e-4c1f-9a7d-8e2b1c4d5f60","ClientSecret":"Vn8Q~..."}

Response

A status message. On success the subcode is Successfully created the Microsoft 365 system..

Returned ids: on success the status message also carries SystemID for the new record.

Failures, in addition to the common failures:

`subcode`	Cause
`User does not have permission to add appss for this organization.`	The caller lacks Write (sic).
`Either of ClientSecret, AppID, TenantID or TenantName are missing.`	A field was missing. `submessage`: `AddM365App failure.`
`CGuid missing`	`CGuid` was missing. `submessage`: `AddM365App failure.`
`CGuid incorrect`	`CGuid` was malformed. `submessage`: `AddM365App failure.`
`ClientSecret wrong.`	Microsoft refused the credentials.
`System could not be created.`	The write failed.

Changes in this version: The client secret is validated against Microsoft Entra but no longer stored; Populatem365Licenses takes it with every call. The new SystemID is returned.

ListM365Licenses

Returns the stored tenant summary, licence subscriptions and a sample of user licences of a Microsoft 365 system, as last fetched by Populatem365Licenses.

GET https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/m365

v1 alias: POST https://api.moleant.com/discover/ListM365Licenses/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`SystemID`	Yes	Path segment. The Microsoft 365 system.	Digits, max 10.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/19/m365
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

An object with three arrays.

Attribute	Description	Example
`AzureGeneralStats[].NumberOfUsers`	Users in the tenant. A number.	287
`AzureGeneralStats[].TenantName`	Tenant name.	Contoso Tenant
`AzureGeneralStats[].NumberOfGAs`	Always `0` today. A number.	0
`AzureGeneralStats[].LastSync`	Unix time of the last fetch.	1786954442
`AzureGeneralStats[].LastSyncHR`	The same time as `Y-m-d h:i:s` — a 12-hour clock without AM/PM.	2026-08-18 08:14:02
`AzureGeneralStats[].AcceptedMailDomains`	Comma-separated verified domains.	contoso.com,contoso.se
`AzureTenantLicenses[]`	One per enabled subscription: `capabilityStatus`, `consumedUnits`, `enabled`, `suspended`, `warning` (numbers), `id`, `skuId`, `skuPartNumber`, `appliesTo`.
`AzureUserLicenses[]`	The first ten user-licence assignments: `CGuid`, `UserGuid`, `LicenseGuid`, `LicensName` (sic), `UserName`.

Example response

{"AzureGeneralStats":[{"NumberOfUsers":287,"TenantName":"Contoso Tenant","NumberOfGAs":0,
   "LastSync":"1786954442","LastSyncHR":"2026-08-18 08:14:02","AcceptedMailDomains":"contoso.com,contoso.se"}],
 "AzureTenantLicenses":[{"capabilityStatus":"Enabled","consumedUnits":287,"id":"72f9..._05e9...",
   "enabled":300,"suspended":0,"warning":0,"skuId":"05e9a617-0261-4cee-bb44-138d3ef5d965",
   "skuPartNumber":"SPE_E3","appliesTo":"User"}],
 "AzureUserLicenses":[{"CGuid":"7a8b26724e508ade","UserGuid":"2c7d...","LicenseGuid":"05e9...",
   "LicensName":"SPE_E3","UserName":"ada@contoso.com"}]}

Empty result: HTTP 200 with a placeholder in place of the whole object: {"AzureGeneralStats":["No Azure licensing informationwas found for this system."]} when there is no tenant summary, or {"AzureTenantLicenses":["No Azure licensing informationwas found for this system."]} when there are no enabled subscriptions. Note the missing space in informationwas.

Failures, in addition to the common failures:

`subcode`	Cause
`Customer guid missing or invalid.`	`CGuid` was missing or malformed.
`SystemID missing or invalid.`	`SystemID` was missing or not numeric.
`User does not have permission to list the M365 licenses for this organization.`	The caller lacks Read.

Populatem365Licenses

Fetches the tenant's users, domains and subscriptions from Microsoft Graph and replaces the stored data of the Microsoft 365 system. The request is authorised by the app registration's client secret: it must obtain a Graph token together with the settings stored by AddM365App.

POST https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/m365/sync

v1 alias: POST https://api.moleant.com/discover/Populatem365Licenses/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Hex, max 100.
`SystemID`	Yes	Path segment. The Microsoft 365 system.	Digits, max 5.
`ClientSecret`	Yes	Client secret of the app registration.	Tolerant text, max 200.

Example request

POST https://api.moleant.com/v2/organizations/7a8b26724e508ade/systems/19/m365/sync
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"ClientSecret":"Vn8Q~..."}

Response

A status message. On success the subcode is Population was successful..

Failures:

`subcode`	Cause
`CGuid is missing.`	`CGuid` was missing or not hex.
`SystemID is missing.`	`SystemID` was missing.
`ClientSecret is missing.`	`ClientSecret` was missing.
`SystemID does not exist.`	The system is not a connected Microsoft 365 system.
`ClientSecret wrong.`	Microsoft refused the credentials.
`Could not retrieve data from Microsoft Graph.`	A Graph request failed; `submessage` has the transport error.
`A database error occurred while processing this request.`	A database statement failed.

Changes in this version: A user token with Write on the organization is required; the operation was unauthenticated before. The tenant's user list is now read completely (all pages), users are counted with the Graph $count query, and licence names come from the tenant's subscribed SKUs where known.

Entitlements

Licences the organization holds, compared with the installations the engines found.

ListEntitlements

Lists the organization's entitlements with their links, installation counts and compliance verdict, followed by its Microsoft 365 licence pools. This handler also serves v2 entitlements, where every field and verdict is described.

GET https://api.moleant.com/v2/organizations/{CGuid}/entitlements

GET https://api.moleant.com/v2/organizations/{CGuid}/systems/{SystemID}/entitlements

v1 alias: POST https://api.moleant.com/Entitlements/ListEntitlements/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token or API key. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID. Ignored with a key.	Alphanumeric, max 120.
`SystemID`	Yes	Path segment. Only asset entitlements that reach this system; also drops the Microsoft 365 pools.	Digits, max 10.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/entitlements
X-Api-Key: c9c42981ebf50a4749c2

Response

An Entitlements array; see v2 entitlements for every field.

