API reference

API reference: Data catalog

Cushy data-catalog API: every discovered object store and managed database with its encryption, exposure and residency, plus evidence-backed governance findings.

The data catalog is derived entirely from resources the sync engine has already discovered — it makes no additional cloud API call. Every field is a value a cloud actually returned; anything the cloud did not report is reported as unknown, never as a violation and never as an estimate.

GET/api/data/catalogSession or Bearer

Data assets (object stores + managed databases), governance findings, residency roll-up and data-service spend for your org. A never-connected org returns { empty: true }.

Example response

json

{ "generatedAt": "2026-08-20T09:00:00.000Z",
  "counts": { "assets": 10, "objectStores": 6, "databases": 4, "byProvider": [ { "provider": "AWS", "assets": 10 } ] },
  "assets": [ { "nativeId": "arn:aws:s3:::acme-logs", "name": "acme-logs", "provider": "AWS",
      "region": "us-east-1", "category": "object-store", "kind": "S3 bucket",
      "encryption": { "atRest": true, "detail": "encryption=AES256" },
      "versioning": false, "publicAccess": false,
      "residency": { "country": "US", "countryName": "United States", "jurisdiction": "US" } } ],
  "findings": [ { "rule": "versioning-disabled", "severity": "medium", "nativeId": "arn:aws:s3:::acme-logs",
      "evidence": [ { "attribute": "versioning", "value": "disabled" } ] } ],
  "coverage": { "encryptionUnknown": 0, "versioningUnknown": 0, "publicAccessUnknown": 0 },
  "residency": { "byJurisdiction": [ … ], "byCountry": [ … ], "unmapped": [ … ] },
  "spend": { "currency": "USD", "total": 18412.97, "services": [ … ], "matchedBy": "billing service name …" },
  "limits": [ { "id": "size-and-growth", "text": "…" } ], "truncated": false }

Errors

Status	When
`401`	Not signed in / invalid token.

Governance rules and their fixed severities: public-object-store (critical), publicly-exposed-database (critical), unencrypted-at-rest (high), versioning-disabled (medium). Each finding carries the exact attribute evidence that produced it. There is no risk score — severity is a property of the rule, not a computed judgement.

Known limits, also returned in limits[]: object counts, stored bytes and growth trends are not collected (they need per-bucket metrics APIs Cushy does not call); classification is metadata-only, so no object or row content is ever read and this is not PII detection; a region outside the residency table is reported as unmapped rather than guessed.