API Documentation

Public data endpoints (patterns, controls, frameworks) require no authentication. Key management endpoints require either a browser session (OAuth) or an API key.

curl -H "X-API-Key: osa_your_key_here" \
  https://www.opensecurityarchitecture.org/api/v1/patterns

List all security patterns with optional filtering and pagination.

Get full detail for a specific pattern including controls, threats, examples, and references.

One call for the join that otherwise takes a pattern call, a framework call and one call per control: each control with its emphasis, the threats it mitigates in this pattern, and its clauses in the frameworks you name. An empty clause list means OSA records no mapping, and the response names those controls under unmapped. For a framework compared with a published crosswalk, unmapped_checked lists the ones with no clause there either. Where OSA's mapping takes a published crosswalk as its base, based_on names it, and a control's osa_own lists the clauses OSA adds to it, which are still part of OSA's mapping. A control that NIST has withdrawn from SP 800-53 is marked withdrawn, with the controls it moved into. pattern.control_counts gives the totals for the whole pattern, so a filtered response shows how many controls it left out.

IDs are accepted in either form: SP-023 or sp-023, SC-07 or sc-7, iec_62443 or iec-62443.

List the NIST SP 800-53 Rev 5 controls with optional filtering. The controls that NIST has withdrawn are included, each marked withdrawn.

Get full control detail including compliance mappings and which patterns use it. withdrawn says whether NIST has withdrawn the control, and incorporated_into names the controls its content moved into. attack gives the number of MITRE ATT&CK techniques the control mitigates in CTID's mapping, with the route that lists them.

Line up a set of SP 800-53 controls against up to five frameworks in one call, for example your own controls once you have mapped them to SP 800-53 (how). For each framework it lists the matching clauses (clauses_reached) and the gaps (clauses_not_reached) in the framework's own order, with the SP 800-53 controls that map to each gap (controls_for_not_reached). For each control it lists the control's clauses. Check each matching clause against the framework's own text. Where OSA's mapping starts from a published crosswalk, based_on names it and a control's osa_own lists the clauses OSA adds. For a withdrawn control outside OSA's catalogue, such as SA-12, withdrawn_by_nist names what NIST moved it into.

The ATT&CK version, the sources and their licences, counts, and the tactics with how many of their techniques have a control.

Techniques and sub-techniques, each with its CTID status (mapped, non_mappable, unmapped) and its number of controls.

One technique: MITRE's description, its SP 800-53 controls, MITRE's mitigations and detection strategies, the groups MITRE records using it, its sub-techniques, and the OSA patterns ranked by how many of its controls they include. The same as a card at /attack/t1566.md.

List all 90 supported compliance frameworks with mapping statistics.

Get framework detail. Use fields=mappings for paginated control-to-framework mappings.

List all patterns the authenticated user is following. Returns pattern IDs and follow timestamps.

Follow a pattern. Idempotent — following an already-followed pattern succeeds silently.

Unfollow a pattern. Idempotent — unfollowing an unfollowed pattern succeeds silently.

Public endpoint returning the follower count for a pattern. Cached for 5 minutes.

List all frameworks the authenticated user is following.

Follow a framework. Idempotent.

Unfollow a framework. Idempotent.

Public endpoint returning the follower count for a framework. Cached for 5 minutes.

List your API keys (name, prefix, tier, rate limit, timestamps). The full key is never returned.

Create a new API key. Maximum 5 active keys per account.

POST /api/v1/keys
Content-Type: application/json
Cookie: session=...

{
  "name": "My Integration"
}

{
  "key": "osa_abc123...",
  "data": {
    "id": "2fd2564e0e21...",
    "name": "My Integration",
    "prefix": "osa_abc1",
    "tier": "free",
    "rate_limit": 100,
    "created_at": "2026-02-12T09:00:00Z"
  }
}

The full key is returned only once at creation. Store it securely — it cannot be retrieved later.

Revoke an API key. Revoked keys are immediately rejected on authenticated endpoints. Returns 204 on success.