Attribute	Description	Example
`Entitlements[].Guid, EntitlementName, SerialKey, ExpiryDate, LogDate, LogTime, Type, Comments`	The entitlement's own fields. `ExpiryDate` is a Unix timestamp in a string; `LogDate`/`LogTime` are the same moment split.
`Entitlements[].Licenses, TotalInstalls, HighestWinningNumber`	Numbers.	25, 2, 2
`Entitlements[].EntitlementAssets / EntitlementSoftware`	Links: `{ServerID}` or `{ApplicationName, Version, Installs}`.
`Entitlements[].HasFile, FileName`	`HasFile` is the string `"true"` or `"false"`.	true
`Entitlements[].Alert`	Compliance verdict.	Over-licensed (178%)

Example response

{"Entitlements":[
  {"Guid":"c30a...","EntitlementName":"Adobe Acrobat Pro","SerialKey":"XXXXX-XXXXX-XXXXX",
   "ExpiryDate":"1801353600","LogDate":"2027-01-31","LogTime":"00:00:00","Type":"Assets",
   "Licenses":25,"Comments":"Renewed via reseller","EntitlementAssets":[{"ServerID":38},{"ServerID":41}],
   "HasFile":"true","FileName":"acrobat-licence.pdf","TotalInstalls":2,"HighestWinningNumber":2,
   "Alert":"Over-licensed (1250%)"}
]}

Empty result: HTTP 200 with {"Entitlements":["No Entitlements were found."]}.

Failures, in addition to the common failures:

`subcode`	Cause
`User does not have permission to list computers for this customer.`	The caller lacks Read (sic).

Changes in this version: With SystemID, an Assets entitlement is listed when one of its assets is a member of that system; Software entitlements are not system-bound and are left out, as before.

AddEntitlement

Creates an entitlement, links it to assets or applications, and stores an optional licence document.

Not atomic. The entitlement is created before its links are checked, so a failure about an asset, an application or the document leaves the entitlement in place with only some of its links. Delete it with DeleteEntitlement and try again.

POST https://api.moleant.com/v2/organizations/{CGuid}/entitlements

v1 alias: POST https://api.moleant.com/Entitlements/AddEntitlement/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`Type`	No	`Assets` or `Software`. Decides how ListEntitlements filters by system.	Text, max 20.
`EntitlementName`	Yes	Name of the entitlement.	Text, max 255.
`Licenses`	Yes	Number of licences owned. Must be at least 1.	Digits.
`EntitlementAssets`	Conditional	For an asset entitlement: array of `{"ServerID": "<id>"}`. Every asset must exist.	Digits, max 5 each.
`EntitlementFiles`	Conditional	For a software entitlement: array of `{"ApplicationName": "…", "Version": "…"}`; leave `Version` empty to match every version. Every application must be installed somewhere. Used only when `EntitlementAssets` is absent.	Text, max 450 each.
`SerialKey`	No	Serial or licence key.	Text, max 300.
`ExpiryDate`	No	Expiry as a Unix timestamp in seconds.	Digits.
`trackVersion`	No	Whether the entitlement is bound to exact versions.	Text, max 255.
`Notes`	No	Comments; returned as `Comments`.	Text, max 4096.
`FileName`	No	Name of a licence document to attach.	The extension must be an allowed upload type.
`FileData`	No	The document, Base64-encoded. One document per entitlement.	Base64.
`Subject`	No	Read, never used.

Example request

POST https://api.moleant.com/v2/organizations/7a8b26724e508ade/entitlements
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"EntitlementName":"Adobe Acrobat Pro","Type":"Assets","Licenses":"25","EntitlementAssets":[{"ServerID":"38"},{"ServerID":"41"}],"SerialKey":"XXXXX-XXXXX-XXXXX","ExpiryDate":"1801353600"}

Response

A status message. On success the subcode is Entitlement uploaded successfully..

Returned ids: on success the status message also carries Guid for the new record.

Failures, in addition to the common failures:

`subcode`	Cause
`User does not have permission to add entitlement.`	The caller lacks Write.
`EntitlementName and Licenses must be specified.`	A required field was missing, or `Licenses` was 0.
`Too many assets specified.`	`EntitlementAssets` exceeded the cap.
`One or more assets specified were empty.`	An element had no `ServerID`.
`One of the assets specified does not exist.`	No asset has that id.
`Too many files specified.`	`EntitlementFiles` exceeded the cap.
`One or more files specified were empty.`	An element had no `ApplicationName`.
`One of the softwares specified does not exist.`	No asset has that application (and version) installed.
`Filename missing or invalid.`	`FileName` was invalid.
`Extension is not allowed for upload.`	The document type is not on the allowed list.
`Failed to upload file.`	The document could not be stored.

Changes in this version: The entitlement, its assets or software links and its file are created in one transaction: a failure (for example an unknown asset) no longer leaves a half-created entitlement behind. The new Guid is returned.

ModifyEntitlement

Rewrites an entitlement. It is a full replacement: the name, licences, serial key, expiry and comments are all overwritten, and every asset and application link is removed and rebuilt from the request. The type cannot be changed.

PUT PATCH https://api.moleant.com/v2/organizations/{CGuid}/entitlements/{Guid}

v1 alias: POST https://api.moleant.com/Entitlements/ModifyEntitlement/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`Guid`	Yes	Path segment. The entitlement.	Hex, max 150.
`EntitlementName`	Yes	Name of the entitlement.	Text, max 255.
`Licenses`	Yes	Number of licences owned. Must be at least 1.	Digits.
`EntitlementAssets`	Conditional	For an asset entitlement: array of `{"ServerID": "<id>"}`. Every asset must exist.	Digits, max 5 each.
`EntitlementFiles`	Conditional	For a software entitlement: array of `{"ApplicationName": "…", "Version": "…"}`; leave `Version` empty to match every version. Every application must be installed somewhere. Used only when `EntitlementAssets` is absent.	Text, max 450 each.
`SerialKey`	No	Serial or licence key.	Text, max 300.
`ExpiryDate`	No	Expiry as a Unix timestamp in seconds.	Digits.
`trackVersion`	No	Whether the entitlement is bound to exact versions.	Text, max 255.
`Notes`	No	Comments; returned as `Comments`.	Text, max 4096.
`FileName`	No	Name of a licence document to attach.	The extension must be an allowed upload type.
`FileData`	No	The document, Base64-encoded. One document per entitlement.	Base64.
`Subject`	No	Read, never used.

Example request

PUT https://api.moleant.com/v2/organizations/7a8b26724e508ade/entitlements/c30a...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"EntitlementName":"Adobe Acrobat Pro","Licenses":"30","EntitlementAssets":[{"ServerID":"38"},{"ServerID":"41"},{"ServerID":"52"}],"SerialKey":"XXXXX-XXXXX-XXXXX","ExpiryDate":"1801353600"}

Response

A status message. On success the subcode is Entitlement modified successfully..

