Run this sequence of REST calls to create an asset.

Run this sequence of REST calls to create an asset.


:::info
Use this document with our [Cobalt API documentation](https://cobalt-public-api.netlify.app/v2/) to define your assets on the Cobalt platform.

:::

To use our API, you need a Cobalt account with membership in your organization. Your organization owner can create an account and [assign you as a member](https://docs.cobalt.io/en-us/articles/manage-users-e390HqcTEl#h-invite-users). Your organization owner is typically the user who interacts with the Cobalt Customer Success Manager (CSM).

You can create an [asset](https://docs.cobalt.io/en-us/articles/glossary-YfTMKeZ1VM#h-asset) in the UI. If you prefer to automate the process and/or work from the command line, you can also use our API.

To create or modify an asset with our API, follow the sequence of commands shown on this page.

## **What You Need**

* [Personal API token](https://docs.cobalt.io/en-us/articles/create-a-personal-cobalt-api-token-LT9Nl8EAVR): `YOUR-PERSONAL-API-TOKEN`
* [Organization token](https://docs.cobalt.io/en-us/articles/get-an-organization-token-RlqtesM1QN): `YOUR-V2-ORGANIZATION-TOKEN`

## **Create an Asset**

You can create an [asset](https://docs.cobalt.io/en-us/articles/glossary-YfTMKeZ1VM#h-asset) with the following REST call:

```javascript
curl -X POST "https://api.cobalt.io/assets" \
  -H 'Accept: application/vnd.cobalt.v2+json' \
  -H 'Authorization: Bearer YOUR-PERSONAL-API-TOKEN' \
  -H 'Content-Type: application/vnd.cobalt.v2+json' \
  -H 'Idempotency-Key: A-UNIQUE-IDENTIFIER-TO-PREVENT-UNINTENTIONAL-DUPLICATION' \
  -H 'X-Org-Token: YOUR-V2-ORGANIZATION-TOKEN' \
  --data '{
            "title": "Test Asset",
            "description": "How to describe the asset to our pentesters",
            "asset_type": "web"
          }' \
  -v
```

For more information on each parameter, see our API reference documentation on how to [Create an Asset](https://docs.cobalt.io/en-us/articles/assets-RUpwTwSQmx#h-create-an-asset).

The command we use includes a -v, which sets up output in verbose mode. The command works without it. However, you would see no response from this REST call.

When you review the output of the REST call with the -v, look for the line with HTTP/2. If the command is successful, you’ll see

| **Message** | **Meaning** |
|----|----|
| HTTP/2 201 | Asset created |

For a list of error codes, see the [Errors](https://docs.cobalt.io/en-us/articles/errors-E2Fq8ITsB6) section of our API reference.

### **Next Steps**

Once you create an asset, you can:

* Continue with our API. You can [Find Your Asset ID](https://docs.cobalt.io/en-us/articles/create-or-modify-an-asset-mkveRKVD19#h-find-your-asset-id) and then [Add or Modify Asset Details](https://docs.cobalt.io/en-us/articles/create-or-modify-an-asset-mkveRKVD19#h-add-or-modify-asset-details).
* Sign in to our UI and modify details of your newly created asset.

## **Find Your Asset ID**

To add or modify information related to your asset, you’ll need the asset ID. You can find this ID with the REST call to [Get All Assets](https://docs.cobalt.io/en-us/articles/assets-RUpwTwSQmx#h-get-all-assets):

```javascript
curl -X GET "https://api.cobalt.io/assets" \
  -H "Accept: application/vnd.cobalt.v2+json" \
  -H "Authorization: Bearer YOUR-PERSONAL-API-TOKEN" \
  -H "X-Org-Token: YOUR-V2-ORGANIZATION-TOKEN" \
  | jq .
```

If you’ve set up more than one asset, you may need to search through the output. You can also limit the number of assets in the output with the limit parameter. For more information about each asset response field, see our API reference to [Get All Assets](https://docs.cobalt.io/en-us/articles/assets-RUpwTwSQmx#h-get-all-assets).


:::info
**Tip**

**You can use** `jq `**to filter assets by their** `title`**and** `id`**. To do so, end the REST call with**`| jq -r ".data[] | .resource | .title, .id"`

:::

## Review sample output.

```javascript
{
  "data": {
    "resource": {
      "id": "YOUR-ASSET-IDENTIFIER",
      "title": "Test Asset",
      "description": "How to describe the asset to our pentesters",
      "asset_type": "web",
      "logo": null,
      "attachments": []
    },
    "links": {
      "ui": {
        "url": "https://api.cobalt.io/links/<endpoint for the asset>"
      }
    }
  }
}
```

If you’ve set up more than one asset, you’ll see the id in the same object as the title, which you may have used to [create the asset](https://docs.cobalt.io/en-us/articles/assets-RUpwTwSQmx#h-create-an-asset).

