2170a58734
Some checks failed
Lighthouse CI / Lighthouse Audit (push) Waiting to run
Lighthouse CI / Axe Accessibility Audit (push) Waiting to run
Manifest Integrity / Validate Schema Integrity (push) Waiting to run
Manifest Integrity / Validate Contract Documents (push) Waiting to run
Manifest Integrity / Validate Pack Fixtures (push) Waiting to run
Manifest Integrity / Audit SHA256SUMS Files (push) Waiting to run
Manifest Integrity / Verify Merkle Roots (push) Waiting to run
Policy Lint & Smoke / policy-lint (push) Waiting to run
Policy Simulation / policy-simulate (push) Waiting to run
Docs CI / lint-and-preview (push) Has been cancelled
Export Center CI / export-ci (push) Has been cancelled
Findings Ledger CI / build-test (push) Has been cancelled
Findings Ledger CI / migration-validation (push) Has been cancelled
Findings Ledger CI / generate-manifest (push) Has been cancelled
- Implemented tests for Cryptographic Failures (A02) to ensure proper handling of sensitive data, secure algorithms, and key management. - Added tests for Security Misconfiguration (A05) to validate production configurations, security headers, CORS settings, and feature management. - Developed tests for Authentication Failures (A07) to enforce strong password policies, rate limiting, session management, and MFA support. - Created tests for Software and Data Integrity Failures (A08) to verify artifact signatures, SBOM integrity, attestation chains, and feed updates.
435 lines
9.8 KiB
YAML
435 lines
9.8 KiB
YAML
openapi: 3.1.0
|
|
info:
|
|
title: StellaOps Evidence & Decision API
|
|
description: |
|
|
REST API for evidence retrieval and decision recording.
|
|
Sprint: SPRINT_3602_0001_0001
|
|
version: 1.0.0
|
|
license:
|
|
name: AGPL-3.0-or-later
|
|
url: https://www.gnu.org/licenses/agpl-3.0.html
|
|
|
|
servers:
|
|
- url: /v1
|
|
description: API v1
|
|
|
|
security:
|
|
- bearerAuth: []
|
|
|
|
paths:
|
|
/alerts:
|
|
get:
|
|
operationId: listAlerts
|
|
summary: List alerts with filtering and pagination
|
|
tags:
|
|
- Alerts
|
|
parameters:
|
|
- name: band
|
|
in: query
|
|
schema:
|
|
type: string
|
|
enum: [critical, high, medium, low, info]
|
|
- name: severity
|
|
in: query
|
|
schema:
|
|
type: string
|
|
- name: status
|
|
in: query
|
|
schema:
|
|
type: string
|
|
enum: [open, acknowledged, resolved, suppressed]
|
|
- name: artifactId
|
|
in: query
|
|
schema:
|
|
type: string
|
|
- name: vulnId
|
|
in: query
|
|
schema:
|
|
type: string
|
|
- name: componentPurl
|
|
in: query
|
|
schema:
|
|
type: string
|
|
- name: limit
|
|
in: query
|
|
schema:
|
|
type: integer
|
|
default: 50
|
|
maximum: 500
|
|
- name: offset
|
|
in: query
|
|
schema:
|
|
type: integer
|
|
default: 0
|
|
responses:
|
|
'200':
|
|
description: Alert list
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/AlertListResponse'
|
|
'400':
|
|
$ref: '#/components/responses/BadRequest'
|
|
'401':
|
|
$ref: '#/components/responses/Unauthorized'
|
|
|
|
/alerts/{alertId}:
|
|
get:
|
|
operationId: getAlert
|
|
summary: Get alert details
|
|
tags:
|
|
- Alerts
|
|
parameters:
|
|
- $ref: '#/components/parameters/alertId'
|
|
responses:
|
|
'200':
|
|
description: Alert details
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/AlertSummary'
