API overview

Probo exposes two primary APIs for programmatic access: a GraphQL API for CRUD operations and an MCP API for AI agent automation.

Probo provides two complementary APIs. The GraphQL API is the primary interface for all data operations — the same API the web app uses. The MCP API is purpose-built for AI agents, following the Model Context Protocol standard.

GraphQL API

Endpoint: POST /api/console/v1/graphql

The GraphQL API supports all create, read, update, and delete operations across every resource in Probo. Use it to build integrations, automate workflows, or query compliance data programmatically.

curl -X POST https://your-probo-instance/api/console/v1/graphql \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ viewer { id } }"}'

MCP API

Endpoint: POST /api/mcp/v1

The MCP API exposes Probo as a set of tools that AI agents can call directly. It is designed for use with MCP-compatible clients such as Claude Desktop, Cursor, and custom agent frameworks.

If you’re building an AI-powered compliance workflow, start with the MCP API. If you’re building a custom integration or dashboard, use the GraphQL API.

Authentication

Both APIs use the same authentication mechanism: an API key passed as a Bearer token in the Authorization header.

Authorization: Bearer YOUR_API_KEY

See the Authentication page for details on creating and managing API keys.

IDs

All resource IDs in Probo are Global IDs (GIDs) — opaque strings that encode both the resource type and its identifier. Always treat them as strings; do not attempt to parse or construct them manually.

Example GID: "gid://probo/Organization/01J5XKZW9QMXP3N6V8HTJA2FKB"

Pagination

List operations use cursor-based pagination. Each response includes a next_cursor field. Pass this value as the cursor parameter in your next request to retrieve the following page.

Parameter	Type	Description
cursor	string	Opaque cursor from the previous response’s next_cursor
size	integer	Number of results per page

When next_cursor is absent or null in the response, you have reached the last page.

{
  "vendors": [...],
  "next_cursor": "eyJmIjoiQ1JFQVRFRF9BVCIsImQiOiJBU0MiLCJ2IjoiMjAyNC0..."
}

Resources

Authentication

Create API keys and authenticate requests

Organizations

Access organization data

Users

Manage users and memberships

Vendors

Track third-party vendors and risk assessments

Risks

Create and manage risks

Measures

Manage security and compliance measures

Frameworks

Work with compliance frameworks

Assets

Track physical and virtual assets