Components

Component CRUD, spreadsheet import, export, and locking

---

Get a lightweight component summary

GET

/api/components/{id}/summary

Returns the component header — identity, counts, SRG info, the caller's effective permissions, and the serialized comment-phase state machine — without the heavy rules/reviews/histories arrays. Access matches the component show rules: released components are readable by any authenticated user; unreleased ones require viewer permission.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Parameters

Path Parameters

id*

Numeric ID of the component.

Type

integer

Required

Example38

Responses

Component summary with phase state

Content-Type

application/json

{

  

"id": 38,

  

"name": "RHEL 9 Hardened Baseline",

  

"prefix": "RHEL-09",

  

"document_type": "stig",

  

"title": "Red Hat Enterprise Linux 9",

  

"version": 2,

  

"release": 1,

  

"released": false,

  

"project_id": 7,

  

"component_id": null,

  

"security_requirements_guide_id": 3,

  

"based_on_title": "General Purpose Operating System Security Requirements Guide",

  

"based_on_version": "V3R3",

  

"rules_count": 203,

  

"memberships_count": 4,

  

"severity_counts": {

  

  

"high": 20,

  

  

"medium": 173,

  

  

"low": 10

  

},

  

"pending_comment_count": 5,

  

"effective_permissions": "viewer",

  

"updated_at": "2026-07-10T14:07:37.142Z",

  

"comment_phase": "open",

  

"closed_reason": null,

  

"comment_period_starts_at": "2026-07-01T00:00:00.000Z",

  

"comment_period_ends_at": "2026-07-15T00:00:00.000Z",

  

"accepting_new_comments": true,

  

"triaging_active": true,

  

"frozen_for_writes": false,

  

"comment_period_days_remaining": 5

}

GET

/api/components/{id}/summary

Playground

Authorization

cookieAuth

Variables

Key

Value

id*

Samples

---

Get rule statistics for a component

GET

/api/components/{id}/stats

Returns rule counts by status and severity plus completion and lock percentages, computed as SQL aggregates. Access matches the component show rules: released components are readable by any authenticated user; unreleased ones require viewer permission.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Parameters

Path Parameters

id*

Numeric ID of the component.

Type

integer

Required

Example38

Responses

Component rule statistics

Content-Type

application/json

{

  

"document_type": "stig",

  

"rules_by_status": {

  

  

"not_yet_determined": 50,

  

  

"applicable_configurable": 120,

  

  

"applicable_inherently_meets": 15,

  

  

"applicable_does_not_meet": 8,

  

  

"not_applicable": 10

  

},

  

"rules_by_severity": {

  

  

"high": 20,

  

  

"medium": 173,

  

  

"low": 10

  

},

  

"rule_count": 203,

  

"completion_pct": 75.4,

  

"lock_pct": 12.3

}

GET

/api/components/{id}/stats

Playground

Authorization

cookieAuth

Variables

Key

Value

id*

Samples

---

Get workflow readiness for a component

GET

/api/components/{id}/workflow_state

Returns where the component stands across the authoring, lock, review, comment, triage, and export stages — SQL-aggregated counts plus the comment-phase write-guard booleans. Access matches the component show rules: released components are readable by any authenticated user; unreleased ones require viewer permission.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Parameters

Path Parameters

id*

Numeric ID of the component.

Type

integer

Required

Example38

Responses

Component workflow state

Content-Type

application/json

{

  

"document_type": "stig",

  

"authoring": {

  

  

"rules_total": 203,

  

  

"rules_determined": 153

  

},

  

"locks": {

  

  

"locked": 25,

  

  

"total": 203,

  

  

"all_locked": false

  

},

  

"reviews": {

  

  

"under_review": 4

  

},

  

"comment": {

  

  

"phase": "open",

  

  

"accepting_new_comments": true,

  

  

"triaging_active": true,

  

  

"frozen_for_writes": false,

  

  

"pending_comments": 3

  

},

  

"triage": {

  

  

"pending": 3,

  

  

"awaiting_adjudication": 1

  

},

  

"export": {

  

  

"released": false,

  

  

"releasable": false

  

}

}

GET

/api/components/{id}/workflow_state

Playground

Authorization

cookieAuth

Variables

Key

Value

id*

Samples

---

Get triage summary for a component

GET

/api/components/{id}/triage_summary

Returns top-level comment counts per triage status plus the adjudication percentage — rule-attached and component-attached comments both count. Access matches the component show rules: released components are readable by any authenticated user; unreleased ones require viewer permission.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Parameters

Path Parameters

id*

Numeric ID of the component.

