Appearance
List projects with pagination, search, and sorting
GET
/api/projects
Paginated project listing for SPA consumption. Supports substring search over name and description, whitelist-validated sorting, and pagy-backed pagination (default 25 per page, maximum 100). Unknown sort fields are silently ignored. Requires authentication. Returns 400 when the requested page is out of range. Timestamps on this endpoint are ISO 8601 (render_as_json path), unlike the string-rendered project pages.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Query Parameters
q
Case-insensitive substring filter matched against project name and description.
Type
string
Example
"Photon"sort
Sort field. Unknown fields are silently ignored.
Type
string
Valid values
"name""created_at""updated_at"Example
"name"order
Sort direction. Defaults to asc when sort is applied.
Type
string
Valid values
"asc""desc"Example
"asc"page
Page number (1-based). Out-of-range pages return 400.
Type
integer
Example
1per_page
Records per page (default 25, capped at 100).
Type
integer
Example
25Responses
Paginated project rows
application/json
JSON "rows": [ { "id": 34, "name": "Photon 3", "description": null, "visibility": "discoverable", "memberships_count": 2, "admin_name": "Demo Admin", "admin_email": "admin@example.org", "created_at": "2026-05-30T14:06:03.797Z", "updated_at": "2026-05-30T14:06:28.292Z" } ], "pagination": { "page": 1, "per_page": 25, "total": 1 }
{
}
Get rule statistics for a project
GET
/api/projects/{id}/stats
Returns rule statistics aggregated across every component in the project plus a per-component breakdown, computed from grouped SQL queries. Requires viewer permission on the project.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Path Parameters
id*
Numeric ID of the project.
Type
Requiredinteger
Example
7Responses
Project rule statistics with per-component breakdown
application/json
JSON "aggregate": { "rules_by_status_by_type": { "stig": { "not_yet_determined": 51, "applicable_configurable": 121, "applicable_inherently_meets": 15, "applicable_does_not_meet": 8, "not_applicable": 10 }, "srg": { "not_yet_determined": 2, "applicable": 1, "not_applicable": 0 } }, "rules_by_severity": { "high": 21, "medium": 176, "low": 11 }, "rule_count": 208, "completion_pct": 74.5, "lock_pct": 12 }, "components": [ { "id": 38, "name": "RHEL 9 Hardened Baseline", "prefix": "RHEL-09", "document_type": "stig", "rule_count": 203, "completion_pct": 75.4, "lock_pct": 12.3 }, { "id": 41, "name": "Photon OS 5 Baseline", "prefix": "PHTN-50", "document_type": "srg", "rule_count": 5, "completion_pct": 40, "lock_pct": 0 } ]
{
}
Get triage summary for a project
GET
/api/projects/{id}/triage_summary
Returns triage metrics aggregated across all of the project's components — top-level comment counts per triage status plus the adjudication percentage. Requires viewer permission on the project.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Path Parameters
id*
Numeric ID of the project.
Type
Requiredinteger
Example
7Responses
Project-wide triage summary
application/json
JSON "by_triage_status": { "pending": 3, "concur": 1, "concur_with_comment": 0, "non_concur": 0, "duplicate": 0, "informational": 1, "needs_clarification": 0, "withdrawn": 0, "addressed_by": 0 }, "total": 5, "adjudicated": 1, "adjudication_pct": 20
{
}
List accessible projects
GET
/projects
Returns all projects the current user can access, including owned projects, member projects, and discoverable projects. Includes membership counts and pending comment counts per project. Requires authentication.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
Projects list
application/json
JSON { "id": 4, "name": "Container Platform", "memberships_count": 14 }, { "id": 1, "name": "Photon 3", "memberships_count": 14 }
[
]
Create a new project
POST
/projects
Creates a new project with the given name and description. The creating user is automatically added as an admin member. Requires authentication.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
application/json
JSON "project": { "name": "Red Hat Enterprise Linux 9", "description": "STIG development for RHEL 9" }
{
}
Responses
Project created
application/json
JSON "toast": { "title": "Project created.", "message": [ "Successfully created project Red Hat Enterprise Linux 9." ], "variant": "success" }, "redirect_url": "/projects/5"
{
}
Project detail with component list and stats
GET
/projects/{projectId}
Returns full project details including components, membership count, comment counts, and project metadata. Requires membership in the project or admin role.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
Project detail with components
application/json
JSON "id": 1, "name": "Photon 3", "memberships_count": 16, "pending_comment_count": 1, "components": [ { "id": 1, "name": "Photon OS 3", "prefix": "PHOS-03" } ]
{
}
Full replacement of project attributes
PUT
/projects/{projectId}
Full replacement — all fields required. Updates the project name, description, or visibility. Requires admin role on the project. Returns a canonical toast response.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
application/json
JSON "project": { "name": "Container Platform v2" }
{
}
Responses
Project updated
application/json
JSON "toast": { "title": "Project updated.", "message": [ "Successfully updated project." ], "variant": "success" }
{
}
Delete a project and all its components
DELETE
/projects/{projectId}
Permanently deletes the project, all its components, rules, reviews, and memberships. Requires admin role on the project. This action cannot be undone. Returns 403 for non-admin users.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
Project deleted
application/json
JSON "toast": { "title": "Project deleted.", "message": [ "Successfully deleted project." ], "variant": "success" }
{
}
Partial update of project attributes
PATCH
/projects/{projectId}
Partial update — send only changed fields. Updates the project name, description, or visibility. Requires admin role on the project. Returns a canonical toast response.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
application/json
JSON "project": { "name": "Container Platform v2" }
{
}
Responses
Project updated
application/json
JSON "toast": { "title": "Project updated.", "message": [ "Successfully updated project." ], "variant": "success" }
{
}
Aggregated comments across all project components
GET
/projects/{projectId}/comments
Returns paginated comments from all components in the project, with triage status counts. Different row shape from component comments — includes component_id/component_name but omits some triage attribution fields. Uses Project#paginated_comments (NOT CommentQueryService).
