# Balbix

> Balbix is a cyber risk and exposure management platform founded in 2015 in San Jose, California. The Balbix Security Cloud (Balbix D3) ingests telemetry from 70+ security and IT systems through pre-built connectors and sensors, unifies it into a single asset, application, vulnerability and software inventory model, and quantifies breach risk in dollar terms. Balbix was acquired by SAFE Security in November 2025; balbix.com now redirects to safe.security, and Balbix product documentation is published as the "Balbix Help" section of docs.safe.security. The platform continues to run on the balbix.net domain.

This file was generated by the API Evangelist enrichment pipeline on 2026-08-02 from Balbix's own published documentation. Balbix does not publish an llms.txt of its own; the successor company publishes https://safe.security/llms.txt and the documentation host publishes https://docs.safe.security/llms.txt, which carries the Balbix Help index.

## APIs

- [Balbix REST API v1](https://docs.safe.security/balbixhelp/docs/balbix-rest-api-guide-v20): Read-only REST API for programmatic access to Assets and their associated Vulnerabilities, Misconfigurations, Software Inventory, Applications and application Artifacts. Base URL is tenant-specific, of the form `https://{tenant}.balbix.net/apis/v1`.

### Authentication

- Exchange HTTP Basic credentials plus a Customer Key at `GET /apis/v1/gen_token?key={CUSTOMER_KEY}` for a session token. Tokens expire after 30 minutes.
- Every call carries two headers: `Authorization` (the raw session token, not an RFC 6750 `Bearer` value) and `Client-API-Key` (identifies the customer tenant).
- API credentials are issued per tenant by Balbix Engineering / Customer Success. Self-service credential creation is documented as planned, not available.
- The platform web application at app.balbix.net uses Okta OpenID Connect single sign-on (issuer `https://login.balbix.net/oauth2/aus9g844oA86yTqSo356`, authorization code flow with PKCE).

### Documented endpoints

Asset surface:

- `POST /apis/v1/bx-it/asset/asset_list` — resolve assets by any combination of `host_name`, `ip`, `mac`; returns `dev_id` (the Balbix Device ID).
- `GET /apis/v1/bx-it/asset/asset_details/{DEVICE_ID}` — all attributes for one asset; not paginated.
- `POST /apis/v1/bx-it/asset/vulns/{DEVICE_ID}` — vulnerabilities for an asset; paginates to 1000.
- `POST /apis/v1/bx-it/asset/misconfig_details/{DEVICE_ID}` — misconfigurations for an asset; paginates to 100.
- `POST /apis/v1/bx-it/asset/sw_details/{DEVICE_ID}` — software inventory including OS for an asset; paginates to 100.

Application surface:

- `POST /apis/v1/bx-it/application/app_list` — resolve applications by `application_name`, `application_id` or `app_url`; returns `app_id`.
- `GET /apis/v1/bx-it/application/app_details/{APP_ID}` — all attributes for one application; not paginated.
- `POST /apis/v1/bx-it/application/artifacts/{APP_ID}` — repositories, projects and deployments; paginates to 100.
- `POST /apis/v1/bx-it/application/vulns/{APP_ID}` — vulnerabilities for an application; paginates to 1000.
- `POST /apis/v1/bx-it/application/infra-assets/{APP_ID}` — infrastructure assets running an application; paginates to 100.

### Conventions and limits

- Read-only. Assets, UI state, uploads and tags cannot be modified via the API.
- Reads from a replica database, so results may lag the Balbix web UI.
- No hard-coded rate limits, but only 4 concurrent sessions per customer; further sessions queue.
- Not suitable for bulk data exports — use the in-product export instead.
- Offset pagination via `page_offset` / `page_limit` in the JSON request body; responses carry a `meta` block with `total_count`, `page_offset`, `page_limit`, `filters` and `sort`.
- Field naming is predominantly snake_case; the `sw_details` endpoint returns camelCase.
- No error catalogue, status-code table, request-id header or idempotency contract is published.

