> ## Documentation Index > Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt > Use this file to discover all available pages before exploring further. # Create an inventory asset. > Requires esi.inventory.manage or project manager access. Panel-created assets are manual and default to approved; discovered candidate assets are created by backend ingestion. ## OpenAPI ````yaml https://api.infrawatch.com/openapi.json?contract=d15375c post /projects/{project_uuid}/esi/inventory/assets openapi: 3.1.0 info: description: >- Customer-facing Infrawatch APIs. Authenticate with an API key unless an operation documents another supported credential. ### Infrawatch Public API Public API authenticated exclusively with Infrawatch API keys. ### Infrawatch Customer Alerting API Project alert rules, destinations, silences, inbox state, and delivery history. ### Infrawatch Remote Browser API Project-scoped interactive browser sessions owned by Platform Core. Session admission, lifecycle, RBAC, audit, usage, screenshot history, and stream tickets are Platform Core resources. The browser master is private infrastructure and its identifiers, proxy routes, process options, and credentials are never exposed by this API. A session and all of its evidence are private to the credential that created it. Project managers may list project session metadata, inspect one session's metadata, and terminate it, but cannot access its live stream, screenshots, or network events. Terminal session metadata and screenshots are retained indefinitely. A creator can replay a terminal session as a new queued resource while preserving a durable link to the source session. ### Infrawatch ESI API Customer-facing External Surface Intelligence API for project-scoped product data authenticated by an Infrawatch API key. API keys are constrained to their immutable owner's project ceiling and assigned ESI scopes; human project-manager fallback never expands an API key. Authorised API-key requests are rate-limited and consume monthly quota. ### Infrawatch Reports API Threat report discovery API authenticated by an Infrawatch API key. ### Infrawatch Public Rules API Account-aware rule authoring, taxonomy, catalogue, and runtime observations for API clients. ### Infrawatch Search API Search hosts, services, DNS records, and certificates. Complete percent-encoded query strings are limited to 65536 bytes. title: Infrawatch Customer API version: 1.0.0 servers: - description: Infrawatch customer API url: https://api.infrawatch.com/api/v1 security: [] tags: - name: API Usage - name: Projects - name: Alert destinations - name: Alert rules - name: Alert silences - name: Alerts - name: Browser sessions - name: Browser evidence - name: Browser streaming - name: Access - name: Inventory - name: Dangling DNS - name: Findings - name: Secrets - name: Typosquatting - name: Services - name: AI Surface - description: Search hosts, services, DNS records, certificates, and open directories. name: Search - name: Dashboard - name: Reports - name: Rules - name: Rule tags - name: Rule observations paths: /projects/{project_uuid}/esi/inventory/assets: servers: - url: https://api.infrawatch.com/api/v1 parameters: - $ref: '#/components/parameters/esi_v1_ProjectUUID' post: tags: - Inventory summary: Create an inventory asset. description: >- Requires esi.inventory.manage or project manager access. Panel-created assets are manual and default to approved; discovered candidate assets are created by backend ingestion. operationId: createInventoryAsset requestBody: content: application/json: schema: $ref: '#/components/schemas/esi_v1_InventoryAssetCreate' required: true responses: '201': content: application/json: schema: properties: asset: $ref: '#/components/schemas/esi_v1_InventoryAsset' required: - asset type: object description: Inventory asset created. '400': $ref: '#/components/responses/esi_v1_BadRequest' '401': $ref: '#/components/responses/esi_v1_Unauthorized' '403': $ref: '#/components/responses/esi_v1_Forbidden' '409': $ref: '#/components/responses/esi_v1_Conflict' security: - apiKeyAuth: [] components: parameters: esi_v1_ProjectUUID: in: path name: project_uuid required: true schema: format: uuid type: string schemas: esi_v1_InventoryAssetCreate: additionalProperties: false description: > Omit `asset_kind` for hostnames and IP values and the API infers `domain`, `subdomain`, `ip_address`, or `ip_block` from `value`. `brand_name` stores brand strings used for internet mention workflows. The API canonicalizes value, normalized_value, asset_type, and