Appearance
List uploaded STIGs
GET
/stigs
Returns all uploaded STIGs sorted by title. Requires authentication. STIGs are published security guidance that can be used as reference when authoring Components.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
All STIGs
application/json
JSON { "id": 1, "stig_id": "Application_Security_Development_STIG", "name": "Application Security Development STIG - Ver 6, Rel 4", "title": "Application Security and Development Security Technical Implementation Guide", "version": "V6R4", "benchmark_date": "2025-10-01", "severity_counts": { "high": 34, "medium": 230, "low": 22 } }, { "id": 2, "stig_id": "Crunchy_Data_PostgreSQL_STIG", "name": "Crunchy Data PostgreSQL STIG - Ver 3, Rel 1", "title": "Crunchy Data PostgreSQL Security Technical Implementation Guide", "version": "V3R1", "benchmark_date": "2025-09-15", "severity_counts": { "high": 10, "medium": 85, "low": 5 } }
[
]