​
Overview

The Assets API lets external systems manage the LowerPlane asset inventory programmatically. Use it to sync assets from your CMDB, provisioning pipelines, or custom discovery tools. All endpoints require API key authentication.

​
Endpoints

MethodPathDescription
GET/api/v1/external/assetsList assets
GET/api/v1/external/assets/{id}Get a single asset
POST/api/v1/external/assetsCreate an asset
PUT/api/v1/external/assets/{id}Update an asset
DELETE/api/v1/external/assets/{id}Delete an asset

​
List Assets

GET /api/v1/external/assets
​
type
string
Filter by asset type (see Asset types).
​
status
string
Filter by status: active, inactive, archived.
​
criticality
string
Filter by criticality: low, medium, high, critical.
​
classification
string
Filter by data classification: public, internal, confidential, restricted.
​
search
string
Search assets by name, description, or external ID.
​
sort_by
string
default:"name"
Sort field: name, type, status, criticality, created_at, updated_at.
​
sort_order
string
default:"asc"
Sort direction: asc or desc.
​
page
number
default:"1"
Page number.
​
limit
number
default:"20"
Results per page.
curl "https://app.lowerplane.com/api/v1/external/assets?type=server&status=active&page=1&limit=20" \
  -H "Authorization: Bearer lp_your_api_key"

​
Get an Asset

GET /api/v1/external/assets/{id}
Returns full asset detail including owner, cloud metadata, and open vulnerabilities. 
curl https://app.lowerplane.com/api/v1/external/assets/9f8e7d6c-asset-id \
  -H "Authorization: Bearer lp_your_api_key"

​
Create an Asset

POST /api/v1/external/assets
​
name
string
required
Display name of the asset.
​
type
string
required
Asset type (see Asset types).
​
description
string
Description of the asset.
​
subtype
string
Free-form subtype, e.g., an OS name (macOS, Ubuntu 22.04) or instance class.
​
external_id
string
Your system’s identifier for the asset (e.g., AWS ARN, serial number). Must be unique within your organization.
​
external_url
string
Link to the asset in an external system.
​
status
string
default:"active"
active, inactive, or archived.
​
classification
string
default:"internal"
Data classification: public, internal, confidential, restricted.
​
criticality
string
default:"medium"
low, medium, high, or critical.
​
environment
string
Deployment environment, e.g., production, staging.
​
region
string
Cloud region or physical region, e.g., us-east-1.
​
location
string
Physical location, if applicable.
​
in_scope
boolean
default:"true"
Whether the asset is in scope for compliance.
​
data_types
string[]
Types of data the asset handles, e.g., ["pii", "financial"].
​
contains_sensitive_data
boolean
default:"false"
Whether the asset stores or processes sensitive data.
​
is_encrypted
boolean
Whether the asset’s data is encrypted at rest.
​
encryption_type
string
Encryption mechanism, e.g., AES-256.
​
tags
string[]
Free-form tags.
​
custom_attributes
object
Arbitrary key-value metadata.
curl -X POST https://app.lowerplane.com/api/v1/external/assets \
  -H "Authorization: Bearer lp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "prod-db-01",
    "type": "database",
    "description": "Primary PostgreSQL production database",
    "external_id": "arn:aws:rds:us-east-1:123456789:db:prod-db-01",
    "environment": "production",
    "region": "us-east-1",
    "criticality": "critical",
    "classification": "confidential",
    "contains_sensitive_data": true,
    "is_encrypted": true,
    "encryption_type": "AES-256",
    "data_types": ["pii"],
    "tags": ["postgres", "rds"]
  }'
Returns 201 Created with the full asset record, including its id.

​
Update an Asset

PUT /api/v1/external/assets/{id}
Accepts the same body fields as create. Only the fields you include are updated; omitted fields are left unchanged. 
curl -X PUT https://app.lowerplane.com/api/v1/external/assets/9f8e7d6c-asset-id \
  -H "Authorization: Bearer lp_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "inactive",
    "criticality": "low"
  }'

​
Delete an Asset

DELETE /api/v1/external/assets/{id}

curl -X DELETE https://app.lowerplane.com/api/v1/external/assets/9f8e7d6c-asset-id \
  -H "Authorization: Bearer lp_your_api_key"
Deletion is permanent and also removes associated vulnerability links. To retire an asset while keeping its history, update its status to archived instead.

​
Asset Types

TypeDescription
workstationLaptops and desktops (aliases: laptop, desktop)
serverPhysical or virtual servers
mobile_devicePhones and tablets (alias: mobile)
network_deviceRouters, switches, firewalls (alias: network)
databaseDatabases
applicationApplications and software (alias: software)
cloud_accountCloud provider accounts
cloud_resourceGeneric cloud resources
containerContainers
apiAPIs
data_storeStorage systems (alias: storage)
saasSaaS applications
otherAnything else
Cloud-specific types are also supported: s3_bucket, ec2_instance, rds_instance, iam_user, iam_role, azure_vm, azure_storage_account, azure_ad_user, gce_instance, gcs_bucket, digitalocean_droplet, digitalocean_volume.
Unrecognized types are stored as other.

​
Error Responses

StatusErrorDescription
400name and type are requiredMissing required fields on create
400No fields to updateUpdate request body contained no recognized fields
401—Authentication failure (see Authentication)
404Asset not foundAsset ID doesn’t exist or belongs to another organization
409—An asset with the same external_id already exists in your organization