typed columns. properties: activity: maxLength: 256 type: string added_by_method: description: >- Alias of source_kind. `discovery` is accepted and stored as `auto_discovered`. enum: - manual - discovery - auto_discovered - import - api - integration type: string asn: description: >- Optional for ASN creates; when supplied, it must match the ASPLAIN `value`. format: int64 maximum: 4294967295 minimum: 1 type: integer asset_family: description: Defaults to asset_kind. type: string asset_kind: $ref: '#/components/schemas/esi_v1_InventoryAssetKind' description: >- Optional for hostnames and IPs. Required for brand_name, certificates, ASN, contact, and page assets. asset_type: type: string brand_main_website_url: description: >- Required for `brand_name` assets. Must be an HTTP or HTTPS URL whose canonical percent-encoded form also fits the 2048-character limit. format: uri maxLength: 2048 pattern: ^[hH][tT][tT][pP][sS]?://[^/@\s]+([/?#].*)?$ type: string certificate_issuer: type: string certificate_not_after: format: date-time type: string certificate_not_before: format: date-time type: string certificate_sha256: pattern: ^[0-9a-fA-F]{64}$ type: string certificate_subject: type: string cname_records: items: type: string type: array contact_email: description: >- Normalized to a lower-case mailbox address and rejected when syntactically invalid. format: email type: string contact_name: type: string contact_type: type: string discovery_channel: type: string discovery_provider: type: string display_name: type: string dns_a_records: items: type: string type: array dns_aaaa_records: items: type: string type: array dns_name: type: string domain_status: description: >- Domain/subdomain enrichment status. Invalid for non-domain inventory assets. maxLength: 128 type: string favicon_sha256: pattern: ^[0-9a-fA-F]{64}$ type: string final_url: format: uri maxLength: 2048 pattern: ^[hH][tT][tT][pP][sS]?://[^/@\s]+([/?#].*)?$ type: string first_seen_at: format: date-time type: string host: type: string ip: type: string ip_addresses: items: type: string type: array ip_block: type: string last_observed_at: format: date-time type: string last_seen_at: format: date-time type: string metadata: additionalProperties: true type: object name_servers: items: type: string type: array normalized_value: description: >- Defaults to the asset-kind canonical value, such as a lower-case hostname or upper-case ASPLAIN ASN (`AS13335`). type: string os_family: type: string owner_group_uuid: format: uuid type: string owner_membership_uuid: format: uuid type: string page_sha256: pattern: ^[0-9a-fA-F]{64}$ type: string parent_domain: type: string primary_source_name: type: string primary_source_ref: type: string provider: maxLength: 256 type: string registered_at: format: date-time type: string registrar: maxLength: 512 type: string root_domain: type: string screenshot_sha256: pattern: ^[0-9a-fA-F]{64}$ type: string source_kind: $ref: '#/components/schemas/esi_v1_InventorySourceKind' status: $ref: '#/components/schemas/esi_v1_InventoryAssetStatus' title: maxLength: 1024 type: string url: description: >- HTTP or HTTPS URL without embedded user credentials. For page assets, omit it to derive from `value`; when supplied it must match `value` and `host`. The canonical percent-encoded URL must also fit the 2048-character limit. format: uri maxLength: 2048 pattern: ^[hH][tT][tT][pP][sS]?://[^/@\s]+([/?#].*)?$ type: string value: description: >- For page assets this is an HTTP or HTTPS URL without embedded user credentials. ASN assets require canonicalizable ASPLAIN text such as `AS13335`. type: string required: - value type: object esi_v1_InventoryAsset: properties: activity: maxLength: 256 type: string added_by_method: description: >- Product-facing source method. source_kind=auto_discovered is returned as discovery. enum: - manual - discovery - import - api - integration type: string approved_at: format: date-time type: string approved_by_api_key_uuid: format: uuid type: string approved_by_membership_uuid: format: uuid type: string archived_at: format: date-time type: string asn: description: >- Unsigned 32-bit ASPLAIN number matching the canonical `value`, such as `AS13335`. format: int64 maximum: 4294967295 minimum: 1 type: integer asset_family: type: string asset_kind: $ref: '#/components/schemas/esi_v1_InventoryAssetKind' asset_type: type: string brand_favicon_count: minimum: 0 type: integer brand_linked_asset_count: minimum: 0 type: integer brand_main_website_url: description: Required for `brand_name` assets. Must be an HTTP or HTTPS URL. format: uri maxLength: 2048 pattern: ^https?://[^/@\s]+([/?