Appearance
List the latest release of each SRG
GET
/api/srgs/latest
Returns one row per SRG — its numerically highest V{major}R{minor} release — for dropdown population. Public reference data, no authentication required. The q parameter filters SRGs by case-insensitive substring with abbreviation expansion (GPOS matches General Purpose Operating System); queries shorter than 2 characters return no rows.
Parameters
Query Parameters
q
SRG filter — case-insensitive substring matched against name, title, and srg_id, with abbreviation expansion (minimum 2 characters).
Type
string
Example
"GPOS"Responses
Latest release of each SRG, ordered by title
application/json
JSON "rows": [ { "id": 42, "srg_id": "General_Purpose_Operating_System", "title": "General Purpose Operating System Security Requirements Guide", "version": "V3R3", "name": "General Purpose Operating System - Ver 3, Rel 3" }, { "id": 43, "srg_id": "Web_Server_SRG", "title": "Web Server Security Requirements Guide", "version": "V4R4", "name": "Web Server SRG - Ver 4, Rel 4" } ]
{
}
Get rule counts and component usage for an SRG
GET
/api/srgs/{id}/stats
Returns the SRG's rule count, severity breakdown, and which components are based on it. Usage is scoped to components the caller can see (member projects or released) — the count and list use the same scope, so hidden usage is never revealed. Requires authentication.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Path Parameters
id*
Numeric ID of the SRG.
Type
Requiredinteger
Example
3Responses
SRG stats with caller-scoped usage
application/json
JSON "rule_count": 250, "severity_counts": { "high": 30, "medium": 200, "low": 20 }, "usage": { "count": 2, "components": [ { "id": 38, "name": "RHEL 9 Hardened Baseline", "project_id": 7, "project_name": "RHEL Hardening" }, { "id": 41, "name": "Photon OS 5 Baseline", "project_id": 9, "project_name": "Photon OS 5 Hardening" } ] }
{
}
List the latest release of each STIG
GET
/api/stigs/latest
Returns one row per STIG — its numerically highest V{major}R{minor} release — for dropdown population. Public reference data, no authentication required. The q parameter filters STIGs by case-insensitive substring with abbreviation expansion (RHEL matches Red Hat Enterprise Linux); queries shorter than 2 characters return no rows.
Parameters
Query Parameters
q
STIG filter — case-insensitive substring matched against name, title, and stig_id, with abbreviation expansion (minimum 2 characters).
Type
string
Example
"RHEL"Responses
Latest release of each STIG, ordered by title
application/json
JSON "rows": [ { "id": 7, "stig_id": "RHEL_9_STIG", "title": "Red Hat Enterprise Linux 9 Security Technical Implementation Guide", "version": "V2R7", "name": "RHEL 9 STIG - Ver 2, Rel 7" } ]
{
}
Get rule counts for a STIG
GET
/api/stigs/{id}/stats
Returns the STIG's rule count and severity breakdown. Pure reference data — no usage section (components are based on SRGs, not STIGs) — and public like the rest of the STIG catalog.
Parameters
Path Parameters
id*
Numeric ID of the STIG.
Type
Requiredinteger
Example
4Responses
STIG rule counts and severity breakdown
application/json
JSON "rule_count": 380, "severity_counts": { "high": 40, "medium": 300, "low": 40 }
{
}
List the latest released component per prefix
GET
/api/components/latest
Returns one released component per prefix — the numerically highest version/release pair — for dropdown population. A component is a STIG in progress; released ones are instance-wide reference data for any authenticated user. Unreleased drafts never appear. The q parameter filters components by case-insensitive substring with abbreviation expansion (RHEL matches Red Hat Enterprise Linux); queries shorter than 2 characters return no rows.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Query Parameters
q
Component filter — case-insensitive substring matched against name, prefix, and title, with abbreviation expansion (minimum 2 characters).
Type
string
Example
"RHEL-09"Responses
Latest released component per prefix, ordered by prefix
application/json
JSON "rows": [ { "id": 38, "prefix": "RHEL-09", "name": "RHEL 9 Hardened Baseline", "title": "Red Hat Enterprise Linux 9", "version": 2, "release": 1 } ]
{
}
List uploaded Security Requirements Guides
GET
/srgs
Returns all uploaded SRGs sorted by title. Requires authentication. SRGs are the DISA baseline requirement documents that Components implement. Each SRG contains the rules that Component authors map their controls to.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
All SRGs
application/json
JSON { "id": 1, "srg_id": "Container_Platform_SRG", "name": "Container Platform SRG - Ver 2, Rel 4", "title": "Container Platform Security Requirements Guide", "version": "V2R4", "release_date": "2025-10-28", "core": false, "severity_counts": { "high": 8, "medium": 177, "low": 3 } }, { "id": 2, "srg_id": "General_Purpose_Operating_System_SRG", "name": "General Purpose Operating System - Ver 3, Rel 3", "title": "General Purpose Operating System SRG", "version": "V3R3", "release_date": "2025-06-15", "core": false, "severity_counts": { "high": 15, "medium": 150, "low": 8 } }
[
]
Upload an SRG XCCDF XML file
POST
/srgs
Parses and imports a DISA SRG from an XCCDF XML file. Requires admin role. Extracts all rules, CCIs, and metadata from the XML. Duplicate SRGs (same title + version) are rejected.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
multipart/form-data
DISA XCCDF XML file (.xml) containing the SRG.
