Lock all unlocked rules in a component
POST
/components/{componentId}/lock
Locks every currently-unlocked rule in the component, preventing further edits. Requires component-admin authority. Already-locked rules are unaffected.
Authorizations
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
application/json
JSON "review": { "action": "lock_control", "comment": "Locking for DISA submission review." }
{
}
Responses
Lockable rules locked. Rules with incomplete data are SKIPPED, not failed — Not Yet Determined without satisfactions, Does Not Meet without mitigations, Inherently Meets without an artifact description — and each skip is named in a warning line appended to the message (variant becomes warning).
application/json
JSON "toast": { "title": "Locked 2 controls.", "message": [ "Locked: CNTR-00-000001, CNTR-00-000002" ], "variant": "success" }
{
}