Documentation

API & platform documentation

Every backend service serves interactive Swagger UI at /docs directly, and a merged OpenAPI spec is generated into docs/api/openapi.yaml in the platform repository.

All requests route through the API Gateway. Authentication is a Bearer JWT (Authorization: Bearer <token>) on every route except registration, login, password recovery, and the public billing catalogue.

Modules

Auth
/api/v1/auth, /api/v1/users

Registration, login, MFA, self-service profile & password management.

Billing
/api/v1/billing

Plans, checkout, subscriptions, invoices, webhooks.

Pentest
/api/v1/engagements, /api/v1/scans

Engagement lifecycle, scan dispatch, findings.

Vuln-Scan
/api/v1/assets, /api/v1/findings

Asset registry, scheduled scanning, compliance reports.

SOC
/api/v1/soc

Event ingestion, correlation, tenant-scoped alerting.

Threat Intel
/api/v1/threats

IOC management, Threat DNA profiling.

DFIR
/api/v1/dfir

Case management, evidence, timeline.

EASM
/api/v1/easm

Domain verification, discovery, exposure tracking.

BAS
/api/v1/bas

Attack simulation scenarios and results.

Mobile
/api/v1/mobile

Self-declared checklist scans, dynamic lab sessions.

AI / Chat
/api/v1/chat, /api/v1/copilot

AI assistant and SOC analyst copilot.