Quickstart

This page walks through a single API call from start to finish. It assumes you have a security token. If you do not, see Authentication.

1. Set your token

export INTERLYNK_SECURITY_TOKEN="lynk_live_xxxxxxxxxxxxxxxxxxxx"

2. Make a request

The API has one endpoint. You always send a POST with a JSON body.

curl https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "query { organization { id name } }"}'

{
  "data": {
    "organization": {
      "id": "72219448-e3cf-47f4-8e54-49199fc47f52",
      "name": "Acme Corp"
    }
  }
}

Anatomy of a request

The JSON body has up to three keys:

Key	Required	Purpose
query	Yes	The GraphQL query or mutation string
variables	No	Values referenced by the query, as a JSON object
operationName	No	Names the operation when the query string defines more than one

A request with variables looks like this:

curl https://api.interlynk.io/lynkapi \
  -H "Authorization: Bearer $INTERLYNK_SECURITY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "query GetSbom($projectId: Uuid!, $sbomId: Uuid!) { sbom(projectId: $projectId, sbomId: $sbomId) { id projectVersion } }",
    "variables": {
      "projectId": "1fade833-0603-4139-8ca0-26592264a4c9",
      "sbomId": "4e423fe0-d089-4025-b1e4-8fe9608138d6"
    },
    "operationName": "GetSbom"
  }'

Variables keep IDs and user input out of the query string, which makes requests easier to build and safer to script.

Queries read data. Mutations change data. Both go to the same endpoint as a POST. Uploads are the one exception: they use multipart/form-data instead of a JSON body. See Upload an SBOM.

Next steps

• Learn how the platform is organized in the Data Model.

• List your products and versions to get the IDs other calls need.

• Upload or download an SBOM.