Appearance
Search across all resource types
GET
/api/search/global
Searches projects, components, rules, SRGs, and STIGs by name or title. Results are grouped by type and limited per group. Project results cover everything the caller can discover (memberships plus discoverable projects); component and rule content is served only from the caller's memberships and released components; SRG/STIG results and the srg_rules requirement catalog are instance-global. The rules group covers both document kinds — stig rules and authored SRG requirements — and can be scoped to a specific component via the component_id parameter. Requires authentication — returns 401 if not signed in.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Query Parameters
q*
Search query string (minimum 2 characters).
Type
Requiredstring
Example
"container platform"Min Length
2limit
Maximum results per resource type.
Type
integer
Example
5Minimum
1Maximum
20Default
5component_id
Scope rule search to a specific component.
Type
integer
Example
29Responses
Search results grouped by type
application/json
JSON "projects": [ { "id": 4, "name": "Container Platform" } ], "components": [ { "id": 29, "name": "Container SRG" } ], "rules": [ ], "stig_rules": [ ], "srg_rules": [ ], "srgs": [ { "id": 1, "title": "Container Platform Security Requirements Guide" } ], "stigs": [ ]
{
}
Search users by name or email
GET
/api/users/search
Searches user accounts by name or email address. Used by the membership assignment UI to find users to add to projects. Requires authentication.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Query Parameters
q*
Search query string (minimum 2 characters).
Type
Requiredstring
Example
"container platform"Min Length
2membership_type*
Type of resource to search members for.
Type
Requiredstring
Valid values
"Project""Component"Example
"Project"membership_id*
ID of the project or component to search members for.
Type
Requiredinteger
Example
1scope
Search scope. Default searches non-members (for "add member" flow, admin only). "members" searches existing members (for PoC selection, any member).
Type
string
Valid values
"members"Example
"members"limit
Maximum number of results (1-25, default 10).
Type
integer
Example
10Minimum
1Maximum
25Responses
Matching users
application/json
JSON "users": [ { "id": 42, "name": "Jane Doe", "email": "jane.doe@example.org" } ]
{
}
Legacy requirement search by SRG version
GET
/search/rules
Searches requirement rows of both document kinds — stig rules and authored SRG requirements — by version identifier. Scoped to components the user can access: project or component membership, or released components; admins are unrestricted. Returns compact tuples [id, rule_id, component_id, prefix]. Requires authentication. This is a legacy search endpoint — prefer /api/search/global for new integrations.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Query Parameters
q*
SRG version identifier to search for.
Type
Requiredstring
Example
"SRG-OS-000001-GPOS-00001"Responses
Matching rules as compact tuples
application/json
JSON "rules": [ [ 1786, "000001", 1, "PHOS-03" ], [ 2500, "000001", 5, "CNTR-01" ] ]
{
}
Legacy component search by SRG ID
GET
/search/components
Searches components by the SRG identifier they are based on. Scoped to components the user can access: project or component membership, or released components; admins are unrestricted. Returns compact tuples [id, name]. This is a legacy search endpoint — prefer /api/search/global for new integrations.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Query Parameters
q*
SRG identifier to search for.
Type
Requiredstring
Example
"Container_Platform_SRG"Responses
Matching components as compact tuples
application/json
JSON "components": [ [ 1, "Photon OS 3" ], [ 8, "Container Platform" ] ]
{
}
Legacy project search by SRG ID
GET
/search/projects
Searches projects that have components based on a given SRG. Returns compact tuples [id, name]. This is a legacy search endpoint — prefer /api/search/global for new integrations.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Parameters
Query Parameters
q*
SRG identifier to search for.
Type
Requiredstring
Example
"Container_Platform_SRG"Responses
Matching projects as compact tuples
application/json
JSON "projects": [ [ 4, "Container Platform" ] ]
{
}