Type

integer

Required

Example38

Responses

Component triage summary

Content-Type

application/json

{

  

"by_triage_status": {

  

  

"pending": 3,

  

  

"concur": 1,

  

  

"concur_with_comment": 0,

  

  

"non_concur": 0,

  

  

"duplicate": 0,

  

  

"informational": 1,

  

  

"needs_clarification": 0,

  

  

"withdrawn": 0,

  

  

"addressed_by": 0

  

},

  

"total": 5,

  

"adjudicated": 1,

  

"adjudication_pct": 20

}

GET

/api/components/{id}/triage_summary

Playground

Authorization

cookieAuth

Variables

Key

Value

id*

Samples

---

List released components

GET

/components

Returns all released (published) components visible to the current user. Released components are read-only snapshots that have been through the DISA review process. Requires authentication.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Responses

Released components

Content-Type

application/json

[

  

{

  

  

"id": 29,

  

  

"name": "Container SRG",

  

  

"prefix": "CNTR",

  

  

"version": 1,

  

  

"release": 1,

  

  

"released": true

  

},

  

{

  

  

"id": 30,

  

  

"name": "Photon OS 3",

  

  

"prefix": "PHOS-03",

  

  

"version": 1,

  

  

"release": 1,

  

  

"released": true

  

}

]

GET

/components

Playground

Authorization

cookieAuth

Samples

---

Create or duplicate a component in a project

POST

/projects/{projectId}/components

Creates a new component in the project from one or more declared source SRGs, duplicates an existing component, or imports from an uploaded XCCDF/CSV file. Requires admin role on the project. The component is initialized with requirements from every declared source (full union by default, or the requirement_selections subset) — security_requirements_guide_id designates the primary.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Request Body

{

  

"component": {

  

  

"name": "Container SRG",

  

  

"prefix": "CNTR",

  

  

"title": "Container Platform Security Technical Implementation Guide",

  

  

"version": 1,

  

  

"release": 1,

  

  

"security_requirements_guide_id": 1

  

}

}

Responses

Component created

Content-Type

application/json

{

  

"toast": {

  

  

"title": "Component created.",

  

  

"message": [

  

  

  

"Successfully created component Container SRG."

  

  

],

  

  

"variant": "success"

  

}

}

POST

/projects/{projectId}/components

Playground

Authorization

cookieAuth

Body

Samples

---

Component detail with rules

GET

/components/{componentId}

Returns full component details including all rules with their content fields, for either document kind. Members (any role) receive the editor view; a non-member receives the read-only show view for a RELEASED component (released components are never concealed, whatever the project's visibility). An unreleased component answers a non-member per the disclosure policy: 403 with the project admins to ask when the project is discoverable, or the concealment 404 when it is hidden.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Responses

Component with rules — the editor view for members, the read-only show view otherwise. A null effective_permissions marks the show branch. The two shapes share their core fields, so they are documented as anyOf.

Content-Type

application/json

{

  

"id": 1,

  

"name": "Photon OS 3",

  

"prefix": "PHOS-03",

  

"title": "Photon OS 3 STIG Readiness Guide",

  

"rules_count": 203,

  

"comment_phase": "open",

  

"version": 1,

  

"release": 1,

  

"released": false

}

GET

/components/{componentId}

Playground

Authorization

cookieAuth

Samples

---

Update component attributes

PUT

/components/{componentId}

Updates component metadata (name, prefix, version, release, description). Requires admin role on the parent project. Does not modify rules — use the rule endpoints for rule content changes.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Request Body

application/json

{

  

"component": {

  

  

"version": 2,

  

  

"release": 1

  

}

}

Responses

Component updated

Content-Type

application/json

{

  

"toast": {

  

  

"title": "Component updated.",

  

  

"message": [

  

  

  

"Successfully updated component."

