PACCI CVMS API Documentation

const base = process.env.NEXT_PUBLIC_APP_URL ?? "https://api.pacci-cvms.com";

await fetch(`${base}/api/manage-assets`, {
  credentials: "include",
  headers: {
    "Content-Type": "application/json",
    "x-customer-id": "<customer_id>",
  },
});

• Requires an authenticated session (NextAuth cookies are sent when credentials: "include" is set).
• Requires x-customer-id (or x-pacci-customer-id) on every request: the handler returns 400 if it is missing. Use your organization id for customer portal users; for MSP staff, use the active organization id (same value the UI stores in the customer cookie).

For programmatic access from tools such as Postman, use either a valid session cookie from an authenticated browser session or a Bearer token where your deployment supports it (e.g. JWT from your IdP), consistent with your PACCI auth configuration.

fetch(url, {
  credentials: "include",
});

• Content-Type: application/json for JSON request bodies (POST/PUT).
• Always required for manage-assets: x-customer-id or x-pacci-customer-id must be the target organization id. The handler returns 400 if the header is missing. Customer portal users must use their own org id (403 otherwise).
• Optional for security-overview: the same headers override org when present. If omitted, the server uses the organization already resolved on the session (e.g. customer portal users, or MSP after selecting a customer in the UI). If no organization id can be resolved, you get 400 with a "missing organization scope" style message.
• Dashboard overview family: GET /api/dashboard/overview, GET /api/dashboard/overview/sonar, and GET /api/dashboard/overview/sla do not read x-customer-id; they use getCustomerContext only (MSP must have an active customer selected in-session).

• GET /api/customers — List customers (MSP)
• POST /api/customers — Create customer (role-gated)
• Related: GET/PATCH /api/customers/[customerId], /api/customers/[customerId]/users

Production deployments should set SECURE_VAULT_UPLOAD_DIR to a persistent, writable directory. Serverless filesystems (e.g. default Vercel) are not suitable for durable binary storage unless you use external object storage.

• Vault-oriented reads/writes are exposed under routes such as GET /api/folders, GET /api/secure-vault/findings, and PDF upload via POST /api/folders/files (multipart). Conceptually, GET /api/secure-vault and POST /api/secure-vault/upload map to this surface in product documentation.

Validation (pre-flight)

• POST /api/integrations/sonarqube/validate — SonarQube / SonarCloud connectivity and token checks
• POST /api/integrations/snyk/validate — Snyk API configuration
• POST /api/integrations/checkmarx/validate — Checkmarx One realm and client credentials

Product docs may abbreviate Sonar as /integrations/son/validate; the deployed route is sonarqube.

Catalog sync (writes PACCI DB)

• POST /api/integrations/sonarqube/sync — Pull Sonar projects and issues for the active session organization. After a successful run, Sonar projects that no longer exist upstream are pruned in PACCI (synced Project rows, findings, and sonar_project asset-group members).
• POST /api/integrations/snyk/sync — Refresh Snyk projects and org-level summaries for the active organization.
• POST /api/integrations/checkmarx/sync — Sync Checkmarx One catalog and findings. AppSec code projects no longer assigned in Cx are pruned (including checkmarx_appsec group members for those PACCI project ids).

MSP users must select a customer before calling sync (session customerId); otherwise the API returns 400 with a "no active organization" message.

• Missing credentials: "include" — Browser requests omit the session cookie → 401 Unauthorized.
• Missing x-customer-id / x-pacci-customer-id — On GET /api/manage-assets you get 400 Missing x-customer-id header. On other org routes, MSP flows may resolve the wrong scope → empty or incorrect data.
• Modifying MSP-wide asset groups as customer_admin — Full replace and some writes are forbidden or no-op for shared rows; use org-owned groups or ask an MSP admin.
• Stale local builds — After backend or route changes, rebuild .next (e.g. next build / dev restart) so App Router handlers and middleware match the server you are testing.

{
  "error": "Unauthorized"
}

• 401 — Missing or invalid session
• 403 — Authenticated but not allowed for this resource
• 400 — Malformed body or parameters

fetch — security aggregation

await fetch("https://api.pacci-cvms.com/api/manage-assets", {
  credentials: "include",
  headers: {
    "Content-Type": "application/json",
    "x-customer-id": "<customer_id>",
  },
});

fetch — asset groups

await fetch("/api/asset-groups", {
  credentials: "include",
});

cURL — manage assets

curl -X GET https://api.pacci-cvms.com/api/manage-assets \
  -H "Content-Type: application/json" \
  -H "x-customer-id: <customer_id>"