EchelonGraph API

openapi: 3.1.0
info:
  title: EchelonGraph API
  version: '2026-11-06'
  description: 'GENERATED FROM DOCUMENTATION by API Evangelist on 2026-11-06: 23 operation(s) read from 10 public documentation page(s) (each
    operation names its page in x-source). This is not the provider''s published contract; EchelonGraph has published no machine-readable contract
    that the pipeline could find. Engine: local.'
  x-evidence-tiers:
    code-example: 7
    documentation: 16
    pages-with-code: 4
    pages-read: 10
  x-generated-from: documentation
  x-provenance: generated
  x-authored-by: API Evangelist
  x-generated: '2026-11-06'
  x-generator: generate-contract-from-docs.py
  x-engine: local
  x-sources:
  - https://echelongraph.io/pulse/api
  - https://echelongraph.io/pulse/mcp
  - https://echelongraph.io/shadow-ai-radar
  - https://echelongraph.io/docs/iac-scanning
  - https://echelongraph.io/docs/tier3-deployment
  - https://echelongraph.io/pulse/methodology
  - https://echelongraph.io/pulse/vendor-advisories/github/GHSA-m3qr-fvp4-78xj
  - https://echelongraph.io/pulse/vendor-advisories/github/GHSA-7wpf-ch8f-5f4x
  - https://echelongraph.io/pulse/vendor-advisories/github/GHSA-4xm8-rg9h-jhq2
  - https://echelongraph.io/pulse/vendor-advisories/github/GHSA-494m-4556-wf5p
servers:
- url: https://app.echelongraph.io
paths:
  /api/v1/auth/tokens:
    get:
      operationId: get_api_v1_auth_tokens
      tags:
      - Api
      summary: GET /api/v1/auth/tokens
      x-source: https://echelongraph.io/pulse/vendor-advisories/github/GHSA-m3qr-fvp4-78xj
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -i 'http://127.0.0.1:8000/api/v1/auth/tokens'\n Expected protected result: \n HTTP/1.1 401 Unauthorized\n This demonstrates\
          \ that default auth is active while /api/v1/logs bypasses it due to registration order. \n Impact \n An unauthenticated network attacker\
          \ can retrieve recent application logs. Depending on deployment and log level, logs can disclose operational metadata such as component\
          \ names, "
  /api/v1/logs:
    get:
      operationId: get_api_v1_logs
      tags:
      - Api
      summary: GET /api/v1/logs
      x-source: https://echelongraph.io/pulse/vendor-advisories/github/GHSA-m3qr-fvp4-78xj
      parameters:
      - name: limit
        in: query
        required: false
        schema:
          type: string
      - name: since_minutes
        in: query
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: "curl -i 'http://127.0.0.1:8000/api/v1/logs?limit=1000&since_minutes=1440'\n Expected vulnerable result: \n HTTP/1.1 200 OK\n\
          Content-Type: application/json\n{\"timestamp\":\"...\",\"count\":...,\"logs\":[...]}\n Compare with a protected endpoint without credentials: "
  /api/v1/public/cves:
    get:
      operationId: get_api_v1_public_cves
      tags:
      - Api
      summary: The main feed — paginated JSON list, newest first.
      x-source: https://echelongraph.io/pulse/api
      parameters:
      - name: limit
        in: query
        required: false
        schema:
          type: string
        description: default 50, max 200
      - name: offset
        in: query
        required: false
        schema:
          type: string
      - name: search
        in: query
        required: false
        schema:
          type: string
      - name: severity
        in: query
        required: false
        schema:
          type: string
      - name: min_cvss
        in: query
        required: false
        schema:
          type: string
      - name: kev_only
        in: query
        required: false
        schema:
          type: string
      - name: year
        in: query
        required: false
        schema:
          type: string
      - name: sort
        in: query
        required: false
        schema:
          type: string
        description: published | epss | severity | cvss_v3_score
      - name: skip_count
        in: query
        required: false
        schema:
          type: string
      - name: reverse
        in: query
        required: false
        schema:
          type: string
        description: true reads the default listing from its far end
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetApiV1PublicCvesResponse'
      x-evidence:
        kind: documentation
  /api/v1/public/cves/CVE-2021-44228:
    post:
      operationId: post_api_v1_public_cves_CVE_2021_44228
      tags:
      - Api
      summary: POST /api/v1/public/cves/CVE-2021-44228
      x-source: https://echelongraph.io/pulse/api
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostApiV1PublicCvesCve202144228Request'
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: 'curl https://app.echelongraph.io/api/v1/public/cves/CVE-2021-44228 | jq . Endpoints GET /api/v1/public/cves The main feed —
          paginated JSON list, newest first. Params: limit (default 50, max 200), offset, search, severity, min_cvss, kev_only, year, sort (published
          | epss | severity | cvss_v3_score), skip_count. reverse=true reads the default listing (sort=published or no sort, with no status other '
  /api/v1/public/cves/match/batch:
    post:
      operationId: post_api_v1_public_cves_match_batch
      tags:
      - Api
      summary: The registry match for up to 200 components in one call.