Failures, in addition to the common failures:

`subcode`	Cause
`Guid must be specified.`	`Guid` was missing.
`User does not have permission to modify entitlement.`	The caller lacks Write.
`This entitlement does not exist.`	No entitlement has that GUID.
`User does not have permission to upload to this organization.`	The caller may not store the document.
`EntitlementName and Licenses must be specified.`	A required field was missing, or `Licenses` was 0.
`Too many assets specified.`	`EntitlementAssets` exceeded the cap.
`One or more assets specified were empty.`	An element had no `ServerID`.
`One of the assets specified does not exist.`	No asset has that id.
`Too many files specified.`	`EntitlementFiles` exceeded the cap.
`One or more files specified were empty.`	An element had no `ApplicationName`.
`One of the softwares specified does not exist.`	No asset has that application (and version) installed.
`Filename missing or invalid.`	`FileName` was invalid.
`Extension is not allowed for upload.`	The document type is not on the allowed list.
`Failed to upload file.`	The document could not be stored.

Changes in this version: The change is transactional.

DeleteEntitlement

Deletes an entitlement with its links and document. Unlike the other entitlement writes, this needs Account admin.

DELETE https://api.moleant.com/v2/organizations/{CGuid}/entitlements/{Guid}

v1 alias: POST https://api.moleant.com/Entitlements/DeleteEntitlement/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 50.
`Guid`	Yes	Path segment. The entitlement.	Hex, max 150.

Example request

DELETE https://api.moleant.com/v2/organizations/7a8b26724e508ade/entitlements/c30a...
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

A status message. On success the subcode is Entitlement successfully deleted..

Failures, in addition to the common failures:

`subcode`	Cause
`This Guid does not exist.`	`Guid` was missing or not hex.
`User does not have permission to delete entitlement.`	The caller lacks Account admin.
`This entitlement does not exist.`	No entitlement has that GUID.

Changes in this version: The attached file's stored-file record is removed as well.

Active Directory

Domain data read by the web app, and the update protocol Moleant Engine follows. Several engines may see the same domain, so one of them is elected the designated update server.

ADListDomainData

Returns the stored domain, forest, statistics and domain-controller data for one domain.

GET https://api.moleant.com/v2/organizations/{CGuid}/ad/domains/{DomainObjectGUID}

v1 alias: POST https://api.moleant.com/discover/ADListDomainData/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 255.
`DomainDNSRoot`	Yes	The domain.	DNS name, max 255.
`DomainObjectGUID`	Yes	Path segment. Object GUID of the domain.	GUID, max 255.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/ad/domains/5b1e0c6e-8f7a-4c7d-9e1a-2f3b4c5d6e7f?DomainDNSRoot=corp.example.com
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

An object with four one-element arrays. When a part is missing the call instead answers with a verdict: a Success status with subcode FALSE and submessage Domain does not exist., Forest does not exist. (also used when the statistics are missing), Domain controllers do not exist. or Unknown error occurred.

Attribute	Description	Example
`Domain[]`	`DomainDNSRoot`, `DomainObjectGUID`, `DomainSID`, `PDCEmulator`, `RIDMaster`, `ParentDomain`, `NetBIOSName`, `DomainMode`, `ForestRootDomain`, `ForestObjectGUID`, `UserUpdateSession`, `LastUpdated`, `PrimaryUpdateServer`, `CGUID`.
`Forest[]`	`ForestRootDomain`, `ForestObjectGUID`, `GlobalCatalogs`, `DomainNamingMaster`, `SchemaMaster`, `ForestMode`, `Sites`, `SPNSuffixes`, `UPNSuffixes`, `PrimaryUpdateServer`, `LastUpdated`, `ApplicationPartitions`, `CrossForestReferences`.
`DomainStats[]`	`DomainDNSRoot`, `ForestDNSRoot`, `DomainObjectGUID`, `ForestObjectGUID`, the counts `Users`, `Computers`, `Groups`, `InactiveUsers`, `DisabledUsers`, `LockedOutUsers`, `ExpiredUsers`, `PasswordExpiredUsers`, `Workstations`, `Servers`, `DisabledComputers` (numbers), `LastUpdated`, `PrimaryUpdateServer`.
`DomainControllers[]`	`ComputerObjectDN`, `DefaultPartition`, `Domain`, `Enabled`, `Forest`, `HostName`, `InvocationId`, `IPv4Address`, `IPv6Address`, `IsGlobalCatalog`, `LdapPort` (number), `Name`, `NTDSSettingsObjectDN`, `OperatingSystem`, `OperatingSystemHotfix`, `OperatingSystemServicePack`, `OperatingSystemVersion`, `OperationMasterRoles`, `isSchemaMaster`, `isPDC`, `isDNM`, `isRID`, `isInfra` (`"0"` or `"1"`), `Partitions`, `ServerObjectDN`, `ServerObjectGuid`, `Site`, `SslPort` (number).

Example response

{"Domain":[{"DomainDNSRoot":"corp.example.com","DomainObjectGUID":"5b1e...","DomainSID":"S-1-5-21-...",
   "PDCEmulator":"DC01.corp.example.com","RIDMaster":"DC01.corp.example.com","ParentDomain":"",
   "NetBIOSName":"","DomainMode":"Windows2016Domain","ForestRootDomain":"corp.example.com",
   "ForestObjectGUID":"0a1b...","UserUpdateSession":"9f8e...","LastUpdated":"1786954442",
   "PrimaryUpdateServer":"b13f7d0e5a2c","CGUID":"7a8b26724e508ade"}],
 "Forest":[{"ForestRootDomain":"corp.example.com","...":"..."}],
 "DomainStats":[{"DomainDNSRoot":"corp.example.com","Users":412,"Computers":96,"...":"..."}],
 "DomainControllers":[{"HostName":"DC01.corp.example.com","LdapPort":389,"SslPort":636,"isPDC":"1","...":"..."}]}

The example abbreviates the Forest, DomainStats and DomainControllers objects with "..."; the real ones carry every field listed above.

Failures, in addition to the common failures:

`subcode`	Cause
`FALSE`	With `submessage` `Domain identifiers missing.` or `Organization data missing.`
`User does not have permission to list domain data.`	The caller lacks Read.

Changes in this version: A domain, forest or statistics row that does not exist is a Failure status (Domain does not exist., Forest does not exist., Domain statistics do not exist., Domain controllers do not exist.) instead of a bare FALSE body. All domain controllers are listed; earlier versions listed only the last one.

ADSearchUser

Finds Active Directory users whose SamAccountName contains the search text, across all of the organization's domains.

GET https://api.moleant.com/v2/organizations/{CGuid}/ad/users

v1 alias: POST https://api.moleant.com/discover/ADSearchUser/ with the same fields, and the credential, in a JSON body.