  

  

],

  

  

"variant": "success"

  

}

}

PUT

/components/{componentId}

Playground

Authorization

cookieAuth

Body

Samples

---

Delete a component and all its rules

DELETE

/components/{componentId}

Permanently deletes the component, all its rules, reviews, and associated data. Requires admin role on the parent project. This action cannot be undone.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Responses

Component deleted

Content-Type

application/json

{

  

"toast": {

  

  

"title": "Component deleted.",

  

  

"message": [

  

  

  

"Successfully deleted component."

  

  

],

  

  

"variant": "success"

  

}

}

DELETE

/components/{componentId}

Playground

Authorization

cookieAuth

Samples

---

Partial update of component attributes

PATCH

/components/{componentId}

Partial update — same behavior as PUT but only supplied fields are changed. Requires admin role on the parent project.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Request Body

application/json

{

  

"component": {

  

  

"name": "Container SRG",

  

  

"prefix": "CNTR",

  

  

"version": 1,

  

  

"release": 1,

  

  

"title": "Container Platform Security Technical Implementation Guide",

  

  

"description": "STIG guidance for container orchestration platform deployments.",

  

  

"released": false,

  

  

"admin_name": "Jane Analyst",

  

  

"admin_email": "jane.analyst@example.com",

  

  

"advanced_fields": false,

  

  

"comment_phase": "open",

  

  

"closed_reason": "string",

  

  

"comment_period_starts_at": "2026-07-01T00:00:00Z",

  

  

"comment_period_ends_at": "2026-08-01T00:00:00Z",

  

  

"additional_questions_attributes": [

  

  

  

{

  

  

  

  

"id": 3,

  

  

  

  

"name": "Deployment environment",

  

  

  

  

"question_type": "dropdown",

  

  

  

  

"_destroy": false,

  

  

  

  

"options": [

  

  

  

  

  

[

  

  

  

  

  

  

"Cloud",

  

  

  

  

  

  

"On-prem"

  

  

  

  

  

]

  

  

  

  

]

  

  

  

}

  

  

],

  

  

"component_metadata_attributes": {

  

  

  

"data": {

  

  

  

  

"additionalProperties": "string"

  

  

  

}

  

  

}

  

}

}

Responses

Component updated

Content-Type

application/json

{

  

"toast": {

  

  

"title": "User updated.",

  

  

"message": [

  

  

  

[

  

  

  

  

"Successfully updated user."

  

  

  

]

  

  

],

  

  

"variant": "success"

  

}

}

PATCH

/components/{componentId}

Playground

Authorization

cookieAuth

Body

Samples

---

Paginated triage table for component comments

GET

/components/{componentId}/comments

Returns paginated public comments on this component's rules, with triage status counts and filtering. Powers the triage page table and split-pane views. Supports filtering by status, section, rule, author, text search, and resolution state. Requires project membership.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Parameters

Query Parameters

triage_status

Filter comments by triage disposition. Defaults to "pending" — the triage table opens on undispositioned comments. Use "all" to return comments in any status.

Type

string

Valid values

"all""pending""concur""concur_with_comment""non_concur""duplicate""informational""needs_clarification""withdrawn""addressed_by"

Example"pending"

Default

"pending"

page

Page number for paginated results (1-based).

Type

integer

Example1

Minimum

1

Default

1

per_page

Number of items to return per page.

Type

integer

Example25

Minimum

1

Maximum

1000

Default

25

section

Filter by requirement section (fixtext, check_content, etc.).

Type

string

Example"fixtext"

rule_id

Filter to comments on a specific rule.

Type

integer

Example100

author_id

Filter to comments by a specific author.

Type

integer

Example42

q

Full-text search across comment content.

Type

string

Example"container image"

resolved

Filter by resolved state (true/false/all).

Type

string

Valid values

"true""false""all"

Example"false"

commentable_type

Restrict rows to comments on requirements ("rule") or on the component itself ("component"). Absent or any other value returns both.

Type

string

Valid values

"rule""component"

Example"rule"

include_rule_content

Include rule content fields for split-pane triage view.