      x-source: https://echelongraph.io/pulse/api
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostApiV1PublicCvesMatchBatchRequest'
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostApiV1PublicCvesMatchBatchResponse'
      x-evidence:
        kind: documentation
  /api/v1/public/cves/{id}/references:
    get:
      operationId: get_api_v1_public_cves_id_references
      tags:
      - Api
      summary: Per-reference enrichment for one CVE — vendor advisory cross-walks, patch URLs, exploit POC indicators where surfaced.
      x-source: https://echelongraph.io/pulse/api
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetApiV1PublicCvesIdReferencesResponse'
      x-evidence:
        kind: documentation
  /api/v1/public/cves/{id}/related:
    get:
      operationId: get_api_v1_public_cves_id_related
      tags:
      - Api
      summary: Three lists of related CVEs, up to 10 each.
      x-source: https://echelongraph.io/pulse/api
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetApiV1PublicCvesIdRelatedResponse'
      x-evidence:
        kind: documentation
  /api/v1/public/kev/recent:
    get:
      operationId: get_api_v1_public_kev_recent
      tags:
      - Api
      summary: CVE & exposure intelligence, inside your AI tools
      x-source: https://echelongraph.io/pulse/mcp
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /api/v1/public/vendor-advisories:
    get:
      operationId: get_api_v1_public_vendor_advisories
      tags:
      - Api
      summary: Vendor-disclosed security advisories (Microsoft MSRC, Red Hat RHSA, GitHub GHSA, Cisco PSIRT, AWS, GCP, GitLab).
      x-source: https://echelongraph.io/pulse/api
      parameters:
      - name: has_cve
        in: query
        required: false
        schema:
          type: string
      - name: limit
        in: query
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetApiV1PublicVendorAdvisoriesResponse'
      x-evidence:
        kind: documentation
  /api/v1/public/vendor-advisories/{vendor}/{advisoryId}:
    get:
      operationId: get_api_v1_public_vendor_advisories_vendor_advisoryId
      tags:
      - Api
      summary: Single vendor-advisory detail — title, description, CVSS, affected products, remediation, references, linked CVE IDs.
      x-source: https://echelongraph.io/pulse/api
      parameters:
      - name: vendor
        in: path
        required: true
        schema:
          type: string
      - name: advisoryId
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetApiV1PublicVendorAdvisoriesVendorAdvisoryidResponse'
      x-evidence:
        kind: documentation
  /api/v1/scan/iac:
    post:
      operationId: post_api_v1_scan_iac
      tags:
      - Api
      summary: Shift‑left CI/CD gate – Developer opens a PR → POST /api/v1/scan/iac (Bearer ek_…). Verdict blocks a bad terraform apply before
        deploy.
      x-source: https://echelongraph.io/docs/iac-scanning
      parameters:
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
        description: Bearer token (e.g., ek_… ) for tenant‑scoped authentication.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostApiV1ScanIacRequest'
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostApiV1ScanIacResponse'
      x-evidence:
        kind: documentation
  /collections:
    delete:
      operationId: delete_collections
      tags:
      - Collections
      summary: Shadow AI Radar — Publicly Observed AI Infrastructure
      x-source: https://echelongraph.io/shadow-ai-radar
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /insecure/plain/local:///path/to/ico-oob.ico@png:
    get:
      operationId: get_insecure_plain_local_path_to_ico_oob_ico_png
      tags:
      - Insecure
      summary: GET /insecure/plain/local:///path/to/ico-oob.ico@png
      x-source: https://echelongraph.io/pulse/vendor-advisories/github/GHSA-494m-4556-wf5p
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: curl "http://127.0.0.1:8080/insecure/plain/local:///path/to/ico-oob.ico@png"
  /insecure/plain/local:///path/to/normal.ico@png:
    get:
      operationId: get_insecure_plain_local_path_to_normal_ico_png
      tags:
      - Insecure
      summary: GET /insecure/plain/local:///path/to/normal.ico@png
      x-source: https://echelongraph.io/pulse/vendor-advisories/github/GHSA-494m-4556-wf5p
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: curl
        snippet: curl "http://127.0.0.1:8080/insecure/plain/local:///path/to/normal.ico@png"
  /model-versions/get-artifact:
    get:
      operationId: get_model_versions_get_artifact
      tags:
      - Model Versions
      summary: Shadow AI Radar — Publicly Observed AI Infrastructure
      x-source: https://echelongraph.io/shadow-ai-radar
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /models:
    get:
      operationId: get_models
      tags:
      - Models
      summary: Shadow AI Radar — Publicly Observed AI Infrastructure
      x-source: https://echelongraph.io/shadow-ai-radar
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
    post:
      operationId: post_models
      tags:
      - Models
      summary: Shadow AI Radar — Publicly Observed AI Infrastructure
      x-source: https://echelongraph.io/shadow-ai-radar
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /signalk/v2/api/resources/{resourcetype}/{resourceid}:
    get:
      operationId: get_signalk_v2_api_resources_resourcetype_resourceid
      tags:
      - Signalk
      summary: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution
      x-source: https://echelongraph.io/pulse/vendor-advisories/github/GHSA-4xm8-rg9h-jhq2
      parameters:
      - name: resourcetype
        in: path
        required: true
        schema:
          type: string
      - name: resourceid
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetSignalkV2ApiResourcesResourcetypeResourceidResponse'
      x-evidence:
        kind: documentation
  /skServer/providers:
    post:
      operationId: post_skServer_providers
      tags:
      - Skserver
      summary: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution
