Start a conversation Sign in
Start a conversation
  1. CloudFix Support
  2. CloudFix - API Guide
  3. Articles

CloudFix API - Endpoint Summary

Base URL: https://app.cloudfix.com/api/v3


This summary focuses on typical workflows: retrieving and grouping recommendations, acting on them, and reporting.

Authentication

  • Most endpoints require an Authorization header.

  • API tokens start with cft_. Supported formats for an API token:

    • Authorization: api-token cft_<token>

    • Authorization: Bearer cft_<token>

    • Authorization: cft_<token>

  • Sign-in tokens come from POST /api/v3/auth/login. Send the accessToken prefixed with the tokenProvider from the same response, for example Authorization: cognito <accessToken>. Don't send a sign-in token with Bearer: every Bearer value is treated as an API token, so a sign-in token sent that way is refused with 403.

  • API tokens can be created in the CloudFix UI (Settings > API Tokens) or via POST /api/v3/tokens.

  • Which token each endpoint below needs:

    • API token with the Reader role or higher: list recommendations, summary, summary filters, recommendation report and share link.

    • API token with the ResourceManager role or higher: postpone, manual fix and create change requests.

    • Tenant Admin sign-in token: execution schedule, the savings, realized savings, savings history and cost ranking reports, webhooks, email integrations, and creating API tokens.

  • The examples below use api-token <token> where an API token works and cognito <accessToken> where a Tenant Admin sign-in token is required. See the CloudFix API - Customer Guide for details.


Public endpoints (no auth required):


  • POST /api/v3/auth/login

curl -s -X POST "https://app.cloudfix.com/api/v3/auth/login" \  -H "Content-Type: application/json" \  -d '{"username":"user@example.com","password":"YOUR_PASSWORD"}'


  • POST /api/v3/auth/refresh

curl -s -X POST "https://app.cloudfix.com/api/v3/auth/refresh" \  -H "Content-Type: application/json" \  -d '{"username":"user@example.com","refreshToken":"<refresh_token>"}'


  • GET /api/v3/reports/view/{hash}

curl -s "https://app.cloudfix.com/api/v3/reports/view/<hash>"


Recommendations (find, group, act)

  • GET /api/v3/recommendations - list recommendations, examples

curl -s "https://app.cloudfix.com/api/v3/recommendations?pageNumber=1&pageLimit=10" \  -H "Authorization: api-token <token>"
 curl -s "https://app.cloudfix.com/api/v3/recommendations?finderFixerId=EbsDeleteOldVolumeSnapshots&pageNumber=1&pageLimit=10" \  -H "Authorization: api-token <token>"
 curl -s "https://app.cloudfix.com/api/v3/recommendations?finderFixerId=EbsDeleteOldVolumeSnapshots&account=123456789012&pageNumber=1&pageLimit=10" \    -H "Authorization: api-token <token>"   
curl -s "https://app.cloudfix.com/api/v3/recommendations/summary?account=123456789012" \  -H "Authorization: api-token <token>"

  • GET /api/v3/recommendations/summary - grouped summary by type

curl -s "https://app.cloudfix.com/api/v3/recommendations/summary" \  -H "Authorization: api-token <token>"


  • GET /api/v3/recommendations/summary-filters - valid OU/account/region/tag filters

curl -s "https://app.cloudfix.com/api/v3/recommendations/summary-filters" \  -H "Authorization: api-token <token>"


  • POST /api/v3/recommendations/postpone - snooze recommendations

curl -s -X POST "https://app.cloudfix.com/api/v3/recommendations/postpone" \  -H "Authorization: api-token <token>" \  -H "Content-Type: application/json" \  -d '{"recommendationIds":["rec-123"],"postponeUntil":1735689600000,"reason":"Quarterly review"}'


  • POST /api/v3/recommendations/manual-fix - mark recommendations manually fixed

curl -s -X POST "https://app.cloudfix.com/api/v3/recommendations/manual-fix" \  -H "Authorization: api-token <token>" \  -H "Content-Type: application/json" \  -d '{"recommendationIds":["rec-123"]}'

Execute or schedule changes

  • POST /api/v3/create-change-requests - execute fixers for recommendation IDs (starts an SSM Automation execution per recommendation; the endpoint name predates the move off AWS Change Manager, and it no longer creates a change-template request of any kind)

curl -s -X POST "https://app.cloudfix.com/api/v3/create-change-requests" \  -H "Authorization: api-token <token>" \  -H "Content-Type: application/json" \  -d '{"recommendationIds":["rec-123"]}'

Omit executeOnSchedule or send it as false. Every CloudFix tenant now runs fixers through Direct SSM Automation, and this endpoint rejects executeOnSchedule:true with 422 "Using Experimental feature, cannot execute on schedule." Recommendations execute immediately once submitted; there is no per-request scheduling.


