Signals API Reference

Operations

GET /api/v1/buildinfo

API alias for /buildinfo.json (same payload).

Responses:

POST /api/v1/runtime/observations

Responses:

POST /api/v1/score/evaluate

Compute unified score

Evaluates a unified trust score combining EWS computation with Determinization entropy.

Parameters:

Responses:

GET /api/v1/score/explain/{digest}

Get score explanation by digest

Retrieves a deterministic score explanation contract for an existing score digest.

Parameters:

Responses:

GET /api/v1/score/history

Get score history

Retrieves score computation history for a CVE, optionally filtered by purl.

Parameters:

Responses:

POST /api/v1/score/verify

Verify score replay

Verifies a replay envelope by re-executing the score computation and comparing results. This HTTP path checks signature fields structurally only; it does not establish cryptographic signature or Rekor authenticity.

Responses:

GET /api/v1/score/weights

List weight manifests

Lists all available EWS weight manifests.

Responses:

GET /api/v1/score/weights/effective

Get effective weight manifest

Retrieves the effective EWS weight manifest for a given date.

Parameters:

Responses:

GET /api/v1/score/weights/{version}

Get weight manifest

Retrieves a specific EWS weight manifest by version.

Parameters:

Responses:

GET /api/v1/score/{scoreId}

Get score by ID

Retrieves a previously computed score by its unique identifier.

Parameters:

Responses:

GET /api/v1/score/{scoreId}/replay

Get score replay envelope

Retrieves the DSSE-shaped replay envelope for a previously computed score, enabling deterministic comparison by auditors. The current producer does not sign the envelope or attach a Rekor inclusion proof.

Parameters:

Responses:

GET /api/v1/signals

Parameters:

Responses:

GET /api/v1/signals/stats

Responses:

GET /buildinfo.json

Image build provenance (module, gitSha, gitCommitTime, imageBuiltAt, branch) for drift detection.

Responses:

GET /readyz

Responses:

POST /signals/beacons

Responses:

GET /signals/beacons/rate/{artifactId}/{environmentId}

Parameters:

Responses:

POST /signals/callgraphs

Responses:

GET /signals/callgraphs/{callgraphId}

Parameters:

Responses:

GET /signals/callgraphs/{callgraphId}/manifest

Parameters:

Responses:

POST /signals/execution-evidence

Responses:

GET /signals/facts/{subjectKey}

Parameters:

Responses:

GET /signals/ping

Responses:

POST /signals/reachability/recompute

Responses:

POST /signals/reachability/union

Parameters:

Responses:

GET /signals/reachability/union/{analysisId}/files/{fileName}

Parameters:

Responses:

GET /signals/reachability/union/{analysisId}/meta

Parameters:

Responses:

POST /signals/runtime-facts

Responses:

POST /signals/runtime-facts/ndjson

Parameters:

Responses:

POST /signals/runtime-facts/synthetic

Responses:

GET /signals/status

Responses:

GET /signals/unknowns

Parameters:

Responses:

POST /signals/unknowns

Responses:

GET /signals/unknowns/{id}/explain

Parameters:

Responses:

GET /signals/unknowns/{subjectKey}

Parameters:

Responses:

POST /webhooks/gitea

Inbound webhook endpoint for Gitea events. Validates the X-Hub-Signature-256 HMAC signature (falls back to X-Hub-Signature), extracts the event type and delivery ID, and dispatches the payload for scan and SBOM trigger evaluation. Returns 202 Accepted on success.

Responses:

POST /webhooks/github

Inbound webhook endpoint for GitHub events. Validates the X-Hub-Signature-256 HMAC signature, extracts the event type and delivery ID, and dispatches the payload to the SCM webhook service for scan and SBOM trigger evaluation. Returns 202 Accepted on success.

Responses:

POST /webhooks/gitlab

Inbound webhook endpoint for GitLab events. Validates the X-Gitlab-Token header, extracts the event UUID and type, and dispatches the payload for scan and SBOM trigger evaluation. Returns 202 Accepted on success.

Responses: