API Requests and How They Work in SanerCVEM

Objective

This article explains the basics of how API requests work in general and how the Saner agent interacts with SanerCVEM through APIs for device communication, data exchange, and remediation.

Understanding API Requests (General)

• API (Application Programming Interface): A defined way for two systems (client and server) to communicate.

• Request/Response model:

  • A client sends an HTTP request (GET, POST, PUT, DELETE) with necessary headers and data.

  • The server processes the request and returns an HTTP response with status code and result.

• Authentication: Most APIs use tokens or credentials to verify client identity.

• Data format: JSON is the most common format used for requests and responses.

How API Requests Work in SanerCVEM

1. Agent Initiation

• The Saner agent installed on the endpoint device initiates requests to the SanerCVEM server.

• Communication is outbound from the agent (no need for inbound firewall rules).

2. Request/Response Flow

• Request: Agent → CVEM API endpoint (HTTPS, JSON format).

• Response: CVEM → Agent with tasks, configurations, or acknowledgement.

Example (conceptual flow):

1. Agent requests: “Do I have any new tasks?”

2. CVEM responds: “Yes, apply this patch or run this response.”

3. Agent executes the action locally and reports back via another API call.

3. Secure Communication

• All API traffic is over HTTPS (TLS encrypted).

• Only authorised, token-based agent requests are accepted by CVEM

Notes

• API requests from agents are automatic, no manual intervention required.

• Admins can also directly interact with SanerCVEM APIs for integration (via API keys).

Conclusion

API requests act as the backbone of communication between Saner agents and SanerCVEM. While APIs in general work through a request-response model over HTTP(S), the Saner agent uses secure, token-based API calls to fetch tasks, upload results, and maintain synchronisation with the SanerCVEM server. This ensures continuous visibility, vulnerability management, and remediation across all managed devices.