|
|
'404':
|
|
$ref: '#/components/responses/NotFound'
|
|
|
|
/alerts/{alertId}/evidence:
|
|
get:
|
|
operationId: getAlertEvidence
|
|
summary: Get evidence bundle for an alert
|
|
tags:
|
|
- Evidence
|
|
parameters:
|
|
- $ref: '#/components/parameters/alertId'
|
|
responses:
|
|
'200':
|
|
description: Evidence payload
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/EvidencePayloadResponse'
|
|
'404':
|
|
$ref: '#/components/responses/NotFound'
|
|
|
|
/alerts/{alertId}/decisions:
|
|
post:
|
|
operationId: recordDecision
|
|
summary: Record a decision for an alert
|
|
tags:
|
|
- Decisions
|
|
parameters:
|
|
- $ref: '#/components/parameters/alertId'
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/DecisionRequest'
|
|
responses:
|
|
'201':
|
|
description: Decision recorded
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/DecisionResponse'
|
|
'404':
|
|
$ref: '#/components/responses/NotFound'
|
|
'400':
|
|
$ref: '#/components/responses/BadRequest'
|
|
|
|
/alerts/{alertId}/audit:
|
|
get:
|
|
operationId: getAlertAudit
|
|
summary: Get audit timeline for an alert
|
|
tags:
|
|
- Audit
|
|
parameters:
|
|
- $ref: '#/components/parameters/alertId'
|
|
responses:
|
|
'200':
|
|
description: Audit timeline
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/AuditTimelineResponse'
|
|
'404':
|
|
$ref: '#/components/responses/NotFound'
|
|
|
|
/alerts/{alertId}/bundle:
|
|
get:
|
|
operationId: downloadAlertBundle
|
|
summary: Download evidence bundle as tar.gz
|
|
tags:
|
|
- Bundles
|
|
parameters:
|
|
- $ref: '#/components/parameters/alertId'
|
|
responses:
|
|
'200':
|
|
description: Evidence bundle file
|
|
content:
|
|
application/gzip:
|
|
schema:
|
|
type: string
|
|
format: binary
|
|
'404':
|
|
$ref: '#/components/responses/NotFound'
|
|
|
|
/alerts/{alertId}/bundle/verify:
|
|
post:
|
|
operationId: verifyAlertBundle
|
|
summary: Verify evidence bundle integrity
|
|
tags:
|
|
- Bundles
|
|
parameters:
|
|
- $ref: '#/components/parameters/alertId'
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/BundleVerificationRequest'
|
|
responses:
|
|
'200':
|
|
description: Verification result
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/BundleVerificationResponse'
|
|
'404':
|
|
$ref: '#/components/responses/NotFound'
|
|
|
|
components:
|
|
securitySchemes:
|
|
bearerAuth:
|
|
type: http
|
|
scheme: bearer
|
|
bearerFormat: JWT
|
|
|
|
parameters:
|
|
alertId:
|
|
name: alertId
|
|
in: path
|
|
required: true
|
|
schema:
|
|
type: string
|
|
description: Alert identifier
|
|
|
|
responses:
|
|
BadRequest:
|
|
description: Bad request
|
|
content:
|
|
application/problem+json:
|
|
schema:
|
|
$ref: '#/components/schemas/ProblemDetails'
|
|
Unauthorized:
|
|
description: Unauthorized
|
|
NotFound:
|
|
description: Resource not found
|
|
|
|
schemas:
|
|
AlertListResponse:
|
|
type: object
|
|
required:
|
|
- items
|
|
- total_count
|
|
properties:
|
|
items:
|
|
type: array
|
|
items:
|
|
$ref: '#/components/schemas/AlertSummary'
|
|
total_count:
|
|
type: integer
|
|
next_page_token:
|
|
type: string
|
|
|
|
AlertSummary:
|
|
type: object
|
|
required:
|
|
- alert_id
|
|
- artifact_id
|
|
- vuln_id
|
