REST API Reference

API Overview

The Veltrix REST API lets you drive the Security-as-Code pipeline programmatically: author configuration canvases, submit them for approval, trigger deployments, roll back, and monitor drift — from scripts, CI/CD pipelines, or AI agents. Everything the web application does flows through this API.

The API uses JSON requests and responses, API-key authentication, per-tenant rate limiting, and predictable resource-oriented URLs under https://app.veltrixsecops.com/api. Every action is tenant-scoped and recorded in the audit trail.

Policy-as-Code Security API Architecture

Fig 1: Policy-as-Code Security API Integration Architecture with DevSecOps Automation Components

Key Features

RESTful endpoints for all platform operations
Policy-as-code implementation and validation
Security configuration management automation
Version control for security configurations
Security approval workflow integration
CI/CD pipeline security integration
Comprehensive error handling
Rate limiting with clear headers

Use Cases

Automate security configuration across deployments
Integrate security scanning into deployment pipelines
Build custom dashboards with security telemetry
Implement infrastructure security posture validation
Create custom security approval workflows
Automate compliance reporting
Build zero trust architecture systems
Implement automated threat detection

Getting Started

Authentication

API requests authenticate with either a role-bound API key (the X-API-Key header — the usual path for automation, CI/CD, and AI agents) or a portal session (JWT). Keys are created under Settings > API Keys, tenant-scoped, revocable, can carry scopes and expiry dates, and every use is attributed in the audit log — issue each automation or AI agent its own key.

API Key Authentication

curl https://app.veltrixsecops.com/api/pipeline/summary \
  -H "X-API-Key: YOUR_API_KEY"

Making Your First Request

Start with the pipeline summary — an overview of your configuration canvases and their deployment state — or the environment matrix, which returns the canvas-by-environment deployment grid:

Request

curl https://app.veltrixsecops.com/api/pipeline/environment-matrix \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json"

The response is a JSON grid of your configuration canvases against your environment tags, showing each combination's latest deployment status — the same data that powers the pipeline dashboard in the web app.

API Reference

Pipeline

Drive validation, deployment, rollback, and drift monitoring. Deployments honor the target environment's policy — approval requirements, deployment strategy, canary steps, and auto-rollback thresholds.

Endpoint	Method	Description
/api/pipeline/canvas/{id}/validate	POST	Run the app's validation handlers against a canvas
/api/pipeline/canvas/{id}/deploy	POST	Deploy an approved canvas to an environment
/api/pipeline/canvas/{id}/deployments	GET	List deployments for a canvas
/api/pipeline/deployments/{id}	GET	Get a deployment's status, health score, and logs
/api/pipeline/deployments/{id}/rollback \| pause \| resume \| promote	POST	Roll back, pause, resume, or promote a deployment to the next environment
/api/pipeline/summary · /api/pipeline/environment-matrix	GET	Pipeline overview and canvas-by-environment deployment grid
/api/pipeline/drift · /api/pipeline/drift/{driftId}/resolve	GET · POST	List detected drift and resolve a drift record (redeploy, accept, or dismiss)

Configuration Canvases & Approvals

Author versioned configuration and route it through human approval. This is the surface AI agents typically use: author and submit with a scoped key, while approval remains with named human reviewers.

Endpoint	Method	Description
/api/configuration-canvas	GET · POST	List canvases or author a new one
/api/configuration-canvas/{id}	GET · PUT	Read or update a canvas (edits to a pending canvas amend its approval request)
/api/configuration-canvas/{id}/submit-for-approval	POST	Validate, assign named approvers, and set target environments
/api/configuration-canvas/{id}/approvals	GET	List approval status per assigned reviewer
/api/configuration-canvas/{id}/approve · /reject	POST	Record an assigned reviewer's decision; all approvers must approve before deploy is possible

Endpoints are permission-gated by role and tenant-scoped; requests are rate-limited per tenant. For request and response schemas beyond this overview, contact us for the full API collection.

Developer Tooling

The REST API works from any language with an HTTP client — no SDK required. For building Veltrix apps (the integrations that connect security tools to the pipeline), two official packages are published on npm with provenance attestation.

App SDK

Typed contracts for the six pipeline handlers, manifest types, and React hooks for app UI pages.

npm install @veltrixsecops/app-sdk

View on GitHub →

Veltrix CLI

Scaffold, validate, and package apps; develop live against an isolated tenant sandbox.

npm install -g @veltrixsecops/cli

Client & Developer Tooling →