### Not published

Balbix publishes no OpenAPI or Swagger document, no GraphQL endpoint, no MCP server, no A2A agent card, no AsyncAPI or webhook surface, no client SDKs on any public package registry, no CLI, no public status page, and no `/.well-known/security.txt`. These were all probed on 2026-08-02 and are recorded as absent rather than assumed.

## Docs

- [Balbix Help (documentation home)](https://docs.safe.security/balbixhelp/docs/dashboard-overview)
- [Balbix REST API Guide](https://docs.safe.security/balbixhelp/docs/balbix-rest-api-guide-v20)
- [Implementing the CTEM Cycle with Balbix](https://docs.safe.security/balbixhelp/docs/implementing-the-ctem-cycle-with-balbix)
- [Balbix Cyber Risk Intelligence Framework](https://docs.safe.security/balbixhelp/docs/balbix-cyber-risk-intelligence-framework)
- [Exposure Management Concepts](https://docs.safe.security/balbixhelp/docs/exposure-management-3)
- [Unified Enterprise Asset Classification Model](https://docs.safe.security/balbixhelp/docs/asset-classification-taxonomy)
- [Data Lifecycle in Balbix](https://docs.safe.security/balbixhelp/docs/data-lifecycle-in-balbix)
- [Connectors](https://docs.safe.security/balbixhelp/docs/connectors)
- [Connector and Sensor Types](https://docs.safe.security/balbixhelp/docs/connector-and-sensor-types)
- [Configure Connectors](https://docs.safe.security/balbixhelp/docs/configure-connectors)
- [Exporting Data](https://docs.safe.security/balbixhelp/docs/exporting-data)
- [Access Control List Configuration](https://docs.safe.security/balbixhelp/docs/access-control-list-configuration)
- [Provisioning Users for SSO-Enabled Customers](https://docs.safe.security/balbixhelp/docs/provisioning-users-for-sso-enabled-customers)
- [Support](https://docs.safe.security/balbixhelp/docs/support)
- [Release Notes - June 2026](https://docs.safe.security/balbixhelp/docs/release-notes-june-2026)
- [Documentation index (llms.txt)](https://docs.safe.security/llms.txt)

## Security and compliance

- [SAFE Security security and compliance](https://safe.security/security/) — SOC 2 Type 2, SOC 3, ISO 27001:2013, ISO 9001:2015, TX-RAMP; responsible disclosure to security@safe.security
- [Balbix Data Security and Privacy](https://docs.safe.security/balbixhelp/docs/data-security-and-privacy-1)
- [Balbix Product Transparency Statement](https://docs.safe.security/balbixhelp/docs/product-transparency-statement)

## Artifacts

Machine-readable artifacts derived by API Evangelist and published in this repository:

- [apis.yml](https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/apis.yml) — APIs.json 0.20 index
- [authentication/balbix-authentication.yml](https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/authentication/balbix-authentication.yml)
- [scopes/balbix-scopes.yml](https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/scopes/balbix-scopes.yml)
- [conventions/balbix-conventions.yml](https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/conventions/balbix-conventions.yml)
- [rate-limits/balbix-rate-limits.yml](https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/rate-limits/balbix-rate-limits.yml)
- [data-model/balbix-data-model.yml](https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/data-model/balbix-data-model.yml)
- [lifecycle/balbix-lifecycle.yml](https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/lifecycle/balbix-lifecycle.yml)
- [changelog/balbix-changelog.yml](https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/changelog/balbix-changelog.yml)
- [conformance/balbix-conformance.yml](https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/conformance/balbix-conformance.yml)
- [well-known/balbix-well-known.yml](https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/well-known/balbix-well-known.yml)
- [security/balbix-domain-security.yml](https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/security/balbix-domain-security.yml)
- [security/balbix-vulnerability-disclosure.yml](https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/security/balbix-vulnerability-disclosure.yml)
- [security/balbix-trust-center.yml](https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/security/balbix-trust-center.yml)
- [integrations/_index.yml](https://raw.githubusercontent.com/api-evangelist/balbix/refs/heads/main/integrations/_index.yml) — 70 published connectors