Request

Authentication: User token. Fields marked Path segment are part of the URL; the others are query parameters.

Attribute	Mandatory?	Description	Notes
`CGuid`	Yes	Path segment. Organization GUID.	Alphanumeric, max 255.
`Search`	Yes	Text to look for in the SamAccountName.	Text, max 255.
`Domain`	No	Validated but not used to narrow the search.	DNS name, max 255.

Example request

GET https://api.moleant.com/v2/organizations/7a8b26724e508ade/ad/users?Search=love
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…

Response

An ADUsers array.

Attribute	Description	Example
`ADUsers[].DistinguishedName`	Distinguished name.	CN=Ada Lovelace,OU=Staff,DC=corp,DC=example,DC=com
`ADUsers[].SamAccountName`	Account name. Send it as `PrimaryUser` to ModifyServerDetails.	alovelace
`ADUsers[].Enabled`	Whether the account is enabled, as reported.	True
`ADUsers[].GivenName / Name / Surname`	Name fields.	Ada / Ada Lovelace / Lovelace
`ADUsers[].DomainRootDomain`	The user's domain. Send it as `Domain`.	corp.example.com
`ADUsers[].CGUID`	Organization GUID.	7a8b26724e508ade

Example response

{"ADUsers":[{"DistinguishedName":"CN=Ada Lovelace,OU=Staff,DC=corp,DC=example,DC=com",
   "SamAccountName":"alovelace","Enabled":"True","GivenName":"Ada","Name":"Ada Lovelace",
   "Surname":"Lovelace","DomainRootDomain":"corp.example.com","CGUID":"7a8b26724e508ade"}]}

Empty result: HTTP 200 with {"ADUsers":[]}.

Failures, in addition to the common failures:

`subcode`	Cause
`FALSE`	With `submessage` `Organization data missing.` or `You need to specify user to search for.`
`User does not have permission to list domain data.`	The caller lacks Read.

ADCheckUpdateAllowed

Decides whether the calling agent may push data for a domain, registering the domain and assigning the designated-server role as needed.

POST https://api.moleant.com/v2/engine/ad/check

v1 alias: POST https://api.moleant.com/discover/ADCheckUpdateAllowed/ with the same fields, and the credential, in a JSON body.

Request

Authentication: Engine token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`ServerGuid`	Yes	The calling agent's id.	Alphanumeric, max 100.
`DomainDNSRoot`	Yes	The domain.	DNS name, max 255.
`DomainObjectGUID`	Yes	Object GUID of the domain.	GUID, max 100.
`ForestDNSRoot`	Yes	The forest root domain.	DNS name, max 255.
`ForestObjectGUID`	Yes	Object GUID of the forest.	GUID, max 100.
`CGuid`	No	Ignored; the token decides the organization.

Example request

POST https://api.moleant.com/v2/engine/ad/check
Authorization: Bearer 2f0c…9a1b
Content-Type: application/json

{"ServerGuid":"b13f7d0e5a2c","DomainDNSRoot":"corp.example.com","DomainObjectGUID":"5b1e0c6e-8f7a-4c7d-9e1a-2f3b4c5d6e7f","ForestDNSRoot":"example.com","ForestObjectGUID":"0a1b2c3d-4e5f-6071-8293-a4b5c6d7e8f9"}

Response

An agent verdict:

`subcode`	`submessage`
`TRUE`	Domain does not exist. It was created. Please proceed.
`TRUE`	Domain exists, but no designated update server exists. You have been assigned this role. Please proceed.
`TRUE`	You are already the designated update server. You may proceed.
`TRUE`	Last update field was missing. It has been replaced, please proceed.
`TRUE`	The last update was so old the update server has been replaced. It is you now. Please proceed. — the previous server had not updated for longer than the configured takeover period.
`FALSE`	You may not update this server. It belongs to another update server.

Failures:

`subcode`	Cause
`FALSE`	With `submessage` `Missing or corrupt token.` or `Domain and/or forest identifiers missing.`
`A database error occurred while processing this request.`	A database statement failed.

ADUpdateForestData

Updates the stored properties of the forest. The fields mirror PowerShell's Get-ADForest.

PUT https://api.moleant.com/v2/engine/ad/forest

v1 alias: POST https://api.moleant.com/discover/ADUpdateForestData/ with the same fields, and the credential, in a JSON body.

Request

Authentication: Engine token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`ServerGuid`	Yes	The calling agent's id. Must be the designated update server.	Alphanumeric, max 100.
`ForestDNSRoot`	Yes	The forest root domain.	DNS name, max 255.
`ApplicationPartitions, CrossForestReferences, DomainNamingMaster, Domains, ForestMode, GlobalCatalogs, Name, PartitionsContainer, SchemaMaster, Sites, SPNSuffixes, UPNSuffixes`	No	Forest properties.	Text, max 1024 each.
`CGuid`	No	Ignored.

Example request

PUT https://api.moleant.com/v2/engine/ad/forest
Authorization: Bearer 2f0c…9a1b
Content-Type: application/json

{"ServerGuid":"b13f7d0e5a2c","ForestDNSRoot":"corp.example.com","ForestMode":"Windows2016Forest","SchemaMaster":"DC01.corp.example.com","DomainNamingMaster":"DC01.corp.example.com","GlobalCatalogs":"DC01.corp.example.com","Sites":"Stockholm","UPNSuffixes":"contoso.com"}

Response

An agent verdict: TRUE / Cats are nice. (sic) on success, or FALSE with Domain does not exist. Please call ADCheckUpdateAllowed first., Domain exists, but no designated update server exists. Please call ADCheckUpdateAllowed first. or You are not the designated update server.

Failures:

`subcode`	Cause
`FALSE`	With `submessage` `Missing or corrupt token.` or `Domain and/or forest identifiers missing.`
`A database error occurred while processing this request.`	A database statement failed.

ADUpdateDomainData

Updates the stored properties of a domain. The fields mirror PowerShell's Get-ADDomain; only some are stored.

PUT https://api.moleant.com/v2/engine/ad/domain

v1 alias: POST https://api.moleant.com/discover/ADUpdateDomainData/ with the same fields, and the credential, in a JSON body.