Type

string

Valid values

"true"

Responses

Paginated comment rows with status counts

Content-Type

application/json

{

  

"rows": [

  

  

{

  

  

  

"id": 44,

  

  

  

"commentable_type": "BaseRule",

  

  

  

"rule_displayed_name": "CNTR-00-000050",

  

  

  

"section": "fixtext",

  

  

  

"author_name": "John Osborne",

  

  

  

"author_email": "josborne@example.org",

  

  

  

"comment": "This requirement needs clarification...",

  

  

  

"triage_status": "pending",

  

  

  

"created_at": "2026-05-19T16:15:00Z",

  

  

  

"responses_count": 0,

  

  

  

"reactions": {

  

  

  

  

"up": 1,

  

  

  

  

"down": 0

  

  

  

}

  

  

}

  

],

  

"pagination": {

  

  

"page": 1,

  

  

"per_page": 25,

  

  

"total": 1,

  

  

"total_comments": 10

  

},

  

"status_counts": {

  

  

"pending": 10,

  

  

"concur": 2

  

}

}

GET

/components/{componentId}/comments

Playground

Authorization

cookieAuth

Variables

Key

Value

triage_status

page

per_page

section

rule_id

author_id

q

resolved

commentable_type

include_rule_content

Samples

---

Export component in the specified format

GET

/components/{componentId}/export/{type}

Downloads the component as CSV, XCCDF XML, InSpec profile, JSON archive, or disposition CSV. Supports mode selection (working_copy, vendor_submission, published_stig) via query param. The xccdf type is kind-routed by the component's document type: SRG components export their authored requirements through the published_srg mode (only Applicable requirements publish); STIG components use published_stig. disposition_csv is for DISA comment triage matrix export. Requires project membership.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Parameters

Query Parameters

mode

Export mode controlling which fields are included. The xccdf type ignores this parameter — its mode is derived from the component's document type (published_srg for SRG kind, published_stig for STIG).

Type

string

Valid values

"working_copy""vendor_submission""published_stig"

Example"working_copy"

triage_status

Filter disposition CSV by triage status.

Type

string

Example"pending"

Responses

Binary file download

Content-Type

GET

/components/{componentId}/export/{type}

Playground

Authorization

cookieAuth

Variables

Key

Value

mode

triage_status

Samples

---

Lock all unlocked rules in a component

POST

/components/{componentId}/lock

Locks every currently-unlocked rule in the component, preventing further edits. Requires component-admin authority. Already-locked rules are unaffected.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Request Body

application/json

{

  

"review": {

  

  

"action": "lock_control",

  

  

"comment": "Locking for DISA submission review."

  

}

}

Responses

Lockable rules locked. Rules with incomplete data are SKIPPED, not failed — Not Yet Determined without satisfactions, Does Not Meet without mitigations, Inherently Meets without an artifact description — and each skip is named in a warning line appended to the message (variant becomes warning).

Content-Type

application/json

{

  

"toast": {

  

  

"title": "Locked 2 controls.",

  

  

"message": [

  

  

  

"Locked: CNTR-00-000001, CNTR-00-000002"

  

  

],

  

  

"variant": "success"

  

}

}

POST

/components/{componentId}/lock

Playground

Authorization

cookieAuth

Body

Samples

---

Lock or unlock sections on every unlocked rule

PATCH

/components/{componentId}/lock_sections

Locks (or unlocks) the named content sections across all unlocked requirement rows in the component — both document kinds. Section names come from the lockable-section vocabulary (Title, Severity, Status, Fix, Check, ...). Locked sections cannot be edited until unlocked. Requires reviewer role or higher on the component. Returns 422 when any section name is not in the vocabulary.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Request Body

application/json

{

  

"sections": [

  

  

"Fix",

  

  

"Check"

  

],

  

"locked": true,

  

"comment": "Content freeze for the review window."

