External API
The External API is a read-only REST API that lets scripts (Azure CLI, Azure PowerShell, curl) and your own backend apps read the same data StratoLens shows in its web UI. Every call is signed in as a real user and runs with that user's normal StratoLens roles and scope.
What You'll Learn
- How an administrator turns the API on, trusts a client app, and optionally limits it to specific users
- How to sign in and call a route from Azure CLI, Azure PowerShell, curl or a custom app
- Which StratoLens permission each route needs and what every error response means
- The parameter formats shared across routes: scan IDs, time windows, lists, paging
- Every available route, its parameters, response fields and exact error strings
Read-only, user sign-in only
- Every route is an HTTP
GET. Nothing can be changed through this API. - Only delegated user sign-in is accepted. Service principals, managed identities and client-credential (app-only) flows are rejected, so unattended automation without a user sign-in is not supported.
- There is no CORS support. Call the API from a script or a backend service, not from JavaScript in a browser on another site.
Key Capabilities
Scripted access to the whole data set
73 routes cover inventory, changes, Activity Log, cost, Defender, Azure Policy, Advisor, recommendations, reports and the audit log. No API keys, personal access tokens or stored secrets.
Runs as the signed-in user
A call can never see more than the caller sees in the browser. Roles decide which routes work; data scope decides which subscriptions and management groups come back.
Off by default, three independent admin controls
A master switch, an allow-list of trusted client apps, and an optional per-user grant. The master switch and the trusted-client list live on the Security card; the per-user grant is set on each grant on Settings > Users. All three are recorded in the audit log.
Works with the tools you already have
Azure CLI and Azure PowerShell are preset clients. Any delegated OAuth flow (MSAL or similar) works for a custom app registration. The wizard prints ready-to-copy sign-in commands.
Same JSON as the web UI
There is no versioned public facade. Each route returns the JSON the StratoLens UI uses, so field sets can grow between releases. Scripts should ignore fields they don't recognise.
No inbound rate limit
These routes have no rate limit, but some are heavy (noted per route). Be considerate with loops: prefer one unpaged call or a narrower window over many pages.
Related Features
Feature Integration
- User Permissions System: API calls use the caller's roles and data scope. The per-user External API access flag lives on each grant on Settings > Users.
- Audit Log System: every admin change to the API controls appears under Access & Security. Individual API calls are not logged.
- MCP Server (AI assistants): the same Security card and the same trust model, with one more toggle (Allow MCP connections) for connecting VS Code, Claude or ChatGPT to StratoLens. It is documented separately.
Documentation Sections
Read the first three pages in order, then use the reference pages as you need them.
Getting Started
Turn the API on, trust a client, and make your first call from Azure CLI or PowerShell.
Read: Getting Started →Authentication, Permissions & Errors
What a token must contain, which permission each route needs, and what every error means.
Read: Authentication, Permissions & Errors →Common Conventions
Scan IDs, scan pairs, time windows, list parameters, paging and response-field rules shared by many routes.
Read: Common Conventions →Reference: Scans & Inventory
Scan history, discovered inventory, entity details and history, role assignments, performance metrics.
Read: Reference: Scans & Inventory →Reference: Changes & Activity
Scan diffs, Resource Graph changes, change attribution and Azure Activity Log operations.
Read: Reference: Changes & Activity →Reference: Security & Defender
StratoLens security findings plus Defender plans, assessments, alerts, vulnerabilities and their diffs.
Read: Reference: Security & Defender →Reference: Azure Policy
Policy compliance and assignments per scan, and how they changed between scans.
Read: Reference: Azure Policy →Reference: Cost & Commitments
Cost Explorer data, cost anomalies, and reservation and savings plan inventory.
Read: Reference: Cost & Commitments →Reference: Recommendations
Sizing, orphaned resources, retirements, quotas, access optimization, realized savings and Azure Advisor.
Read: Reference: Recommendations →Reference: Reports
Every StratoLens report as JSON, with the shared filter parameters.
Read: Reference: Reports →Reference: Audit Log
The StratoLens audit trail: who did what inside StratoLens.
Read: Reference: Audit Log →