Appearance
App shell navigation data
GET
/api/navigation
Returns navbar links, pending access request notifications, and locked user alerts for the authenticated user. Used by the SPA app shell on every page load after authentication.
Authorizations
cookieAuth
Type
API Key (cookie: _vulcan_session)
or
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
Navigation data for app shell
application/json
JSON "nav_links": [ { "icon": "folder2-open", "name": "Projects", "link": "/projects" }, { "icon": "patch-check-fill", "name": "Released Components", "link": "/components" } ], "access_requests": [ { "id": 1, "user": { "id": 42, "name": "Jane Doe", "email": "jane@example.com" }, "project": { "id": 7, "name": "RHEL 9 STIG" } } ], "locked_users": [ { "id": 99, "name": "Locked User", "email": "locked@example.com" } ]
{
}
Public pre-auth UI configuration
GET
/api/settings
Returns application settings needed before authentication: banner, consent modal, auth provider flags, password policy, and registration status. No authentication required — the login page and consent banner need this data before the user signs in.
Responses
Public settings for SPA pre-auth UI
application/json
JSON "banner": { "enabled": true, "text": "UNCLASSIFIED", "background_color": "#007a33", "text_color": "#ffffff" }, "consent": { "enabled": false, "version": 1, "title": "Terms of Use", "content": "", "ttl": 0 }, "local_login": { "enabled": true }, "user_registration": { "enabled": true }, "ldap": { "enabled": false, "title": null }, "oidc": { "enabled": false, "title": null }, "smtp": { "enabled": false }, "password": { "min_length": 15, "min_uppercase": 2, "min_lowercase": 2, "min_number": 2, "min_special": 2 }, "lockout": { "enabled": true, "maximum_attempts": 3, "last_attempt_warning": true }
{
}
Application version and metadata
GET
/api/version
Returns the application name, version, Rails version, Ruby version, and environment. No authentication required — used by monitoring tools, deployment verification scripts, and the frontend health check.
Responses
Version and runtime metadata
application/json
JSON "name": "Vulcan", "version": "2.4.1", "rails": "8.1.3.1", "ruby": "3.4.10", "environment": "production"
{
}
Acknowledge consent banner (AC-8)
POST
/consent/acknowledge
Records the user's acknowledgment of the system consent banner in the Rails session. Required by NIST AC-8 before interacting with the application. Does not require authentication — the consent modal appears before login.
Responses
Consent acknowledged (timestamp stored in session)