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Query Parameters
triage_status
Filter comments by triage disposition. Defaults to "pending" — the triage table opens on undispositioned comments. Use "all" to return comments in any status.
Type
string
Valid values
"all""pending""concur""concur_with_comment""non_concur""duplicate""informational""needs_clarification""withdrawn""addressed_by"Example
"pending"Default
"pending"page
Page number for paginated results (1-based).
Type
integer
Example
1Minimum
1Default
1per_page
Number of items to return per page.
Type
integer
Example
25Minimum
1Maximum
1000Default
25section
Filter by requirement section (fixtext, check_content, etc.).
Type
string
Example
"fixtext"component_id
Filter to a specific component within the project.
Type
integer
author_id
Filter by comment author.
Type
integer
q
Text search within comment content.
Type
string
resolved
Filter by resolved state (true/false/all).
Type
string
Valid values
"true""false""all"Example
"false"Responses
Paginated project comment rows with status counts
application/json
JSON "rows": [ { "id": 26, "rule_displayed_name": "PHOS-03-000038", "component_id": 1, "component_name": "Photon OS 3", "triage_status": "pending", "comment": "This requirement needs clarification.", "responses_count": 0, "reactions": { "up": 0, "down": 0, "mine": null } } ], "pagination": { "page": 1, "per_page": 25, "total": 3 }, "status_counts": { "pending": 1, "concur": 1, "informational": 1 }
{
}
Export project data in the specified format
GET
/projects/{projectId}/export/{type}
Exports selected components from the project as CSV, XCCDF XML, InSpec profile, or JSON archive. Supports mode selection (working copy, vendor submission, published STIG) and optional SRG/membership inclusion. Returns a binary file download. Requires project membership.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Query Parameters
component_ids*
Comma-separated IDs of components to include in the export.
Type
Requiredstring
Example
"29,30"mode
Export mode controlling which fields and rules are included.
Type
string
Valid values
"working_copy""vendor_submission""published_stig"Example
"working_copy"include_srg
Include the source SRG in the export package.
Type
string
Valid values
"true"include_memberships
Include project membership data in the export.
Type
string
Valid values
"true""false"exclude_satisfied_by
Exclude rules that are satisfied by another rule.
Type
string
Valid values
"true"Responses
Binary file download (CSV, XML, ZIP, or JSON)
Create a new project from a JSON archive backup
POST
/projects/create_from_backup
Creates a new project by restoring from a JSON archive (.zip). The archive must have been created by the json_archive export. Optionally override the project name. The archived project metadata (project.json) is restored onto the new project. The creating user becomes the project admin. Requires authentication.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
multipart/form-data
JSON archive .zip file from a previous export.
Format
"binary"Override project name. Uses the archived name if omitted.
Responses
Dry-run returns preview (summary + warnings + project_defaults). Real create returns redirect URL + summary + toast.
application/json
JSON "summary": { "dry_run": true, "components_imported": 2, "rules_imported": 264, "component_details": [ { "name": "Photon OS 3", "rule_count": 132 } ] }, "warnings": [ ], "project_defaults": { "name": "My Original Project", "description": "A test project", "visibility": "discoverable" }
{
}
Import a JSON archive backup
POST
/projects/{projectId}/import_backup
Imports components, rules, reviews, and memberships from a JSON archive (.zip) into the project, replacing or augmenting existing content. Returns 200 with a toast + summary. Requires admin role on the project. The archive must have been created by the json_archive export format.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
multipart/form-data
JSON archive .zip file from a previous export.
