Assets API - LowerPlane Documentation

Overview

The Assets API lets external systems manage the LowerPlane asset inventory programmatically. Use it to sync assets from your CMDB, provisioning pipelines, or custom discovery tools. All endpoints require API key authentication.

Endpoints

Method	Path	Description
GET	`/api/v1/external/assets`	List assets
GET	`/api/v1/external/assets/{id}`	Get a single asset
POST	`/api/v1/external/assets`	Create an asset
PUT	`/api/v1/external/assets/{id}`	Update an asset
DELETE	`/api/v1/external/assets/{id}`	Delete an asset

List Assets

GET /api/v1/external/assets

string

Filter by asset type (see Asset types).

string

Filter by status: active, inactive, archived.

string

Filter by criticality: low, medium, high, critical.

string

Filter by data classification: public, internal, confidential, restricted.

string

Search assets by name, description, or external ID.

string

default:"name"

Sort field: name, type, status, criticality, created_at, updated_at.

string

default:"asc"

Sort direction: asc or desc.

number

default:"1"

Page number.

number

default:"20"

Results per page.

curl "https://app.lowerplane.com/api/v1/external/assets?type=server&status=active&page=1&limit=20" \
  -H "Authorization: Bearer lp_your_api_key"

Get an Asset

GET /api/v1/external/assets/{id}

Returns full asset detail including owner, cloud metadata, and open vulnerabilities.

curl https://app.lowerplane.com/api/v1/external/assets/9f8e7d6c-asset-id \
  -H "Authorization: Bearer lp_your_api_key"

Create an Asset

POST /api/v1/external/assets

string

required

Display name of the asset.

string

required

Asset type (see Asset types).

string

Description of the asset.

string

Free-form subtype, e.g., an OS name (macOS, Ubuntu 22.04) or instance class.

string

Your system’s identifier for the asset (e.g., AWS ARN, serial number). Must be unique within your organization.

string

Link to the asset in an external system.

string

default:"active"

active, inactive, or archived.

string

default:"internal"

Data classification: public, internal, confidential, restricted.

string

default:"medium"

low, medium, high, or critical.

string

Deployment environment, e.g., production, staging.

string

Cloud region or physical region, e.g., us-east-1.

string

Physical location, if applicable.

boolean

default:"true"

Whether the asset is in scope for compliance.

string[]

Types of data the asset handles, e.g., ["pii", "financial"].

boolean

default:"false"

Whether the asset stores or processes sensitive data.

boolean

Whether the asset’s data is encrypted at rest.

string

Encryption mechanism, e.g., AES-256.

string[]

Free-form tags.

object

Arbitrary key-value metadata.

curl -X POST https://app.lowerplane.com/api/v1/external/assets \
  -H "Authorization: Bearer lp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "prod-db-01",
    "type": "database",
    "description": "Primary PostgreSQL production database",
    "external_id": "arn:aws:rds:us-east-1:123456789:db:prod-db-01",
    "environment": "production",
    "region": "us-east-1",
    "criticality": "critical",
    "classification": "confidential",
    "contains_sensitive_data": true,
    "is_encrypted": true,
    "encryption_type": "AES-256",
    "data_types": ["pii"],
    "tags": ["postgres", "rds"]
  }'

Returns 201 Created with the full asset record, including its id.

Update an Asset

PUT /api/v1/external/assets/{id}

Accepts the same body fields as create. Only the fields you include are updated; omitted fields are left unchanged.

curl -X PUT https://app.lowerplane.com/api/v1/external/assets/9f8e7d6c-asset-id \
  -H "Authorization: Bearer lp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "inactive",
    "criticality": "low"
  }'

Delete an Asset

DELETE /api/v1/external/assets/{id}

curl -X DELETE https://app.lowerplane.com/api/v1/external/assets/9f8e7d6c-asset-id \
  -H "Authorization: Bearer lp_your_api_key"

Deletion is permanent and also removes associated vulnerability links. To retire an asset while keeping its history, update its status to archived instead.

Asset Types

Type	Description
`workstation`	Laptops and desktops (aliases: `laptop`, `desktop`)
`server`	Physical or virtual servers
`mobile_device`	Phones and tablets (alias: `mobile`)
`network_device`	Routers, switches, firewalls (alias: `network`)
`database`	Databases
`application`	Applications and software (alias: `software`)
`cloud_account`	Cloud provider accounts
`cloud_resource`	Generic cloud resources
`container`	Containers
`api`	APIs
`data_store`	Storage systems (alias: `storage`)
`saas`	SaaS applications
`other`	Anything else

Cloud-specific types are also supported: s3_bucket, ec2_instance, rds_instance, iam_user, iam_role, azure_vm, azure_storage_account, azure_ad_user, gce_instance, gcs_bucket, digitalocean_droplet, digitalocean_volume.

Unrecognized types are stored as other.

Error Responses

Status	Error	Description
400	`name and type are required`	Missing required fields on create
400	`No fields to update`	Update request body contained no recognized fields
401	—	Authentication failure (see Authentication)
404	`Asset not found`	Asset ID doesn’t exist or belongs to another organization
409	—	An asset with the same `external_id` already exists in your organization

​Overview

​Endpoints

​List Assets

​Get an Asset

​Create an Asset

​Update an Asset

​Delete an Asset

​Asset Types

​Error Responses

Overview

Endpoints

List Assets

Get an Asset

Create an Asset

Update an Asset

Delete an Asset

Asset Types

Error Responses