Request

Authentication: Engine token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`ServerGuid`	Yes	The calling agent's id. Must be the designated update server.	Alphanumeric, max 100.
`DomainObjectGUID`	Yes	Object GUID of the domain.	Text, max 1024.
`DNSRoot`	Yes	The domain's DNS name.	Text, max 1024.
`DomainSID, Forest, DistinguishedName, DomainMode, InfrastructureMaster, PDCEmulator, RIDMaster, ParentDomain`	No	Stored.	Text, max 1024 each.
`ForestObjectGUID`	No	Stored.	GUID, max 100.
`AllowedDNSSuffixes, ChildDomains, ComputersContainer, DeletedObjectsContainer, DomainControllersContainer, ForeignSecurityPrincipalsContainer, LastLogonReplicationInterval, LinkedGroupPolicyObjects, LostAndFoundContainer, ManagedBy, NetBIOSName, ObjectClass, PublicKeyRequiredPasswordRolling, QuotasContainer, ReadOnlyReplicaDirectoryServers, ReplicaDirectoryServers, SubordinateReferences, SystemsContainer, UsersContainer`	No	Accepted but not stored.
`CGuid`	No	Ignored.

Example request

PUT https://api.moleant.com/v2/engine/ad/domain
Authorization: Bearer 2f0c…9a1b
Content-Type: application/json

{"ServerGuid":"b13f7d0e5a2c","DomainObjectGUID":"5b1e0c6e-8f7a-4c7d-9e1a-2f3b4c5d6e7f","DNSRoot":"corp.example.com","DomainSID":"S-1-5-21-1004336348-1177238915-682003330","DomainMode":"Windows2016Domain","PDCEmulator":"DC01.corp.example.com","RIDMaster":"DC01.corp.example.com","InfrastructureMaster":"DC01.corp.example.com"}

Response

An agent verdict: TRUE / Domain updated. on success, or FALSE with Domain does not exist. Please call ADCheckUpdateAllowed first., Domain exists, but no designated update server exists. Please call ADCheckUpdateAllowed first. or You are not the designated update server.

Failures:

`subcode`	Cause
`FALSE`	With `submessage` `Missing or corrupt token.` or `Domain and/or server identifiers missing.`
`A database error occurred while processing this request.`	A database statement failed.

Changes in this version: NetBIOSName and ForestObjectGUID are stored; the previous endpoint dropped them.

ADUpdateDomainStatistics

Replaces the stored object counts of a domain.

PUT https://api.moleant.com/v2/engine/ad/statistics

v1 alias: POST https://api.moleant.com/discover/ADUpdateDomainStatistics/ with the same fields, and the credential, in a JSON body.

Request

Authentication: Engine token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`ServerGuid`	Yes	The calling agent's id. Must be the designated update server.	Hex, max 100.
`DomainDNSRoot`	Yes	The domain.	DNS name, max 255.
`DomainObjectGUID`	Yes	Object GUID of the domain.	GUID, max 255.
`ForestDNSRoot`	No	The forest root domain.	DNS name, max 255.
`ForestObjectGUID`	No	Object GUID of the forest.	GUID, max 100.
`Users, Groups, InactiveUsers, DisabledUsers, LockedOutUsers, ExpiredUsers, PasswordExpiredUsers, Workstations, Servers, DisabledComputers`	No	Object counts.	Digits.
`Computers`	No	Computer count.	Digits, max 10.
`PrimaryUpdateServer`	No	Stored as sent.	Text, max 1024.
`LastUpdated`	No	Ignored; the server's clock is used.

Example request

PUT https://api.moleant.com/v2/engine/ad/statistics
Authorization: Bearer 2f0c…9a1b
Content-Type: application/json

{"ServerGuid":"b13f7d0e5a2c","DomainDNSRoot":"corp.example.com","DomainObjectGUID":"5b1e0c6e-8f7a-4c7d-9e1a-2f3b4c5d6e7f","Users":"412","Computers":"96","Groups":"57","InactiveUsers":"31","DisabledUsers":"12","LockedOutUsers":"0","ExpiredUsers":"2","PasswordExpiredUsers":"5","Workstations":"81","Servers":"15","DisabledComputers":"4"}

Response

An agent verdict: TRUE / Cats are nice. (sic) on success, or FALSE with Domain statistics does not exist. Please call ADCheckUpdateAllowed first., Domain statistics exists, but no designated update server exists. Please call ADCheckUpdateAllowed first. or You are not the designated update server.

Failures:

`subcode`	Cause
`FALSE`	With `submessage` `Missing or corrupt token.` or `Domain identifiers missing.`
`A database error occurred while processing this request.`	A database statement failed.

ADUpdateDomainUserData

Stores a batch of domain users. Large domains are sent in several calls that share one UserUpdateSession: the first call of a new session deletes the domain's stored users, and later calls of the same session append to them.

PUT https://api.moleant.com/v2/engine/ad/users

v1 alias: POST https://api.moleant.com/discover/ADUpdateDomainUserData/ with the same fields, and the credential, in a JSON body.

Request

Authentication: Engine token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`ServerGuid`	Yes	The calling agent's id. Must be the designated update server.	Alphanumeric, max 100.
`DNSRoot`	Yes	The domain.	DNS name, max 250.
`UserUpdateSession`	Yes	Id shared by the calls of one full upload. Use a new value for each upload.	Hex, max 120.
`DomainUsers`	Yes	Array of user objects with single-letter keys; see below.
`DomainObjectGUID, CGuid`	No	Ignored.

Keys of each DomainUsers element. The agent sends more letters; these are the ones stored. Values are Text, max 250.

Key	AD attribute	Notes
`I`	SamAccountName
`F`	ObjectGUID
`G`	DistinguishedName	Optional.
`B`	Enabled	Optional.
`C`	GivenName
`D`	Name
`K`	Surname

Example request

PUT https://api.moleant.com/v2/engine/ad/users
Authorization: Bearer 2f0c…9a1b
Content-Type: application/json

{"ServerGuid":"b13f7d0e5a2c","DNSRoot":"corp.example.com","UserUpdateSession":"9f8e7d6c","DomainUsers":[{"I":"alovelace","F":"2c7d...","G":"CN=Ada Lovelace,OU=Staff,DC=corp,DC=example,DC=com","B":"True","C":"Ada","D":"Ada Lovelace","K":"Lovelace"}]}

Response

An agent verdict: TRUE / Domain users updated on success, or FALSE with Domain does not exist. Please call ADCheckUpdateAllowed first., Domain exists, but no designated update server exists. Please call ADCheckUpdateAllowed first. or You are not the designated update server.

Failures:

`subcode`	Cause
`FALSE`	With `submessage` `Missing or corrupt token.`, `DomainUsers missing or corrupt.`, `UserUpdateSession missing or corrupt.` or `Domain identifiers missing.`
`A database error occurred while processing this request.`	A database statement failed.

Changes in this version: A user already present in the session is updated instead of failing the batch.