#].*)?$ type: string brand_term_count: minimum: 0 type: integer certificate_issuer: type: string certificate_not_after: format: date-time type: string certificate_not_before: format: date-time type: string certificate_sha256: pattern: ^[0-9a-fA-F]{64}$ type: string certificate_subject: type: string cname_records: items: type: string type: array contact_email: description: >- Normalized to a lower-case mailbox address and rejected when syntactically invalid. format: email type: string contact_name: type: string contact_type: type: string created_at: format: date-time type: string created_by_api_key_uuid: format: uuid type: string created_by_membership_uuid: format: uuid type: string discovery_channel: type: string discovery_provider: type: string display_name: type: string dns_a_records: items: type: string type: array dns_aaaa_records: items: type: string type: array dns_name: type: string domain_status: description: >- Detector or enrichment status for domain and subdomain inventory only. maxLength: 128 type: string favicon_sha256: pattern: ^[0-9a-fA-F]{64}$ type: string final_url: format: uri maxLength: 2048 pattern: ^https?://[^/@\s]+([/?#].*)?$ type: string first_seen_at: format: date-time type: string host: type: string ip: type: string ip_addresses: items: type: string type: array ip_block: type: string last_observed_at: format: date-time type: string last_seen_at: format: date-time type: string metadata: additionalProperties: true type: object name_servers: items: type: string type: array normalized_value: type: string os_family: type: string owner_group_uuid: format: uuid type: string owner_membership_uuid: format: uuid type: string page_sha256: pattern: ^[0-9a-fA-F]{64}$ type: string parent_domain: type: string primary_source_name: type: string primary_source_ref: type: string provider: maxLength: 256 type: string registered_at: format: date-time type: string registrar: maxLength: 512 type: string removed_at: format: date-time type: string removed_by_api_key_uuid: format: uuid type: string removed_by_membership_uuid: format: uuid type: string root_domain: type: string screenshot_sha256: pattern: ^[0-9a-fA-F]{64}$ type: string source_kind: $ref: '#/components/schemas/esi_v1_InventorySourceKind' description: >- Optional for panel-created assets; if supplied, must be manual. Backend ingestion owns discovered/imported/API source kinds. status: $ref: '#/components/schemas/esi_v1_InventoryAssetStatus' title: maxLength: 1024 type: string updated_at: format: date-time type: string url: description: >- HTTP or HTTPS URL without embedded user credentials. Required for page assets and matches `value` and `host`. format: uri maxLength: 2048 pattern: ^https?://[^/@\s]+([/?#].*)?$ type: string uuid: format: uuid type: string value: type: string required: - uuid - asset_kind - asset_family - value - normalized_value - status - source_kind - added_by_method - first_seen_at - last_seen_at - metadata - created_at - updated_at type: object esi_v1_InventoryAssetKind: enum: - domain - subdomain - page - ssl_certificate - asn - ip_block - ip_address - contact - brand_name type: string esi_v1_InventorySourceKind: enum: - manual - auto_discovered - import - api - integration type: string esi_v1_InventoryAssetStatus: enum: - candidate - approved - monitored - ignored - removed - archived type: string esi_v1_ErrorResponse: properties: error: properties: code: type: string field_errors: items: properties: code: type: string field: type: string message: type: string required: - field - code - message type: object type: array message: type: string request_id: type: string required: - code - message type: object required: - error type: object responses: esi_v1_BadRequest: content: application/json: schema: $ref: '#/components/schemas/esi_v1_ErrorResponse' description: Invalid request. esi_v1_Unauthorized: content: application/json: schema: $ref: '#/components/schemas/esi_v1_ErrorResponse' description: Authentication required. esi_v1_Forbidden: content: application/json: schema: $ref: '#/components/schemas/esi_v1_ErrorResponse' description: Required scope or project access missing. esi_v1_Conflict: content: application/json: schema: $ref: '#/components/schemas/esi_v1_ErrorResponse' description: Resource already exists. securitySchemes: apiKeyAuth: description: >- Infrawatch API key. Supply the complete key directly as the header value. in: header name: X-API-Key type: apiKey ````