The Link Changes endpoint returns the same underlying data you see on the Changes page in the Hexiosec ASM app. You can use it to export or automate change detection between scan iterations (new and removed risks, domains, and services).

The endpoint uses the same comparison logic and data source as the Changes page in the app, so the added/removed results will match what you see there for the same iteration window and filters.

Full request/response details, query parameters, and schemas are available in the API Reference.

The Link Changes API reports when relationships between assets change. In the data model, assets are represented as nodes and the connections (or relationships) between them as links. For example:

This makes it excellent for tracking risk changes, but it is not a direct feed of “new assets vs removed assets.”

If you want counts such as “4850 new risks, 257 risks removed”:

This mirrors the “Risk” rows in the app Changes page.

If you want the numbers of new and removed assets for each scan iteration, you don’t need to calculate these yourself. The /v1/scans/{id}/iterations endpoint already provides stats.nodes and stats.nodesByLabel, which include counts of added and removed items grouped by label (e.g. Domain, IPv4, Service).

Example snippet from an iteration response:

This matches the “Overview” counts you see in the app — for example:

If you want the detailed records of what changed (not just counts), use the Link Changes endpoint.

When you see “Change type: Domain” or “Change type: IPv4” in the app, that maps to node types in the API:

Remember: these filters still return relationship changes, not a pure list of new assets.

Together, these give you the full picture of what changed in your attack surface between two scans or over time.