ADUpdateDomainControllers

Stores the domain controllers the agent found. Unlike the other pushes it does not check the designated update server.

Only one controller per domain survives. Each element first deletes every stored controller of its domain and then inserts itself, so of several controllers of the same domain — in one call or across calls — only the last one is kept.

PUT https://api.moleant.com/v2/engine/ad/domaincontrollers

v1 alias: POST https://api.moleant.com/discover/ADUpdateDomainControllers/ with the same fields, and the credential, in a JSON body.

Request

Authentication: Engine token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`DomainControllers`	Yes	Array of controller objects; see below.
`CGuid`	No	Ignored; the token decides the organization.

Keys of each DomainControllers element. Values are validated as Text, max 500, unless noted.

Key	Description	Notes
`DomainObjectGUID`	Object GUID of the controller's domain; decides which stored controllers are replaced.
`HostName, Name, Domain, Forest, Site`	Identity and location.
`ComputerObjectDN, DefaultPartition, NTDSSettingsObjectDN, ServerObjectDN, ServerObjectGuid, InvocationId`	Directory references.
`IPv4Address, IPv6Address`	Addresses.
`Enabled, IsGlobalCatalog`	As reported by PowerShell.	Max 10.
`LdapPort, SslPort`	Ports.	Digits, max 4 and 5.
`OperatingSystem, OperatingSystemHotfix, OperatingSystemServicePack, OperatingSystemVersion`	Operating system.
`OperationMasterRoles`	Space-separated FSMO roles: `SchemaMaster`, `DomainNamingMaster`, `PDCEmulator`, `RIDMaster`, `InfrastructureMaster`.	Sets the `is…` flags.
`Partitions`	Array of partition DNs.

Example request

PUT https://api.moleant.com/v2/engine/ad/domaincontrollers
Authorization: Bearer 2f0c…9a1b
Content-Type: application/json

{"DomainControllers":[{"HostName":"DC01.corp.example.com","Name":"DC01","Domain":"corp.example.com","Forest":"corp.example.com","DomainObjectGUID":"5b1e0c6e-8f7a-4c7d-9e1a-2f3b4c5d6e7f","Enabled":"True","IsGlobalCatalog":"True","LdapPort":"389","SslPort":"636","IPv4Address":"10.0.1.10","OperationMasterRoles":"PDCEmulator RIDMaster InfrastructureMaster","Partitions":["DC=corp,DC=example,DC=com"],"Site":"Stockholm","OperatingSystem":"Windows Server 2022 Standard"}]}

Response

A status message. On success the subcode is Added domain controllers to list. — a plain success, not a verdict.

Failures:

`subcode`	Cause
`FALSE`	With `submessage` `Missing or corrupt token.` or `DomainControllers missing or corrupt.`
`A database error occurred while processing this request.`	A database statement failed.

Changes in this version: Every domain controller of a domain is stored (the table template no longer has a unique index on the domain; organizations created earlier keep one row per domain until the index is dropped).

Engine inventory

How Moleant Engine reports an asset.

createserver

Moleant Engine's inventory push. The first call for a ServerGuid creates the asset, with an asset card in environment 1 and asset state 1, and logs Asset was created. Later calls update the asset. Each inventory array replaces what is stored for the asset in that section.

POST https://api.moleant.com/v2/engine/assets

v1 alias: POST https://api.moleant.com/discover/createserver/ with the same fields, and the credential, in a JSON body.

Request

Authentication: Engine token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`ServerGuid`	Yes	The agent's stable id for the machine. Identifies the asset across calls.	Text, max 120.
`Hostname`	Yes	Host name.	Text, max 63.
`SystemType`	Yes	Kind of machine, as reported by the agent.	Text, max 30.
`WindowsType`	Yes	One of `DomainMember`, `Standalone`, `AzureAD` or `Unknown`.	Case-sensitive.
`SerialNumber`	No	Hardware serial number.	Text, max 100.
`Vendor`	No	Hardware vendor.	Text, max 120.
`OperatingSystem`	No	Operating system name and version.	Text, max 256.
`WindowsMemberShip`	No	Domain or workgroup.	DNS name, max 230.
`DomainSuffix`	No	DNS suffix.	DNS name, max 190.
`DateRebooted`	No	Last reboot, `YYYY-MM-DD HH:MM:SS`.	Text, max 20.
`DateCreated`	No	Installation date.	Text, max 50.
`Memory`	No	Physical memory in bytes.	Digits, max 40.
`NICS, Disks, CPU, …`	Yes	The inventory arrays in the next table.	Send every array; use `[]` when there is nothing to report.

Inventory arrays. Every element is an object with the listed keys; values are validated as Text unless noted.

Array	Element keys	Notes
`NICS`	`name`, `MAC`, `gw`, `IPAddresses` (array of strings), `Subnets` (array, parallel to `IPAddresses`), `DNS` (array of strings).
`StaticRoutes`	Strings, one route each.	Optional.
`ListeningPorts`	`LocalAddress`, `ListeningPort` (digits), `IPVersion`, `PortType`.	Optional.
`Roles`	`Name`, `InstallState`, `DisplayName`.	Optional.
`LocalUsers`	`User`.	Replaces local accounts only; primary users linked through ModifyServerDetails are kept.
`LocalGroups`	`Group`, `UserMemberShip` (array of user names).
`WindowsServices`	`Name`, `Displayname`, `Path`, `Status` (optional), `Context`, `StartType`.
`InstalledApplications`	`ApplicationName`, `Version`, `Publisher`, `InstallDate`.	Version max 20, Publisher max 60.
`Disks`	`MountPoint`, `VolumeName`, `Filesystem`, `Type` (these three optional), `TotalBytes`, `UsedBytes`, `FreeBytes` (digits), `FreePCT`.
`Certificates`	`dnsnames`, `friendlynames`, `Oid`, `HasPrivateKey`, `NotAfter`, `NotBefore` (digits, Unix time), `SerialNumber`, `Thumbprint`, `Subject`, `SubjectName`.	Optional.
`LastLoggedin`	`Name`, `LastLogin` (digits, Unix time).	Optional.
`Shares`	`ShareName`, `SharePath`, `Description`.
`CPU`	`Model`, `Speed`, `Cores` (digits).

Arrays marked optional may be omitted. Omitting any other array still clears that section, and also makes the server log a PHP warning.

