REST API

Two credentials work on the API. A session token from /v1/auth/login acts as the account. An API key acts for a specific set of scopes and is what a service or a pipeline should use.

# Issue a scoped key (shown once)
reliastra keys create ci-bot --scopes read:checks,write:dependencies,read:incidents,read:evidence

# Use it
export RELIASTRA_TOKEN=rel_…
curl -sS https://api.reliastra.com/v1/dependencies -H "Authorization: Bearer $RELIASTRA_TOKEN"

A resolved incident produces an evidence record. GET /v1/evidence/{id} returns everything needed to check the artifact it issued, including the public verification id and URL that are printed inside the document itself:

{
  "id": "7c1d0a5f-…",
  "incident_id": "9f1c8b0e-…",
  "checksum": "0c72…",              // SHA-256 of the rendered document
  "data_hash": "3f9a…",             // SHA-256 of the canonical facts payload
  "verification_id": "8Kd2xQ7mB4pL",
  "verification_url": "https://reliastra.com/reports/8Kd2xQ7mB4pL",
  "methodology_version": "2.0",
  "signed": false,                  // this deployment issues unsigned artifacts
  "expires_at": "2027-09-04T09:12:00Z"
}

verification_url opens a page that needs no account, and GET /v1/verify/{verification_id} is the same record as JSON. GET /v1/verify/keys publishes the Ed25519 public keys for deployments that sign, so a third party can check a signature without trusting either endpoint.

Keys are denied by default. A key can reach the dependency, observation, incident and evidence surfaces its scopes allow; it cannot reach identity, account, webhook or key-management surfaces at all, whatever scopes it carries. That boundary is deliberate: a leaked key must not be able to mint credentials or read the account.

{ "items": [ … ], "next_cursor": "eyJpZCI6…", "has_more": true }

Pass next_cursor back as cursor to continue. Cursors are stable for a query shape, not across filters - change the filter and start again.

This page is the field reference. The generated OpenAPI document is not published: it enumerates every route the API registers, including the authenticated ones, so serving it unauthenticated would hand an attacker the full attack surface from a single unauthenticated request.

This is a deliberate choice, not an omission. Operators who need the machine-readable contract can generate it locally against their own deployment.

# generate the schema from your own deployment
curl -sS https://api.reliastra.com/health
# then, against a checkout of the API:
#   EXPOSE_API_SCHEMA=true python -m scripts.export_openapi