|
- severity
|
|
- band
|
|
- status
|
|
- created_at
|
|
properties:
|
|
alert_id:
|
|
type: string
|
|
artifact_id:
|
|
type: string
|
|
vuln_id:
|
|
type: string
|
|
component_purl:
|
|
type: string
|
|
severity:
|
|
type: string
|
|
band:
|
|
type: string
|
|
enum: [critical, high, medium, low, info]
|
|
status:
|
|
type: string
|
|
enum: [open, acknowledged, resolved, suppressed]
|
|
score:
|
|
type: number
|
|
format: double
|
|
created_at:
|
|
type: string
|
|
format: date-time
|
|
updated_at:
|
|
type: string
|
|
format: date-time
|
|
decision_count:
|
|
type: integer
|
|
|
|
EvidencePayloadResponse:
|
|
type: object
|
|
required:
|
|
- alert_id
|
|
properties:
|
|
alert_id:
|
|
type: string
|
|
reachability:
|
|
$ref: '#/components/schemas/EvidenceSection'
|
|
callstack:
|
|
$ref: '#/components/schemas/EvidenceSection'
|
|
vex:
|
|
$ref: '#/components/schemas/EvidenceSection'
|
|
|
|
EvidenceSection:
|
|
type: object
|
|
properties:
|
|
data:
|
|
type: object
|
|
hash:
|
|
type: string
|
|
source:
|
|
type: string
|
|
|
|
DecisionRequest:
|
|
type: object
|
|
required:
|
|
- decision
|
|
- rationale
|
|
properties:
|
|
decision:
|
|
type: string
|
|
enum: [accept_risk, mitigate, suppress, escalate]
|
|
rationale:
|
|
type: string
|
|
minLength: 10
|
|
maxLength: 2000
|
|
justification_code:
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
|
|
DecisionResponse:
|
|
type: object
|
|
required:
|
|
- decision_id
|
|
- alert_id
|
|
- decision
|
|
- recorded_at
|
|
properties:
|
|
decision_id:
|
|
type: string
|
|
alert_id:
|
|
type: string
|
|
decision:
|
|
type: string
|
|
rationale:
|
|
type: string
|
|
recorded_at:
|
|
type: string
|
|
format: date-time
|
|
recorded_by:
|
|
type: string
|
|
replay_token:
|
|
type: string
|
|
|
|
AuditTimelineResponse:
|
|
type: object
|
|
required:
|
|
- alert_id
|
|
- events
|
|
- total_count
|
|
properties:
|
|
alert_id:
|
|
type: string
|
|
events:
|
|
type: array
|
|
items:
|
|
$ref: '#/components/schemas/AuditEvent'
|
|
total_count:
|
|
type: integer
|
|
|
|
AuditEvent:
|
|
type: object
|
|
required:
|
|
- event_id
|
|
- event_type
|
|
- timestamp
|
|
properties:
|
|
event_id:
|
|
type: string
|
|
event_type:
|
|
type: string
|
|
timestamp:
|
|
type: string
|
|
format: date-time
|
|
actor:
|
|
type: string
|
|
details:
|
|
type: object
|
|
replay_token:
|
|
type: string
|
|
|
|
BundleVerificationRequest:
|
|
type: object
|
|
required:
|
|
- bundle_hash
|
|
properties:
|
|
bundle_hash:
|
|
type: string
|
|
description: SHA-256 hash of the bundle
|
|
signature:
|
|
type: string
|
|
description: Optional DSSE signature
|
|
|
|
BundleVerificationResponse:
|
|
type: object
|
|
required:
|
|
- alert_id
|
|
- is_valid
|
|
- verified_at
|
|
properties:
|
|
alert_id:
|
|
type: string
|
|
is_valid:
|
|
type: boolean
|
|
verified_at:
|
|
type: string
|
|
format: date-time
|
|
signature_valid:
|
|
type: boolean
|
|
hash_valid:
|
|
type: boolean
|
|
chain_valid:
|
|
type: boolean
|
|
errors:
|
|
type: array
|
|
items:
|
|
type: string
|
|
|
|
ProblemDetails:
|
|
type: object
|
|
properties:
|
|
type:
|
|
type: string
|
|
title:
|
|
type: string
|
|
status:
|
|
type: integer
|
|
detail:
|
|
type: string
|
|
instance:
|
|
type: string
|