Example request

POST https://api.moleant.com/v2/engine/assets
Authorization: Bearer 2f0c…9a1b
Content-Type: application/json

{"ServerGuid":"b13f7d0e5a2c","Hostname":"SRV-FILE01","SystemType":"Server","WindowsType":"DomainMember","OperatingSystem":"Windows Server 2022 Standard","Vendor":"Dell Inc.","SerialNumber":"7XK2QP3","WindowsMemberShip":"corp.example.com","DomainSuffix":"corp.example.com","DateRebooted":"2026-07-14 03:12:08","DateCreated":"2025-02-02 09:41:11","Memory":"34359738368","NICS":[{"name":"Ethernet0","MAC":"00:50:56:9A:11:22","gw":"10.0.4.1","IPAddresses":["10.0.4.21"],"Subnets":["255.255.255.0"],"DNS":["10.0.1.10"]}],"LocalUsers":[{"User":"Administrator"}],"LocalGroups":[{"Group":"Administrators","UserMemberShip":["Administrator"]}],"WindowsServices":[],"InstalledApplications":[{"ApplicationName":"7-Zip","Version":"23.01","Publisher":"Igor Pavlov","InstallDate":"20250310"}],"Disks":[{"MountPoint":"C:","TotalBytes":"137438953472","UsedBytes":"89120571392","FreeBytes":"48318382080","FreePCT":"35.2"}],"Shares":[],"CPU":[{"Model":"Intel Xeon Silver 4310","Speed":"2100","Cores":"12"}]}

Response

A status message. On success the subcode is Server was created., for updates too.

Failures:

`subcode`	Cause
`Invalid token.`	The token was malformed (HTTP 403) or unknown (HTTP 400).
`Mandatory value hostname missing or invalid.`	`Hostname` was missing or too long.
`Mandatory value SystemType missing or invalid.`	`SystemType` was missing or too long.
`Mandatory value ServerGuid missing or invalid.`	`ServerGuid` was missing or too long.
`Mandatory value WindowsType missing or invalid.`	`WindowsType` was not one of the four values.
`Unable to create server.`	The asset row could not be written.
`Unable to create server details.`	The asset card could not be written.
`A database error occurred while processing this request.`	A database statement failed.

Changes in this version: The inventory is replaced in one transaction, so a failure half-way leaves the previous inventory intact. DNS servers of every adapter are kept (only the last adapter's were), CPU models are stored without a leading space, and a duplicate local user or certificate in the report is skipped instead of failing the whole report.

Accounts and orders

Moleant accounts, plans and subscriptions (the account.moleant.com branch) and the Stripe webhook.

CreateAccount

Creates an account in Moleant's directory with the given subscriptions and e-mails the sign-in details.

POST https://api.moleant.com/v2/account/users

v1 alias: POST https://api.moleant.com/account/CreateAccount/ with the same fields, and the credential, in a JSON body.

Request

Authentication: Account token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`Mode`	Yes	`Create`. `Invite` is accepted but not implemented.	Case-sensitive.
`Email`	Yes	E-mail address of the new account.	E-mail, max 255.
`FirstName`	Yes	Given name.	Plain text, max 255.
`LastName`	Yes	Surname.	Plain text, max 255.
`MiddleName`	No	Middle name.	Plain text, max 255.
`PurchasedSubscriptions`	Yes	Array of subscription GUIDs. Every one must exist.	Hex, max 120 each.

Example request

POST https://api.moleant.com/v2/account/users
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"Mode":"Create","Email":"ada@contoso.com","FirstName":"Ada","LastName":"Lovelace","PurchasedSubscriptions":["f17f35b502f0d4d965ef594fe1c9fc0c"]}

Response

A status message. On success the subcode is User was successfully created., with the same text in submessage.

Failures, in addition to the common failures:

`subcode`	Cause
`Mode not specified or incorrect.`	`Mode` was not `Create` or `Invite`.
`Firstname and Lastname must be specified when creating a new user.`	A name was missing.
`Email must be specified.`	`Email` was missing or not an e-mail address.
`FALSE`	With `submessage` `Subscription data missing or invalid`: `PurchasedSubscriptions` was missing or not an array.
`User does already exist and cannot be added again.`	The address already has an account.
`The Invite function is not implemented at this time.`	`Mode` was `Invite`.
`The target email is already used for another user.`	The address is taken in the directory.
`One of the subscriptions does not exist.`	An unknown subscription GUID. `submessage`: `Invalid subscription id.`
`Could not authenticate with the Microsoft Graph API. Please contact MoleAnt System Administration.. EC: …`	Moleant could not get a Graph token.
`Failed to create user. EC: …`	Graph rejected the new account.
`User could not be created.`	The account record could not be written.
`An error occurred while creating the user. Please try again later.`	The account could not be confirmed.
`General error. Please contact system administration.`	Anything else.

Changes in this version: The hidden password override has been removed; only an Account token with the CreateAccount/CREATE purpose lock is accepted.

OnBoardAccount

Returns an account, its plan and the state of each subscription, for the website to show while provisioning runs. Calling it also starts provisioning of every subscription that is still in state 1.

POST https://api.moleant.com/v2/account/onboarding

v1 alias: POST https://api.moleant.com/account/OnBoardAccount/ with the same fields, and the credential, in a JSON body.

Request

Authentication: Account token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`AccountGuid`	Yes	Object id of the account.	GUID, max 255.

Example request

POST https://api.moleant.com/v2/account/onboarding
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"AccountGuid":"74c78695-356f-4b00-8b62-bc4e166c37b2"}

Response

An object with a User array (one element) and a Subscriptions array. All values are strings.

Attribute	Description	Example
`User[].UserID`	The account's e-mail address.	ada@contoso.com
`User[].AccountGuid`	Object id of the account.	74c78695-356f-4b00-8b62-bc4e166c37b2
`User[].GivenName / MiddleName / SurName`	Name.	Ada / / Lovelace
`User[].Plan`	Plan GUID.	b0d2...
`Subscriptions[].SubscriptionGuid`	Subscription GUID.	f17f35b502f0d4d965ef594fe1c9fc0c
`Subscriptions[].Name / Description`	Subscription name and description.	Moleant Discover
`Subscriptions[].StateControl`	`1` received, `2` started, `4` in progress, `8` ready, `16` failed.	8
`Subscriptions[].StateMessage`	Text to show for the state.	This subscription is now ready and can be used.
`Subscriptions[].LandingZone`	Where to send the user when it is ready.	https://discover.moleant.com/

Example response

{"User":[{"UserID":"ada@contoso.com","AccountGuid":"74c78695-356f-4b00-8b62-bc4e166c37b2",
   "GivenName":"Ada","MiddleName":"","SurName":"Lovelace","Plan":"b0d2..."}],
 "Subscriptions":[{"SubscriptionGuid":"f17f35b502f0d4d965ef594fe1c9fc0c","Name":"Moleant Discover",
   "Description":"Moleant Discover standard subscription","StateControl":"8",
   "StateMessage":"This subscription is now ready and can be used.","LandingZone":"https://discover.moleant.com/"}]}

Failures, in addition to the common failures:

`subcode`	Cause
`AccountGuid missing.`	`AccountGuid` was missing or not a GUID.
`User does not exist.`	No account has that id.
`User is not bound to a plan.`	The account has no plan.
`User is not bound to a subscription.`	The plan has no subscription.
`General error. Please contact system administration.`	Anything else.

