Developer Portal

The Developer Portal is the reference for configuring and extending Asenion, the AI governance platform. It is written for engineers and administrators who set up the platform’s behaviour, author the policies and rules that drive it, or connect it to systems of their own.

Most of what lives here belongs to the Authoring and Assessment stages — defining the controls a system is governed by, and how answers to those controls roll up into status. See the Overview for how those stages fit with Testing and Runtime Governance.

What is in this section

Configuring the platform

  • System Configuration — the settings that decide how per-control answers roll up into assessment and project status, and which components appear on the project dashboard. Start here if a status is not reading the way you expect.

Authoring content

  • Policy Configuration — the structure of a policy: control bundles, controls, answer options, and the compliance identifiers that make a control count towards status.
  • Audit Packages — grouping policies into a named framework, so a whole framework can be applied to a project in one step.
  • Rules Configuration — screening rules that classify a project at creation and attach the policies that apply to it.
  • User Journey — conditional flow within a control bundle, so a respondent only sees the questions their earlier answers call for.
  • Lifecycle Configuration — the stages a project moves through, and the gating rules that decide when it can advance.
  • Reports Guide — assessment reports, and the Handlebars templates behind project-level reports.

Integrating

  • Archer Integration — a worked example of driving the GraphQL API from an external system.

Authentication

There are two directions to authenticate, and they are not the same. Which one applies depends on whether your code is calling Asenion or Asenion is calling your code.

Calling the Asenion API

Requests go to your deployment’s GraphQL endpoint over HTTPS:

https://<your-asenion-host>/graphql

Authenticate with a bearer token:

Authorization: Bearer <your-token>

A token is obtained either from the Access Tokens tab in your personal settings, or through a one-time GraphQL call after signing in. Note that the one-time call is made as a signed-in user and needs a CSRF token; once you hold a bearer token, requests using it do not.

Two things to plan for:

  • The token is shown once. Only a hash of it is stored, so it cannot be retrieved later — copy it when it is generated and keep it as you would any other secret.
  • Tokens expire. The default lifetime is 90 days and a deployment can shorten it, so a long-running integration needs a rotation plan rather than a token set up once and forgotten. The expiry date is returned when the token is created.

The Archer Integration page walks through both routes and using the token end to end. The same approach applies to any external client.

Endpoints that Asenion calls

When Asenion tests a system of yours, the direction reverses: you expose an endpoint and Asenion calls it. Asenion sends credentials on every request, and your endpoint validates them. Support one or both of:

Authorization: Bearer <your-token>
X-API-Key: <your-api-key>

Reject a missing or invalid credential with 401 Unauthorized and a JSON error body. For a local or internal target you may allow unauthenticated access; require authentication in production.

The full contract — request and response shapes, session handling, and error formats — is in the endpoints reference. Implement against that page rather than this summary.

Never put a real credential in an example, including in configuration you send to us. Use obvious placeholders such as YOUR_TOKEN and YOUR_API_KEY.

Getting access

Configuration content — policies, rules, lifecycles and report templates — is normally reviewed before it is activated on a deployment. Each page in this section describes what to prepare and who can apply it, since some changes are self-service for administrators and others are handled by the Asenion team.

For API credentials or access to a deployment, contact your Asenion representative or support@asenion.ai.

Table of contents