STIG detail with rules and metadata
GET
/stigs/{id}
Returns full STIG details including title, version, benchmark date, description, severity counts, and all embedded rules with DISA metadata and check content. Requires authentication. Used by the STIG detail page (BenchmarkViewer).
Authorizations
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Responses
STIG detail with nested rules
application/json
JSON "id": 1, "stig_id": "Application_Security_Development_STIG", "name": "Application Security Development STIG - Ver 6, Rel 4", "title": "Application Security and Development Security Technical Implementation Guide", "version": "V6R4", "benchmark_date": "2025-10-01", "severity_counts": { "high": 34, "medium": 230, "low": 22 }, "description": "This Security Technical Implementation Guide is published...", "stig_rules": [ { "id": 660, "rule_id": "SV-222387r960735_rule", "title": "The application must limit logon sessions...", "version": "APSC-DV-000010", "rule_severity": "medium" } ]
{
}