Format
"binary"Responses
Backup imported (default mode) or dry-run preview completed
application/json
JSON "toast": { "title": "Backup restored.", "message": [ "Backup restored successfully." ], "variant": "success" }, "summary": { "components_imported": 2, "rules_imported": 264, "satisfactions_imported": 12, "reviews_imported": 48, "memberships_imported": 3, "srgs_imported": 1, "component_details": [ { "name": "Photon OS 3", "rule_count": 132, "srg_title": "General Purpose Operating System SRG", "srg_version": "V3R3" } ] }, "warnings": [ ]
{
}
Audit history for the project
GET
/projects/{projectId}/histories
Returns the 50 most recent audit trail entries for the project, including component and rule changes. Used by the project history sidebar. Requires project membership.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
Recent audit entries
application/json
JSON { "id": 500, "auditable_type": "Component", "auditable_id": 38, "action": "update", "name": "Demo Admin", "created_at": "2026-05-28T15:00:00Z", "audited_changes": [ { "field": "released", "prev_value": false, "new_value": true } ] }
[
]
Request access to a project
POST
/projects/{projectId}/project_access_requests
Creates an access request for the current user on the specified project. Project admins are notified via email (if SMTP is enabled). Returns JSON with toast and the new request ID, or an HTML redirect for browser requests. Returns 422 if the user has already requested access.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Path Parameters
projectId*
Numeric ID of the project to request access to.
Type
Requiredinteger
Example
7Responses
Access request created successfully
application/json
JSON "toast": { "title": "Access request submitted.", "message": [ "Your request for access has been sent." ], "variant": "success" }, "id": 42
{
}
Deny or cancel a project access request
DELETE
/projects/{projectId}/project_access_requests/{requestId}
Admins can deny a pending access request; the requesting user can cancel their own request. If SMTP is enabled, a rejection email is sent when an admin denies. Returns JSON with toast and destroyed request ID, or HTML redirect for browser requests.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Path Parameters
projectId*
Numeric ID of the project.
Type
Requiredinteger
Example
7requestId*
Numeric ID of the access request.
Type
Requiredinteger
Example
42Responses
Access request destroyed successfully
application/json
JSON "toast": { "title": "Access request denied.", "message": [ "Successfully denied Jane Doe's request to access project." ], "variant": "success" }, "id": 42
{
}
List triage response templates for a project
GET
/projects/{projectId}/triage_response_templates
Returns all response templates for the specified project, ordered by name. Viewer+ role required. Templates are reusable canned responses that triagers can insert into the response textarea when making triage decisions.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Path Parameters
projectId*
Numeric ID of the project.
Type
Requiredinteger
Example
42Responses
List of templates
application/json
JSON "triage_response_templates": [ { "id": 1, "name": "Accept - standard", "body": "Concur with the finding as written.", "created_by_id": 42, "created_at": "2026-06-01T10:00:00Z" } ]
{
}
Create a triage response template
POST
/projects/{projectId}/triage_response_templates
Creates a new reusable response template for the project. Admin role required. Template names must be unique within the project (case-insensitive).
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Path Parameters
projectId*
Numeric ID of the project.
Type
Requiredinteger
Example
42Request Body
application/json
JSON "triage_response_template": { "name": "Decline - needs evidence", "body": "Unable to incorporate without supporting evidence." }
{
}
Responses
Template created
application/json
JSON "triage_response_template": { "id": 3, "name": "Decline - needs evidence", "body": "Unable to incorporate without supporting evidence.", "created_by_id": 42, "created_at": "2026-06-03T01:00:00Z" }
{
}
Replace a triage response template
PUT
/projects/{projectId}/triage_response_templates/{id}
Full replacement of an existing template. Same behavior as PATCH. Admin role required.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Path Parameters
projectId*
Numeric ID of the project.
Type
Requiredinteger
Example
42id*
Numeric ID of the template.
Type
Requiredinteger
Example
1Request Body
application/json
JSON "triage_response_template": { "name": "Accept - standard", "body": "Concur with the finding as written." }
{
}
Responses
Template replaced
application/json
JSON "triage_response_template": { "id": 1, "name": "Accept - standard", "body": "Concur with the finding as written. No changes needed.", "created_by_id": 42, "created_at": "2026-06-03T01:00:00Z" }
{
}
Delete a triage response template
DELETE
/projects/{projectId}/triage_response_templates/{id}
Permanently deletes a response template. Admin role required. Returns 204 No Content on success.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Path Parameters
projectId*
Numeric ID of the project.
Type
Requiredinteger
Example
42id*
Numeric ID of the template.
Type
Requiredinteger
Example
1Responses
Template deleted
Update a triage response template
PATCH
/projects/{projectId}/triage_response_templates/{id}
Updates an existing response template. Admin role required. Name uniqueness is enforced within the project.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Path Parameters
projectId*
Numeric ID of the project.
Type
Requiredinteger
Example
42id*
Numeric ID of the template.
Type
Requiredinteger
Example
1Request Body
application/json
JSON "triage_response_template": { "name": "Accept - updated", "body": "Updated response text." }
{
}
Responses
Template updated
application/json
JSON "triage_response_template": { "id": 1, "name": "Accept - standard", "body": "Concur with the finding as written. No changes needed.", "created_by_id": 42, "created_at": "2026-06-03T01:00:00Z" }
{
}