}

Responses

Section lock applied across all unlocked rules

Content-Type

application/json

{

  

"toast": {

  

  

"title": "Section lock applied",

  

  

"message": [

  

  

  

"Locked 2 section(s) on 264 rule(s)"

  

  

],

  

  

"variant": "success"

  

}

}

PATCH

/components/{componentId}/lock_sections

Playground

Authorization

cookieAuth

Body

Samples

---

Audit history for the component

GET

/components/{componentId}/histories

Returns the 50 most recent audit trail entries for the component, including rule changes, review actions, and metadata updates. Used by the component history sidebar. Requires project membership.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Responses

Recent audit entries

Content-Type

application/json

[

  

{

  

  

"id": 600,

  

  

"auditable_type": "Rule",

  

  

"auditable_id": 812,

  

  

"action": "update",

  

  

"name": "Demo Admin",

  

  

"created_at": "2026-05-28T15:00:00Z",

  

  

"audited_changes": [

  

  

  

{

  

  

  

  

"field": "status",

  

  

  

  

"prev_value": "Not Yet Determined",

  

  

  

  

"new_value": "Applicable - Configurable"

  

  

  

}

  

  

]

  

}

]

GET

/components/{componentId}/histories

Playground

Authorization

cookieAuth

Samples

---

Detect which SRG a spreadsheet belongs to

POST

/components/detect_srg

Analyzes an uploaded spreadsheet (CSV/XLSX) to determine which SRG its rule IDs match. Used by the component creation flow to auto-select the correct SRG when importing from a spreadsheet. Returns the matched SRG's id, srg_id, title, and version. Returns 422 if no file provided, no SRG IDs found, no matching SRG exists, or IDs map to multiple SRGs.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Request Body

multipart/form-data

CSV or XLSX spreadsheet containing rule IDs.

Format"binary"

Responses

Matched SRG

Content-Type

application/json

{

  

"id": 1,

  

"srg_id": "Container_Platform_SRG",

  

"title": "Container Platform Security Requirements Guide",

  

"version": "V2R4"

}

POST

/components/detect_srg

Playground

Authorization

cookieAuth

Body

Samples

---

Revision history for a named component across versions

GET

/components/history

Traces the version history of a component by name within a project. Returns an ordered array alternating between milestone entries (marking a version point) and diff entries (showing rule-level changes between consecutive releases). Used by the DiffViewer feature. Requires project membership. Component objects use ComponentBlueprint default view (9 fields).

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Parameters

Query Parameters

project_id*

ID of the project containing the component versions.

Type

integer

Required

Example1

name*

Component name to trace across versions.

Type

string

Required

Example"Photon OS 3"

Responses

Ordered revision history. The array alternates between two entry types: 1. Milestone entries: { component: ComponentSummary } — marks a version point 2. Diff entries: { base_component: ComponentSummary, diff_component: ComponentSummary, changes: { rule_id: HistoryChangeEntry } }

Content-Type

application/json

[

  

{

  

  

"component": {

  

  

  

"id": 1,

  

  

  

"name": "Photon OS 3",

  

  

  

"prefix": "PHOS-03",

  

  

  

"version": 1,

  

  

  

"release": 1

  

  

}

  

},

  

{

  

  

"base_component": {

  

  

  

"id": 1,

  

  

  

"name": "Photon OS 3",

  

  

  

"prefix": "PHOS-03",

  

  

  

"version": 1,

  

  

  

"release": 1

  

  

},

  

  

"diff_component": {

  

  

  

"id": 2,

  

  

  

"name": "Photon OS 3",

  

  

  

"prefix": "PHOS-03",

  

  

  

"version": 1,

  

  

  

"release": 2

  

  

},

  

  

"changes": {

  

  

  

"000050": {

  

  

  

  

"change": "updated",

  

  

  

  

"base": {

  

  

  

  

  

"rule_id": "000050",

  

  

  

  

  

"title": "Original title",

  

  

  

  

  

"fix": "Original fix text"

  

  

  

  

},

  

  

  

  

"diff": {

  

  

  

  

  

"rule_id": "000050",

  

  

  

  

  

"title": "Updated title",

  

  

  

  

  

"fix": "Updated fix text"

  

  

  

  

}

  

  

  

}

  

  

}

  

},

  

{

  

  

"component": {

  

  

  

"id": 2,

  

  

  

"name": "Photon OS 3",

  

  

  

"prefix": "PHOS-03",

  

  

  

"version": 1,

  

  

  

"release": 2

  

  

}

  

}

]

GET

/components/history

Playground

Authorization

cookieAuth

Variables

Key

Value

project_id*

name*

Samples

---

Find components sharing the same SRG baseline

GET

/components/{componentId}/related

Returns other components that are based on the same SRG as this component. Used by the DiffViewer to find peer components for side-by-side comparison. Scoped to components the current user can access plus released components. Returns a hand-built hash (NOT ComponentBlueprint).