Format
"binary"Responses
SRG uploaded and parsed
application/json
JSON "toast": { "title": "SRG created.", "message": [ "Successfully created SRG." ], "variant": "success" }
{
}
SRG detail with rules and metadata
GET
/srgs/{id}
Returns full SRG details including title, version, release date, severity counts, and all embedded rules with DISA metadata and check content. Requires authentication. Used by the SRG detail page (BenchmarkViewer).
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
SRG detail with nested rules
application/json
JSON "id": 1, "srg_id": "Container_Platform_SRG", "name": "Container Platform SRG - Ver 2, Rel 4", "title": "Container Platform Security Requirements Guide", "version": "V2R4", "release_date": "2025-10-28", "core": false, "severity_counts": { "high": 8, "medium": 177, "low": 3 }, "srg_rules": [ { "id": 1, "rule_id": "SV-233015r960759_rule", "title": "The container platform must use TLS 1.2 or greater...", "version": "SRG-APP-000014-CTR-000035", "rule_severity": "medium" } ]
{
}
Delete an uploaded SRG (admin only)
DELETE
/srgs/{id}
Permanently deletes an SRG and all its embedded rules. Requires admin role. Components based on this SRG will lose their baseline reference. This action cannot be undone.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
SRG removed
application/json
JSON "toast": { "title": "SRG removed.", "message": [ "Successfully removed SRG." ], "variant": "success" }
{
}
Export SRG in the specified format
GET
/srgs/{id}/export/{type}
Downloads the SRG as a CSV spreadsheet or XCCDF XML file. Requires authentication. CSV exports all rules in a flat table. XCCDF exports the original DISA XML format.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
Binary file download
List uploaded STIGs
GET
/stigs
Returns all uploaded STIGs sorted by title. Requires authentication. STIGs are published security guidance that can be used as reference when authoring Components.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
All STIGs
application/json
JSON { "id": 1, "stig_id": "Application_Security_Development_STIG", "name": "Application Security Development STIG - Ver 6, Rel 4", "title": "Application Security and Development Security Technical Implementation Guide", "version": "V6R4", "benchmark_date": "2025-10-01", "severity_counts": { "high": 34, "medium": 230, "low": 22 } }, { "id": 2, "stig_id": "Crunchy_Data_PostgreSQL_STIG", "name": "Crunchy Data PostgreSQL STIG - Ver 3, Rel 1", "title": "Crunchy Data PostgreSQL Security Technical Implementation Guide", "version": "V3R1", "benchmark_date": "2025-09-15", "severity_counts": { "high": 10, "medium": 85, "low": 5 } }
[
]
Upload a STIG XCCDF XML file
POST
/stigs
Parses and imports a published STIG from an XCCDF XML file. Requires admin role. Extracts all rules, CCIs, and metadata. Duplicate STIGs (same title + version) are rejected.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
multipart/form-data
DISA XCCDF XML file (.xml) containing the STIG.
Format
"binary"Responses
STIG uploaded and parsed
application/json
JSON "toast": { "title": "STIG added.", "message": [ "Successfully added Application Security and Development Security Technical Implementation Guide." ], "variant": "success" }
{
}
STIG detail with rules and metadata
GET
/stigs/{id}
Returns full STIG details including title, version, benchmark date, description, severity counts, and all embedded rules with DISA metadata and check content. Requires authentication. Used by the STIG detail page (BenchmarkViewer).
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
STIG detail with nested rules
application/json
JSON "id": 1, "stig_id": "Application_Security_Development_STIG", "name": "Application Security Development STIG - Ver 6, Rel 4", "title": "Application Security and Development Security Technical Implementation Guide", "version": "V6R4", "benchmark_date": "2025-10-01", "severity_counts": { "high": 34, "medium": 230, "low": 22 }, "description": "This Security Technical Implementation Guide is published...", "stig_rules": [ { "id": 660, "rule_id": "SV-222387r960735_rule", "title": "The application must limit logon sessions...", "version": "APSC-DV-000010", "rule_severity": "medium" } ]
{
}
Delete an uploaded STIG (admin only)
DELETE
/stigs/{id}
Permanently deletes a STIG and all its embedded rules. Requires admin role. This action cannot be undone.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
STIG removed
application/json
JSON "toast": { "title": "STIG removed.", "message": [ "Successfully removed Application Security and Development Security Technical Implementation Guide." ], "variant": "success" }
{
}
Export STIG in the specified format
GET
/stigs/{id}/export/{type}
Downloads the STIG as CSV or XCCDF XML. Requires authentication. CSV exports all rules in a flat table. XCCDF exports the original DISA XML format.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
Binary file download