REST API

Build release evidence into your workflow.

Name: Vybentis
Brand: Vybentis

Start approved scans, read deterministic findings and verify a change through one versioned, tenant scoped API.

Explore the resource map Use MCP and CLI

Request lifecycle

One contract from token to verification.

Web, REST, CLI and MCP share authorization, rule identity and finding state.

Authenticate

Scoped bearer token and organization context.

Authorize

Target confirmation is bound server side.

Scan

One idempotent request creates one attempt.

Read

Stable error codes and structured findings.

Verify

The same rule is checked again in scope.

Implemented MVP resources

The core endpoints at a glance.

The versioned OpenAPI file remains canonical. Planned extensions are not presented as available.

POST/projects/{project_id}/scansCreate a bounded scan

GET/scans/{scan_id}Read status and summary

GET/scans/{scan_id}/findingsFilter deterministic findings

GET/findings/{finding_id}Read evidence and remediation

POST/findings/{finding_id}/verifyRequest scoped verification

GET/scans/{scan_id}/reports/{format}Download a sealed report

Strict request

Retry safe, bounded and explicitly authorized.

Idempotency-KeyPrevents duplicate scans on exact retries.

X-Vybentis-Organization-IdBinds every request to tenant context.

target_authorization_confirmedAccepts only the literal JSON value true.

create-scan.sh

curl --request POST \ /v1/projects/$PROJECT_ID/scans \ --header "Authorization: Bearer $TOKEN" \ --header "Idempotency-Key: scan-0001" \ --data '{"url":"https://example.com",
"locale":"en",
"target_authorization_confirmed":true}'

Response contract

Clear results. Safe failures.

Findings stay structured

Rule ID, evidence, severity, confidence and remediation remain machine readable.

Unknown stays unknown

Partial coverage is not converted into a complete score or pass.

Errors reveal no secrets

No internal addresses, secret excerpts, stack traces or provider bodies.

Common questions

The important boundary, answered directly.

The base path is /v1. API version and rule pack version are separate, so evidence can retain the exact rules that produced it.

Next step

Bring API evidence into your agent.

MCP exposes the same rules and findings as a small, typed tool set.

Explore MCP and CLI