VEX Evidence through Owner APIs
Source-verified against commit
2021a48f6e(2026-10-05). Re-verify the named source contracts before applying this description to an installation. Re-verify:git show HEAD:src/Vulnerabilities/StellaOps.Vulnerabilities.WebService/Program.cs.
Clients reach owner routes through the gateway. The former draft /vex/statements proxy surface and the retired Excititor/VexLens hosts are not the current API contract.
Statements and provenance
| Method and route | Scope | Result |
|---|---|---|
GET /api/vulnerabilities/v1/issues/{vulnerabilityId}/{productKey}/facts | advisory:read | Live statements, issuer identities, justification and applicability. |
GET /api/vulnerabilities/v1/facts/{factId}/evidence | advisory:read | Provenance and source evidence for the fact. |
POST /api/vulnerabilities/v1/issuers/{issuerId}/vex | vuln:submit, plus configured issuer/client/key admission | Signed OpenVEX DSSE ingestion. |
Encode each route segment, including the versionless product key. Retain the exact fact identity and source evidence when explaining an outcome.
Tenant result
POST /api/policy/vex/effective-status requires policy:read and an authenticated tenant. It returns the projected effective status, justification, winning issuers, conflict flag, overlay flag and decision hash for a batch of issues.
Findings owns tenant decisions at /api/findings/v1/vex-decisions; its machine-only overlay feed carries those decisions to Policy. A global hub statement read is distinct from the tenant’s effective decision.
See the consensus runbook and Vulnerabilities architecture.
The earlier design is frozen history. It does not describe the current runtime.