Signals API Reference

Operations

GET /api/v1/buildinfo

API alias for /buildinfo.json (same payload).

Responses:

POST /api/v1/runtime/observations

Responses:

POST /api/v1/score/evaluate

Compute unified score

Evaluates a unified trust score combining EWS computation with Determinization entropy.

Parameters:

Responses:

GET /api/v1/score/explain/{digest}

Get score explanation by digest

Retrieves a deterministic score explanation contract for an existing score digest.

Parameters:

Responses:

GET /api/v1/score/history

Get score history

Retrieves score computation history for a CVE, optionally filtered by purl.

Parameters:

Responses:

POST /api/v1/score/verify

Verify score replay

Verifies a replay envelope by re-executing the score computation and comparing results. This HTTP path checks signature fields structurally only; it does not establish cryptographic signature or Rekor authenticity.

Responses:

GET /api/v1/score/weights

List weight manifests

Lists all available EWS weight manifests.

Responses:

GET /api/v1/score/weights/effective

Get effective weight manifest

Retrieves the effective EWS weight manifest for a given date.

Parameters:

Responses:

GET /api/v1/score/weights/{version}

Get weight manifest

Retrieves a specific EWS weight manifest by version.

Parameters:

Responses:

GET /api/v1/score/{scoreId}

Get score by ID

Retrieves a previously computed score by its unique identifier.

Parameters:

Responses:

GET /api/v1/score/{scoreId}/replay

Get score replay envelope

Retrieves the DSSE-shaped replay envelope for a previously computed score, enabling deterministic comparison by auditors. The current producer does not sign the envelope or attach a Rekor inclusion proof.

Parameters:

Responses:

GET /api/v1/signals

Parameters:

Responses:

GET /api/v1/signals/stats

Responses:

GET /buildinfo.json

Image build provenance (module, gitSha, gitCommitTime, imageBuiltAt, branch) for drift detection.

Responses:

GET /doctor/signals/checks

Responses:

GET /readyz

Responses:

POST /signals/beacons

Responses:

GET /signals/beacons/rate/{artifactId}/{environmentId}

Parameters:

Responses:

POST /signals/callgraphs

Responses:

GET /signals/callgraphs/{callgraphId}

Parameters:

Responses:

GET /signals/callgraphs/{callgraphId}/manifest

Parameters:

Responses:

POST /signals/execution-evidence

Responses:

GET /signals/facts/{subjectKey}

Parameters:

Responses:

GET /signals/ping

Responses:

POST /signals/reachability/recompute

Responses:

POST /signals/reachability/union

Parameters:

Responses:

GET /signals/reachability/union/{analysisId}/files/{fileName}

Parameters:

Responses:

GET /signals/reachability/union/{analysisId}/meta

Parameters:

Responses:

POST /signals/runtime-facts

Responses:

POST /signals/runtime-facts/ndjson

Parameters:

Responses:

POST /signals/runtime-facts/synthetic

Responses:

GET /signals/status

Responses:

GET /signals/unknowns

Parameters:

Responses:

POST /signals/unknowns

Responses:

GET /signals/unknowns/{id}/explain

Parameters:

Responses:

GET /signals/unknowns/{subjectKey}

Parameters:

Responses:

POST /webhooks/gitea

Inbound webhook endpoint for Gitea events. Validates the X-Hub-Signature-256 HMAC signature (falls back to X-Hub-Signature), extracts the event type and delivery ID, and maps the event. Answers 501 problem+json with code source_scan_not_available for an event that would trigger a scan, or sbom_ingest_not_available for one that would trigger an SBOM ingest: Signals dispatches neither (Scanner quarantines source-triggered scanning). An event that triggers nothing answers 200.

Responses:

POST /webhooks/github

Inbound webhook endpoint for GitHub events. Validates the X-Hub-Signature-256 HMAC signature, extracts the event type and delivery ID, and maps the event. Answers 501 problem+json with code source_scan_not_available for an event that would trigger a scan, or sbom_ingest_not_available for one that would trigger an SBOM ingest: Signals dispatches neither (Scanner quarantines source-triggered scanning). An event that triggers nothing answers 200.

Responses:

POST /webhooks/gitlab

Inbound webhook endpoint for GitLab events. Validates the X-Gitlab-Token header, extracts the event UUID and type, and maps the event. Answers 501 problem+json with code source_scan_not_available for an event that would trigger a scan, or sbom_ingest_not_available for one that would trigger an SBOM ingest: Signals dispatches neither (Scanner quarantines source-triggered scanning). An event that triggers nothing answers 200.

Responses: