Make a raw request to any AttackForge SSAPI endpoint.

Args: method: HTTP method (GET, POST, PUT, DELETE, PATCH) endpoint: SSAPI path, e.g. "/vulnerabilities" or "/project/123/testcases" params: Optional query string parameters body: Optional JSON request body

Manage AttackForge projects.

Actions: list — GET /projects (summary; optional: limit default 25) Returns total + has_more. Use projects.get for full detail. get — GET /project/:id (requires: id) create — POST /project (requires: fields) update — PUT /project/:id (requires: id, fields) clone — POST /project/:id/clone (requires: id) archive — PUT /project/:id/archive (requires: id) restore — PUT /project/:id/restore (requires: id) get_notes — GET /project/:id/notes (requires: id) create_note — POST /project/:id/note (requires: id, note_content) update_note — PUT /project/:id/note/:noteId (requires: id, note_id, note_content) workspace — GET /project/:id/workspace (requires: id)

Manage AttackForge vulnerabilities.

Actions: list — GET /vulnerabilities (summary only; optional: project_id, limit default 25) Prefer project_id scope — global list can return 500+ items. Returns total + has_more. Use get for full text fields. get — GET /vulnerability/:id (requires: id; returns full detail) list_by_asset — GET /vulnerabilities/asset (requires: asset_name) create — POST /vulnerability (requires: fields incl. project_id) update — PUT /vulnerability/:id (requires: id, fields) bulk_create — POST /vulnerability/bulk (requires: project_id, items=[{...},...]) summarize_custom_fields — Scan all vulns in a project and return each custom field key with its distinct non-empty values. (requires: project_id) Optional: fields={"key": "apmid"} to filter to one field. Use this to discover what custom fields an org uses before querying by value — works for any AF instance, not just T-Mobile. list_by_custom_field — Return slimmed vuln summaries where a custom field matches a value. (requires: project_id, fields={"key": "...", "value": "..."}) Optional: limit (default 25).

Key fields for create: projectId (camelCase, required), title (required), affected_asset_name (required), priority (required), description (required), attack_scenario (required), remediation_recommendation (required), steps_to_reproduce (required), tags, notes=[{note, type}], is_zeroday, is_visible, custom_fields=[{key, value}], linked_testcases, custom_tags=[{name, value}]. Key fields for update: project_id (snake_case), title, priority, status, likelihood_of_exploitation, description, attack_scenario, remediation_recommendation, steps_to_reproduce, tags, notes=[{note, type}], is_zeroday, is_visible, is_deleted, custom_fields=[{key, value}], linked_testcases, custom_tags=[{name, value}].

Manage AttackForge testsuite libraries.

Actions: list — GET /testsuites get — GET /testsuites/:id (requires: id) create — POST /testsuite (requires: fields: name, description) update — PUT /testsuite/:id (requires: id, fields) add_testcase — POST /testsuite/:id/testcase (requires: id, fields) add_testcases — POST /testsuite/:id/testcases (requires: id, items=[{...},...]) update_testcase — PUT /testsuite/:id/testcase/:testcase_id (requires: id, testcase_id, fields)

Manage test cases assigned to AttackForge projects.

Actions: list — GET /project/:project_id/testcases (requires: project_id) Optional: limit (default 50). Returns total + has_more. assign — POST /project/:project_id/testcase (requires: project_id, fields) update — PUT /project/:project_id/testcase/:testcase_id (requires: project_id, testcase_id, fields) Key fields: status (Tested/Not Tested), linked_vulnerabilities add_note — POST /project/:project_id/testcase/:testcase_id/note (requires: project_id, testcase_id, note) analytics — GET /analytics/failed/testcases

Manage assets in AttackForge (project scope and library).

Actions: list — GET /assets (all user assets; optional: limit, default 100) list_by_group — GET /assets/group/:id (requires: id = group_id) create_on_project — POST /project/:project_id/assets (requires: project_id, items=[{asset_name, asset_type,...},...]) update_on_project — PUT /project/:project_id/asset/:asset_id (requires: project_id, asset_id, fields) list_library — GET /library/assets get_library — GET /library/asset (params via fields) create_library — POST /library/asset (requires: fields) update_library — PUT /library/asset/:id (requires: id, fields)

Manage remediation notes on AttackForge vulnerabilities.

Actions: create_note — POST /vulnerability/:vulnerability_id/remediationNote (requires: vulnerability_id, fields) Key fields: projectId (required), note (required), note_type ("PLAINTEXT" or "RICHTEXT") update_note — PUT /vulnerability/:vulnerability_id/remediationNote/:note_id (requires: vulnerability_id, note_id, fields)

Query AttackForge analytics endpoints.

Actions: failed_testcases — GET /analytics/failed/testcases vulnerable_assets — GET /analytics/vulnerable/assets (top 100 by vuln count) common_vulns — GET /analytics/common/vulnerabilities (top 50 by count)

Generate and retrieve AttackForge project reports.

Actions: get_data — POST /project/:project_id/report/:report_type (requires: project_id, report_type, optional options) report_type examples: pentest, vulnerability, executive get_report — GET /project/:project_id/report/:report_type (requires: project_id, report_type)

AttackForge utility functions.

Actions: markdown_to_richtext — POST /utils/markdown-to-richtext (requires: markdown) Convert markdown to AF rich text format. Use before setting description/recommendation/note fields. get_form_config — GET /config/form/:config_type (requires: config_type e.g. "vulnerability", "project")

Manage the local SQLite cache for static AF data.

Actions: stats — list all cache entries with key, age_seconds, ttl_seconds, expired invalidate — delete by key (or all entries if no key given)