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Responses

Related components sharing the same SRG

Content-Type

application/json

[

  

{

  

  

"id": 4,

  

  

"name": "Photon OS 3",

  

  

"version": 1,

  

  

"prefix": "PHOS-03",

  

  

"release": 1,

  

  

"project_id": 3,

  

  

"project_name": "vSphere 7.0"

  

}

]

GET

/components/{componentId}/related

Playground

Authorization

cookieAuth

Samples

---

Search requirements within a component by text

POST

/components/{componentId}/find

Full-text search across requirement titles, fix text, vendor comments, status justification, artifact description, vulnerability discussion, mitigations, and check content within a single component. The same field list applies to both document kinds; results are shaped by the component's document_type. Returns matching requirements in rule_id order. Used by the in-component search feature.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Request Body

application/json

{

  

"find": "container image"

}

Responses

Matching requirements in rule_id order, shaped by the component's document_type: STIG rule objects for stig components, authored SRG requirement objects for srg components.

Content-Type

application/json

[

  

{

  

  

"id": 100,

  

  

"rule_id": "CNTR-00-000050",

  

  

"title": "Container images must be signed",

  

  

"status": "Applicable - Configurable",

  

  

"locked": false,

  

  

"satisfies": [

  

  

],

  

  

"satisfied_by": [

  

  

]

  

},

  

{

  

  

"id": 101,

  

  

"rule_id": "CNTR-00-000051",

  

  

"title": "Container images must come from approved registries",

  

  

"status": "Applicable - Configurable",

  

  

"locked": false,

  

  

"satisfies": [

  

  

],

  

  

"satisfied_by": [

  

  

]

  

}

]

POST

/components/{componentId}/find

Playground

Authorization

cookieAuth

Body

Samples

---

Preview changes from a spreadsheet import

POST

/components/{componentId}/preview_spreadsheet_update

Parses an uploaded spreadsheet (CSV/XLSX) and returns a diff of what would change if applied, without modifying any data. Returns four arrays: updated (rules with changes), unchanged (no diff), skipped_locked (locked rules or inherited rules), and warnings (SRG IDs not found). Requires author role on the component.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Request Body

multipart/form-data

CSV or XLSX spreadsheet file containing rule updates.

Format"binary"

Responses

Preview of changes grouped by outcome

Content-Type

application/json

{

  

"updated": [

  

  

{

  

  

  

"rule_id": "000050",

  

  

  

"srg_id": "SRG-APP-000014-CTR-000035",

  

  

  

"changes": {

  

  

  

  

"fixtext": [

  

  

  

  

  

"Old fix text",

  

  

  

  

  

"Updated fix text"

  

  

  

  

]

  

  

  

}

  

  

}

  

],

  

"unchanged": [

  

  

{

  

  

  

"rule_id": "000051",

  

  

  

"srg_id": "SRG-APP-000023-CTR-000040",

  

  

  

"reason": "no changes"

  

  

}

  

],

  

"skipped_locked": [

  

  

{

  

  

  

"rule_id": "000001",

  

  

  

"srg_id": "SRG-APP-000001-CTR-000001",

  

  

  

"reason": "locked"

  

  

}

  

],

  

"warnings": [

  

]

}

POST

/components/{componentId}/preview_spreadsheet_update

Playground

Authorization

cookieAuth

Body

Samples

---

Apply changes from a spreadsheet import

PATCH

/components/{componentId}/apply_spreadsheet_update

Applies rule updates from an uploaded spreadsheet (CSV/XLSX) to the component. Requires admin role on the component. Use the preview endpoint first to review changes before applying. Creates audit trail entries for each modified rule.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Request Body

multipart/form-data

CSV or XLSX spreadsheet file containing rule updates.