Save the value of the asset id as YOUR-ASSET-IDENTIFIER. You’ll use that ID, which starts with as_, when updating or uploading information to your asset.

## **Add or Modify Asset Details**

Now that you’ve created an asset and have the asset ID, you can add more information with the following REST call:

```javascript
curl -X PUT 'https://api.cobalt.io/assets/YOUR-ASSET-IDENTIFIER' \
  -H 'Accept: application/vnd.cobalt.v2+json' \
  -H 'Authorization: Bearer YOUR-PERSONAL-API-TOKEN' \
  -H 'Content-Type: application/vnd.cobalt.v2+json' \
  -H 'X-Org-Token: YOUR-V2-ORGANIZATION-TOKEN' \
  --data '{
            "title": "Updated title",
            "description": "Updated description",
            "asset_type": "web"
          }' \
  -v
```

When you review the output of the REST call with the -v, look for the line with HTTP/2. If the command is successful, you’ll see:

| **Message** | **Meaning** |
|----|----|
| HTTP/2 204 | Asset updated |

For a list of error codes, see the [Errors](https://docs.cobalt.io/en-us/articles/errors-E2Fq8ITsB6) section of our API reference.

Create or Modify an Asset

Cobalt API Overview

Create a Personal Cobalt API Token

Get an Organization Token

Revoke Your Personal Cobalt API Tokens

Import Findings to Google Sheets

Cobalt API

How to get started with Cobalt

Getting Started

Risk Advisories

Assets are what we pentest

Asset Types

Create an Asset

Assets

Pentests

Overview

Asset Details

Pentest Details

Scope & Test Period

Preparation

Create a Pentest

Pentest Process

Pentest States

Coverage Checklist

Pentest Expectations

Set Up an In-House Pentest

Complete an In-House Pentest (For Pentesters)

In House Pentests

Finding States

Severity Levels

Remediate Findings

Findings

Customize Your Report

Co-branded Reports

Contents of a Pentest Report

Reports

Engagements Overview

Digital Risk Assessment

Secure Code Review

Engagements

Insights

Planning

Cobalt Methodologies Overview

Web Methodologies

API Methodologies

External Network Methodologies

Internal Network Methodologies

Mobile Methodologies

Cloud Configuration Review Methodologies

Cloud Pentest Methodology

Desktop Methodologies

AI/LLM Methodologies

Digital Risk Assessment Methodology

Secure Code Review Methodologies

Methodologies

Attack Surface Monitoring (ASM)

Attack Surface

DAST Scanner Overview

Best Practices

Integrations

Partial Scans: Reduced Scope

Scans

Sequence recorder

Targets

Target Authentication

Extra Hosts

Blackout Period

DAST Scanner

Account Overview

Account Settings

Password Best Practices

Sign In to Cobalt

Troubleshoot Sign-in Issues

User Account

Collaboration Overview

Collaborate on Pentests

Groups

Manage Pentest Collaborators

Manage Notifications

User Roles and Permissions

Collaboration

Organization Overview

Manage Users

Your Cobalt Contract

Configure SAML SSO

How to Configure SAML 2.0 for Cobalt 

SAML Migration: Update Your Configuration

SCIM Provisioning Setup Guide

Configure Organization Settings

Organization

Track Your Credits

Cobalt Credits

Cobalt PtaaS Tiers

Credits

Cobalt Integrations Overview

Troubleshooting

Create Jira tickets for Findings

Send email notifications for Findings from Outlook

Create GitLab tickets for Findings

Create GitHub tickets for Findings

HTTP Connector

Import Assets from Google Sheets

Map Cobalt Pentest Finding Severity to Jira Issue Priority

Modify Jira Issue Summary to contain Pentest Title

Create Azure DevOps Work Item for Findings

Send MS Teams notifications for Findings

How to Guides

Connect your applications

Integration Builder

Synchronize Cobalt Severity Levels with Jira

Push Cobalt Findings to Jira

Jira Cloud Integration

Jira Data Center Integration

Troubleshoot Your Jira Integration

Switching to a New Jira Instance

Integrate Jira with Cobalt

Slack

Microsoft Teams

Webhooks

DefectDojo

Kenna Security

Vanta

Carried Over Findings

Create Test Finding

Glossary

March 2026

February 2026

January 2026

November 2025 

August 2025

July 2025

June 2025

May 2025

April 2025

March 2025

January 2025

December 2024

November 2024

October 2024

September 2024

August 2024

July 2024

June 2024

May 2024

April 2024

March 2024

January 2024

What's New

Guide

Cobalt Product Documentation

Create or Modify an Asset

Share

Share

Create or Modify an Asset

Share

Share