CloudFix API - Workflows and Examples

Base URL: https://app.cloudfix.com/api/v3

Conventions

• Use HTTPS only.

• Send Authorization headers for all protected endpoints.

• Replace placeholders such as <token>, <accessToken> and <recommendationId> with real values.

Auth method options

You can authenticate with a sign-in token or with an API token.

• Sign-in token: POST /api/v3/auth/login returns an accessToken and a tokenProvider. Send the access token prefixed with the token provider, for example Authorization: cognito <accessToken>.

• API token: created under Settings > API Tokens (or with POST /api/v3/tokens); it starts with cft_. Send it as Authorization: api-token <token>.

Don't send a sign-in token with Bearer: every Bearer value is treated as an API token, so a sign-in token sent that way is refused with 403. API tokens are limited to the Reader, ResourceManager and RunbookManager roles; managing users and API tokens needs a Tenant Admin sign-in token.

Workflow: Login and call a protected endpoint

1. Login to get a token

curl -s -X POST "https://app.cloudfix.com/api/v3/auth/login" \  -H "Content-Type: application/json" \  -d '{"username":"user@example.com","password":"YOUR_PASSWORD"}'

1. Call a protected endpoint with the accessToken from the login response, prefixed with its tokenProvider (cognito for a username and password sign-in)

curl -s "https://app.cloudfix.com/api/v3/recommendations?pageNumber=1&pageLimit=10" \  -H "Authorization: cognito <accessToken>"

Workflow: Refresh an access token

curl -s -X POST "https://app.cloudfix.com/api/v3/auth/refresh" \  -H "Content-Type: application/json" \  -d '{"username":"user@example.com","refreshToken":"<refresh_token>"}'

Workflow: Create and use an API token

1. Create token (requires a Tenant Admin sign-in token)

curl -s -X POST "https://app.cloudfix.com/api/v3/tokens" \  -H "Authorization: cognito <accessToken>" \  -H "Content-Type: application/json" \  -d '{"name":"automation-token","role":"Reader"}'

1. Use token

curl -s "https://app.cloudfix.com/api/v3/recommendations?pageNumber=1&pageLimit=10" \  -H "Authorization: api-token <token>"

Workflow: Retrieve recommendations and summary

curl -s "https://app.cloudfix.com/api/v3/recommendations/summary" \  -H "Authorization: api-token <token>"

curl -s "https://app.cloudfix.com/api/v3/recommendations/summary-filters" \  -H "Authorization: api-token <token>"

How to use summary-filters

curl -s "https://app.cloudfix.com/api/v3/recommendations/summary?ou=OU-1&account=123456789012&region=us-east-1" \  -H "Authorization: api-token <token>"

Workflow: Get a recommendation report

curl -s "https://app.cloudfix.com/api/v3/recommendations/report?recommendationId=<recommendationId>" \  -H "Authorization: api-token <token>"

From summary to a single recommendation ID

The summary is an aggregate list and does not include recommendation IDs. To get IDs:

1. Use /recommendations with filters, including finderFixerId (often the same value as subCategoryTypeName from the summary).

2. Optionally scope to an account using account=<accountId> (ou=, region=, tagKey=, and tagValue= are also supported).

3. Read the id field from the results list and use it for actions like report retrieval.

Example:

curl -s "https://app.cloudfix.com/api/v3/recommendations?finderFixerId=Ec2Retype&pageNumber=1&pageLimit=10" \  -H "Authorization: api-token <token>"

Example using your summary row:

curl -s "https://app.cloudfix.com/api/v3/recommendations?finderFixerId=EbsDeleteOldVolumeSnapshots&account=123456789012&pageNumber=1&pageLimit=10" \  -H "Authorization: api-token <token>"

Workflow: Admin - manage users

Managing users requires a Tenant Admin sign-in token; API tokens can't call these endpoints.

curl -s "https://app.cloudfix.com/api/v3/users" \  -H "Authorization: cognito <accessToken>" 

curl -s -X POST "https://app.cloudfix.com/api/v3/users" \  -H "Authorization: cognito <accessToken>" \  -H "Content-Type: application/json" \  -d '{"username":"johndoe","firstName":"John","lastName":"Doe","role":"Reader"}'

Troubleshooting

• 401 Unauthorized: the request has no Authorization header

• 403 Forbidden: the request was refused. The token is invalid, expired or revoked; the user who created it is inactive or no longer exists in that tenant; the token's role does not include that endpoint; or a sign-in token was sent with Bearer

• 404 Not Found: wrong path or method

• 400 Bad Request: invalid payload or missing required fields