REST APIs

eramba can receive and send APIs in most modules, this means you can write your own code to automate actions between eramba and other systems.

Remember you can think of APIs as a both-way route:

• Receive REST API CRUD requests in eramba to add, list, edit, remove, Etc (CRUD actions). For example, when your SIEM matches a trigger rule it can REST API to eramba and create an incident on the Incident Module
• Send REST APIs (Webhooks) from eramba to any system based on your own defined triggers: For example, when a Project is created in eramba it automatically creates an issue in Jira. In some cases, these webhooks will have an intermediary workflow automation third-party solution (Zapier, Make.com, etc) that will resolve the integration with other tools.

The diagram below shows both scenarios, on the left eramba receives CRUD actions to a module (in this case Risk), on the right we can see eramba triggering webhooks to other systems (sometimes directly and in one scenario through an intermediary) using notifications and statuses.

As shown in the screenshot below, all our API documentation can be found on each module (you need to be logged as an Admin or member of the Admin group to see the documentation) using Swagger.

The REST engine allows you to manipulate not just objects (Risks, Controls, Reviews, etc.) but also Comments & Attachments and Custom fields created by you in eramba. 

Building this type of integration will require your systems and applications to trigger REST calls to eramba. In this scenario, eramba simply will respond to the request with an OK or NOT OK (error).

eramba can send APIs to external systems based on your own defined conditions with the use of Statuses (see the Status course). Statuses can be configured in every module based on your own conditions:

• When a Risk is created
• When a Risk becomes High
• When a Risk is no longer mitigated
• When an Internal Control needs testing
• Etc

When a status triggers (the label is shown) you can trigger a Warning notification (see notifications) and on that notification you can choose to send a REST call instead of just an email.

You will then have to configure the webhook attributes:

• Endpoint URL
• Headers
• Payload

This can include macro fields, allowing you to inject into the request whatever attribute you want. 

Comments and attachments notifications can also trigger webhook calls, this is useful if you want to send updates to Slack or Teams instead of simply sending emails.