# Phosphorus > Phosphorus Cybersecurity is a cyber-physical systems (CPS) security company in Nashville, Tennessee, > founded in 2017 and acquired by Dragos on 1 June 2026. Its agentless xIoT platform discovers, > assesses, hardens and remediates IoT, OT, IIoT and IoMT devices — rotating credentials, updating > firmware, managing certificates and assessing vulnerabilities across enterprise and critical > infrastructure networks. This file was GENERATED by API Evangelist from the company's published > OpenAPI contract and public website; Phosphorus does not serve an llms.txt of its own > (https://phosphorus.io/llms.txt returns 404). ## What you can call The Phosphorus API is a REST API with two live versions served side by side from one contract. It is deployed per tenant, so the base URL is the customer's own Phosphorus instance — `https://{tenant}.phosphorus.io`. Every operation authenticates with an `X-API-KEY` request header. There are 30 operations across 24 paths. - v2 — read the fleet: a device by uuid and its alerts, certificates, credentials, data provenance, firmware, logs and scans; tenant-wide alerts over a time range; a site by id; and a cross-device search endpoint that takes the Phosphorus Search Query Syntax in a `q` parameter. - v3 — operate the platform: create, read, update, delete, enable, disable and submit data for dynamic scan configurations; list integration providers, read one, run a health check on one or on all of them, and list the credentials a provider can assign; list excluded devices; and create, list, read and update secrets in the Phosphorus Vault. ## What you should know before calling it - No idempotency. There is no `Idempotency-Key` header on any of the 11 write operations, so a retried `createDynamicScanConfigv3` or `createSecretv3` after a timeout creates a duplicate. - No documented rate limits. The contract declares no 429, no `Retry-After` and no `RateLimit-*` headers, so there is no runtime backoff signal to read. - No error detail. Every operation declares only 200 and 400 "Invalid input", and the 400 carries no response body schema, so failures are not machine-diagnosable from the contract. - Limited reversibility. Enable/disable is a true toggle and create/delete undoes a scan config, but `updateSecretv3` writes a new version of a Vault secret with no published operation to read or restore the previous one, and `createSecretv3` has no delete counterpart. No reversal window is stated anywhere. - Writes touch production security infrastructure — the credential vault, scan configuration and provider registration on a live OT/IoT estate. Treat every v3 write as consequential. ## APIs - [Phosphorus API](https://phosphorus.io/platform/): REST API for xIoT device discovery, assessment, firmware, certificates, credentials, sites, dynamic scans, integration providers and the Vault. ## Specs - [OpenAPI 3.0.0 (YAML)](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/openapi/phosphorus-api-openapi.yml) - [OpenAPI 3.0.0 (verbatim original JSON)](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/openapi/_original/phosphorus-openapi.json) - [OpenAPI Overlay of API Evangelist enhancements](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/overlays/phosphorus-api-overlay.yaml) ## Derived artifacts - [Authentication](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/authentication/phosphorus-authentication.yml) - [Conventions and reversibility](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/conventions/phosphorus-conventions.yml) - [Error catalog](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/errors/phosphorus-problem-types.yml) - [Data model](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/data-model/phosphorus-data-model.yml) - [Rate limits](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/rate-limits/phosphorus-rate-limits.yml) - [Lifecycle](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/lifecycle/phosphorus-lifecycle.yml) - [Conformance](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/conformance/phosphorus-conformance.yml) - [Packages](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/packages/phosphorus-packages.yml) - [Plans and pricing](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/plans/phosphorus-plans-pricing.yml) - [Domain security](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/security/phosphorus-domain-security.yml) - [Vulnerability disclosure](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/security/phosphorus-vulnerability-disclosure.yml) - [Well-known probe](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/well-known/phosphorus-well-known.yml) - [MCP candidate tool set](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/mcp/phosphorus-mcp.yml) - [Agent skills](https://raw.githubusercontent.com/api-evangelist/phosphorus/refs/heads/main/skills/_index.yml) ## Docs - [Platform](https://phosphorus.io/platform/) - [Integrations](https://phosphorus.io/integrations/) — Check Point, Microsoft Sentinel, ServiceNow, CyberArk, Axonius; alliance partners Qualys, Forescout, Sevco - [Support](https://phosphorus.io/support/) — the API reference itself is behind the customer portal at https://support.phosphorus.io/ (Atlassian Service Desk login) - [Blog](https://phosphorus.io/resource-center/blog/) - [Terms of service](https://phosphorus.io/terms-of-service/) - [Privacy policy](https://phosphorus.io/privacy-policy/) - [Security contact](https://github.com/phosphorusinc/public) — security@phosphorus.io, PGP key published ## Not available - No developer portal, no public API reference, no getting-started guide. - No SDK in any package registry, and no first-party CLI. - No MCP server, no A2A agent card, no llms.txt of the provider's own. - No sandbox, no test credentials, no Postman collection. - No public pricing — https://phosphorus.io/pricing/ does not exist and serves the homepage. - No status page, no changelog, no deprecation policy, no SLA. - No AsyncAPI and no documented webhook or event surface.