Changes in this version: Only the account of the token holder can be onboarded (AccountGuid must be the caller's own id).

OffBoardAccount

Deprovisions every ready subscription (state 8) of an account, removing the organization it provisioned. A subscription is skipped when the account is linked to more or fewer than one organization, since the right one cannot be told apart.

Irreversible. Deprovisioning deletes the organization and its data.

POST https://api.moleant.com/v2/account/offboarding

v1 alias: POST https://api.moleant.com/account/OffBoardAccount/ with the same fields, and the credential, in a JSON body.

Request

Authentication: Account token. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`AccountGuid`	Yes	Object id of the account.	GUID, max 255.

Example request

POST https://api.moleant.com/v2/account/offboarding
Authorization: Bearer eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIi…
Content-Type: application/json

{"AccountGuid":"74c78695-356f-4b00-8b62-bc4e166c37b2"}

Response

An object listing what happened.

Attribute	Description	Example
`Deprovisioned`	Array of subscription GUIDs that were deprovisioned.	["f17f35b502f0d4d965ef594fe1c9fc0c"]
`Skipped`	Array of subscription GUIDs that could not be deprovisioned. Present only when there are any.

Example response

{"Deprovisioned":["f17f35b502f0d4d965ef594fe1c9fc0c"]}

Failures, in addition to the common failures:

`subcode`	Cause
`AccountGuid missing.`	`AccountGuid` was missing or not a GUID.
`User does not exist.`	No account has that id.
`User is not bound to a plan.`	The account has no plan.
`User is not bound to a subscription.`	The plan has no subscription.
`No subscriptions could be deprovisioned.`	Nothing was deprovisioned. `submessage` lists the skipped GUIDs, or says `No provisioned subscriptions found for this account.`

Changes in this version: Only the account of the token holder can be offboarded.

AcceptOrder

Stripe's webhook for a completed checkout. For a customer Moleant has not seen before it creates an account in Moleant's directory with the default subscription and e-mails the sign-in details. For a known customer it records the payment.

POST https://api.moleant.com/v2/webhooks/stripe

v1 alias: POST https://api.moleant.com/discover/AcceptOrder/ with the same fields, and the credential, in a JSON body.

Request

Authentication: Stripe signature. Fields marked Path segment are part of the URL; the others are fields of the JSON request body.

Attribute	Mandatory?	Description	Notes
`data.object.customer`	Yes	Stripe customer id; identifies the order.	Text, max 200.
`data.object.customer_name`	Yes	Customer name; the first two words become given name and surname.	Text, max 200.
`data.object.customer_email`	Yes	Customer e-mail address; receives the welcome e-mail.	Text, max 355.
`data.object.customer_phone`	Yes	Customer phone number.	Text, max 200.
`data.object.id`	No	Read, never used.

Example request

POST https://api.moleant.com/v2/webhooks/stripe
Stripe-Signature: t=1726570000,v1=…
Content-Type: application/json

{"id":"evt_1MRI0CH2l3145r1K1Kl9v4d7","type":"checkout.session.completed","data":{"object":{"id":"cs_live_a1b2...","customer":"cus_NBfaOUY0f3fziN","customer_name":"Ada Lovelace","customer_email":"ada@contoso.com","customer_phone":"+46701234567"}}}

Response

A status message. On success the subcode is User was successfully created., with the same text in submessage. A known customer gets a Success status with an empty subcode.

Failures:

`subcode`	Cause
`customer missing`	The field was missing; likewise `customer_name missing`, `customer_phone missing` and `customer_email missing`. `submessage`: `Provisioning failure.`
`Could not authenticate with the Microsoft Graph API. Please contact MoleAnt System Administration.. EC: …`	Moleant could not get a Graph token.
`Failed to create user. EC: …`	Graph rejected the new account.
`User could not be created.`	The account record could not be written.
`An error occurred while creating the user. Please try again later.`	Anything else. `submessage`: `User creation failure.`

Changes in this version: The request must carry a valid Stripe-Signature header for the endpoint's signing secret; unsigned calls get HTTP 403. Customer details are also read from data.object.customer_details when the top-level fields are absent.

Key routes kept from the previous v2

The previous v2 API exposed these key-authenticated routes. They keep working: the organization comes from the key (?Key= or X-Api-Key), and a CGuid parameter is ignored. Each one is the operation linked in the table, with the same parameters and responses.

Route	Operation	Notes
GET `/v2/assets`	ListComputers	All assets; the ListComputers filters apply.
GET `/v2/assets/{ServerID}`	ListComputers	One asset, filtered by `ServerID`; PUT/PATCH modifies the card, DELETE deletes the asset.
PUT PATCH `/v2/assets/{ServerID}`	ModifyServerDetails	One asset, filtered by `ServerID`; PUT/PATCH modifies the card, DELETE deletes the asset.
DELETE `/v2/assets/{ServerID}`	DeleteServer	One asset, filtered by `ServerID`; PUT/PATCH modifies the card, DELETE deletes the asset.
GET `/v2/assetdetails`	AllServerDetails	Every asset with every section.
GET `/v2/assetdetails/{ServerID}`	ListServerDetails	One asset with every section.
GET `/v2/systems`	ListSystems	The organization's systems.
GET `/v2/systems/{SystemID}`	ListSystemDetails	One system.
GET `/v2/systemlog`	ListLogEntries	The organization's user-written log entries.
GET `/v2/systemlog/{SystemID}`	ListLogEntries	The entries of one system.
GET `/v2/orglog`	ListMasterLogEntries	The 250 most recent master log entries.
GET `/v2/entitlements`	ListEntitlements	All entitlements.
GET `/v2/entitlements/{SystemID}`	ListEntitlements	The entitlements relevant to one system.
GET `/v2/sbom`	ListSbom	Requires `SystemID` as a query parameter.
GET `/v2/sbom/{SystemID}`	ListSbom	The SBOM of one system.
GET `/v2/vex`	ListVex	Requires `SystemID` as a query parameter.
GET `/v2/vex/{SystemID}`	ListVex	The VEX document of one system.

The previous v2 answered any other path under /v2/ with 501; this version answers 404, and every documented route is implemented.