  • GET /api/v3/fixers/execution-schedule - view the tenant's maintenance-window cron value

curl -s "https://app.cloudfix.com/api/v3/fixers/execution-schedule" \  -H "Authorization: cognito <accessToken>"


  • POST /api/v3/fixers/execution-schedule - set the tenant's maintenance-window cron value

curl -s -X POST "https://app.cloudfix.com/api/v3/fixers/execution-schedule" \  -H "Authorization: cognito <accessToken>" \  -H "Content-Type: application/json" \  -d '{"fixerExecutionSchedule":"cron(0 2 * * ? *)"}'

This value is stored on the tenant and returned by the GET above, but it is not applied to Direct SSM Automation executions today: fixer executions still run immediately once triggered, regardless of what is configured here. The delayed-start "maintenance window" behavior these endpoints once fed was part of AWS Change Manager and is not active for any tenant now.

Reports and savings

  • GET /api/v3/recommendations/report - fetch a recommendation report by ID

curl -s "https://app.cloudfix.com/api/v3/recommendations/report?recommendationId=rec-123" \  -H "Authorization: api-token <token>"


  • POST /api/v3/recommendations/share - create a shareable report link

curl -s -X POST "https://app.cloudfix.com/api/v3/recommendations/share" \  -H "Authorization: api-token <token>" \  -H "Content-Type: application/json" \  -d '{"recommendationId":"rec-123"}'

The response includes a hash and shareUrl. Fetch the shared report with the public endpoint above: GET /api/v3/reports/view/{hash}.


  • GET /api/v3/report/savings - tenant savings report

curl -s "https://app.cloudfix.com/api/v3/report/savings" \  -H "Authorization: cognito <accessToken>"


  • GET /api/v3/report/realized-savings - realized savings report

curl -s "https://app.cloudfix.com/api/v3/report/realized-savings" \  -H "Authorization: cognito <accessToken>"


  • GET /api/v3/savings/history - savings history

curl -s "https://app.cloudfix.com/api/v3/savings/history" \  -H "Authorization: cognito <accessToken>"


  • POST /api/v3/report/cost-ranking - cost ranking

curl -s -X POST "https://app.cloudfix.com/api/v3/report/cost-ranking" \  -H "Authorization: cognito <accessToken>" \  -H "Content-Type: application/json" \  -d '{"minimumPublicAnnualCostFraction":0.01}'

The body is optional; minimumPublicAnnualCostFraction is the only accepted field and falls back to a default when omitted. This endpoint does not take a date range.

Integrations

  • GET /api/v3/events/webhook - list webhooks

curl -s "https://app.cloudfix.com/api/v3/events/webhook" \  -H "Authorization: cognito <accessToken>"


  • POST /api/v3/events/webhook - create/update webhook

curl -s -X POST "https://app.cloudfix.com/api/v3/events/webhook" \  -H "Authorization: cognito <accessToken>" \  -H "Content-Type: application/json" \  -d '{"name":"order-updates","url":"https://example.com/webhook","secret":"supersecretkey","active":true}'


  • DELETE /api/v3/events/webhook - delete webhook

curl -s -X DELETE "https://app.cloudfix.com/api/v3/events/webhook?name=order-updates" \  -H "Authorization: cognito <accessToken>"


  • POST /api/v3/events/webhook/update-external-id - update external id

curl -s -X POST "https://app.cloudfix.com/api/v3/events/webhook/update-external-id" \  -H "Content-Type: application/json" \  -d '{"externalId":"EXT-123","recommendationId":"rec-123"}'


  • GET /api/v3/integrations/email - list email integrations

curl -s "https://app.cloudfix.com/api/v3/integrations/email" \  -H "Authorization: cognito <accessToken>"


  • POST /api/v3/integrations/email - create email integration

curl -s -X POST "https://app.cloudfix.com/api/v3/integrations/email" \  -H "Authorization: cognito <accessToken>" \  -H "Content-Type: application/json" \  -d '{"email":"alerts@example.com","categories":["category1","category2"]}'


  • PUT /api/v3/integrations/email/{emailIntegrationId} - update email integration

curl -s -X PUT "https://app.cloudfix.com/api/v3/integrations/email/123" \  -H "Authorization: cognito <accessToken>" \  -H "Content-Type: application/json" \  -d '{"email":"alerts@example.com","categories":["category1","category2"]}'


  • DELETE /api/v3/integrations/email/{emailIntegrationId} - delete email integration

curl -s -X DELETE "https://app.cloudfix.com/api/v3/integrations/email/123" \  -H "Authorization: cognito <accessToken>"


  • POST /api/v3/integrations/email/sync - sync email integrations

curl -s -X POST "https://app.cloudfix.com/api/v3/integrations/email/sync" \  -H "Authorization: cognito <accessToken>"

Not in scope for the API

  • UI rendering and export features (charts, PDF exports, report layout)

  • Viewer-only presentation behavior for shared reports

  • One-click UI execution controls beyond the change-request and scheduling endpoints

  • Client-side analytics and telemetry

Persistence Notes

  • Configuration, recommendations, and reports are stored server-side in CloudFix services.

  • Token lifecycle and revocation are handled by the backend.

  • Exact data retention is plan- and policy-dependent; contact CloudFix Support for retention details.



Choose files or drag and drop files
Was this article helpful?
Yes
No

  1. Bill Gleeson

  2. Posted
  3. Updated

Comments