Format"binary"

Responses

Spreadsheet changes applied successfully

Content-Type

application/json

{

  

"toast": {

  

  

"title": "Spreadsheet applied.",

  

  

"message": [

  

  

  

"Successfully updated 12 rules from spreadsheet."

  

  

],

  

  

"variant": "success"

  

}

}

PATCH

/components/{componentId}/apply_spreadsheet_update

Playground

Authorization

cookieAuth

Body

Samples

---

Release an SRG component to the catalog

POST

/components/{componentId}/release

Releases an SRG-kind component in one transaction: verifies every live requirement is decided (never Not Yet Determined) and locked, mints the final published identifiers, generates the published SRG XCCDF, creates the catalog SecurityRequirementsGuide entry with its columns derived from that document, copies the published requirements onto the entry, and flags the component released. The released entry behaves exactly like an uploaded SRG — new components can base on it immediately. Requires the author role on the component. STIG readiness components do not use this endpoint (their release is the released flag on component update).

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Responses

Component released and attached to the catalog

Content-Type

application/json

{

  

"toast": {

  

  

"title": "Component released.",

  

  

"message": [

  

  

  

"Container Best Practice SRG - Ver 1, Rel 1 is now in the SRG catalog."

  

  

],

  

  

"variant": "success"

  

},

  

"catalog_srg": {

  

  

"id": 42,

  

  

"srg_id": "Container_Best_Practice_SRG",

  

  

"version": "V1R1",

  

  

"name": "Container Best Practice SRG - Ver 1, Rel 1"

  

},

  

"changelog": {

  

  

"version": "V1R1",

  

  

"removals": [

  

  

],

  

  

"text": "Container Best Practice SRG V1R1 — Release Changelog No requirements were removed in this release."

  

}

}

POST

/components/{componentId}/release

Playground

Authorization

cookieAuth

Samples

---

Bulk export multiple released components

GET

/components/bulk_export/{type}

Exports multiple released components as a single download in the specified format. Component IDs are passed as a comma-separated query parameter. Returns a binary file (zip for multiple components). Returns a JSON error toast if the export type is unsupported or no component IDs are provided.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Parameters

Query Parameters

component_ids*

Comma-separated list of released component IDs to export.

Type

string

Required

Example"29,30,31"

Responses

Binary file download

Content-Type

GET

/components/bulk_export/{type}

Playground

Authorization

cookieAuth

Variables

Key

Value

component_ids*

Samples

---

Side-by-side rule comparison between two peer components

GET

/api/components/compare

Compares rules between a base (older) and diff (newer) component sharing the same SRG. Returns a rule-by-rule diff keyed by field name, with metadata about both components. Used by the DiffViewer stepper in the component editor. Requires authentication and access to both components.

Authorizations

cookieAuth

Type

API Key (cookie: _vulcan_session)

or

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type

HTTP (token)

Parameters

Query Parameters

base_id*

ID of the base (older) component to compare from.

Type

integer

Required

Example29

diff_id*

ID of the diff (newer) component to compare against.

Type

integer

Required

Example30

Responses

Rule-by-rule diff with metadata envelope

Content-Type

application/json

{

  

"data": {

  

  

"000050": {

  

  

  

"base": "control 'CNTR-00-000050' do title 'Container images must be signed' end",

  

  

  

"diff": "control 'CNTR-00-000050' do title 'Container images must be signed and verified' end",

  

  

  

"changed": true

  

  

},

  

  

"000051": {

  

  

  

"base": "control 'CNTR-00-000051' do title 'Approved registries only' end",

  

  

  

"diff": "control 'CNTR-00-000051' do title 'Approved registries only' end",

  

  

  

"changed": false

  

  

}

  

},

  

"meta": {

  

  

"base_id": 29,

  

  

"diff_id": 30,

  

  

"rules_count": 264

  

}

}

GET

/api/components/compare

Playground

Authorization

cookieAuth

Variables

Key

Value

base_id*

diff_id*

Samples

---

Powered by VitePress OpenAPI