      x-source: https://echelongraph.io/pulse/vendor-advisories/github/GHSA-4xm8-rg9h-jhq2
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostSkserverProvidersRequest'
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostSkserverProvidersResponse'
      x-evidence:
        kind: documentation
  /sse:
    get:
      operationId: get_sse
      tags:
      - Sse
      summary: Shadow AI Radar — Publicly Observed AI Infrastructure
      x-source: https://echelongraph.io/shadow-ai-radar
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/auth/oidc/login:
    post:
      operationId: post_v1_auth_oidc_login
      tags:
      - Auth
      summary: POST /v1/auth/oidc/login
      x-source: https://echelongraph.io/docs/tier3-deployment
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: javascript
        snippet: "fetch(\n \"https://vault.your-company.com/v1/auth/oidc/login\",\n { method: \"POST\", body: JSON.stringify({ code: oidcCode\
          \ })"
  /v1/models:
    get:
      operationId: get_v1_models
      tags:
      - Models
      summary: Shadow AI Radar — Publicly Observed AI Infrastructure
      x-source: https://echelongraph.io/shadow-ai-radar
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /v1/transit/decrypt/echelongraph:
    post:
      operationId: post_v1_transit_decrypt_echelongraph
      tags:
      - Transit
      summary: Customer's KMS POST https://vault.acme.com/v1/transit/decrypt/echelongraph
      x-source: https://echelongraph.io/docs/tier3-deployment
      parameters:
      - name: X-Vault-Token
        in: header
        required: true
        schema:
          type: string
        description: Alice's OIDC‑derived token
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostV1TransitDecryptEchelongraphRequest'
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostV1TransitDecryptEchelongraphResponse'
      x-evidence:
        kind: documentation
components:
  schemas:
    GetApiV1PublicCvesResponse:
      type: object
      properties:
        cves:
          type: string
          description: cves for this page
        total:
          type: string
          description: total matching CVEs across all pages
        total_is_lower_bound:
          type: string
          description: whether total is a proven floor
        total_counted:
          type: string
          description: whether a count is in hand
        reverse_available:
          type: string
          description: whether reverse=true would be served
    PostApiV1PublicCvesCve202144228Request:
      type: object
      properties:
        components:
          type: array
          items:
            type: object
            properties:
              purl:
                type: string
    PostApiV1PublicCvesMatchBatchRequest:
      type: object
      properties:
        components:
          type: string
          description: array of objects with either purl or ecosystem/package/version
      required:
      - components
    PostApiV1PublicCvesMatchBatchResponse:
      type: object
      properties:
        components:
          type: string
          description: array of results matching input order
        assessed:
          type: string
          description: whether each component was evaluated
        not_assessed_reason:
          type: string
          description: reason if not assessed
        interval:
          type: string
          description: advisory interval for each match
        fixed_in:
          type: string
          description: fixed version for each match
        matched_package:
          type: string
          description: package used for lookup
        matched_via:
          type: string
          description: purl_name, coordinates, or upstream
    GetApiV1PublicCvesIdReferencesResponse:
      type: object
      properties:
        references:
          type: string
          description: array of enriched reference objects
    GetApiV1PublicCvesIdRelatedResponse:
      type: object
      properties:
        same_product:
          type: string
          description: CVEs sharing an affected package
        same_vendor:
          type: string
          description: CVEs sharing a vendor advisory
        same_cwe:
          type: string
          description: CVEs sharing a CWE
        basis:
          type: string
          description: reason why each list is as it is
    GetApiV1PublicVendorAdvisoriesResponse:
      type: object
      properties:
        advisories:
          type: string
          description: list of vendor advisory objects
    GetApiV1PublicVendorAdvisoriesVendorAdvisoryidResponse:
      type: object
      properties:
        title:
          type: string
          description: advisory title
        description:
          type: string
          description: advisory description
        cvss:
          type: string
          description: CVSS score
        affected_products:
          type: string
          description: list of affected products
        remediation:
          type: string
          description: remediation steps
        references:
          type: string
          description: reference URLs
        linked_cve_ids:
          type: string
          description: array of CVE identifiers linked to this advisory
    PostApiV1ScanIacRequest:
      type: object
      properties:
        IaC files:
          type: string
          description: Changed IaC files (up to 100 files / 5 MB per request) sent in the request body.
      required:
      - IaC files
    PostApiV1ScanIacResponse:
      type: object
      properties:
        '200':
          type: string
          description: Pass verdict – no critical findings; build may proceed.
        '422':
          type: string
          description: Fail verdict – one or more critical findings; build should be blocked.
    GetSignalkV2ApiResourcesResourcetypeResourceidResponse:
      type: object
      properties:
        any JSON file content:
          type: string
          description: The JSON content of the requested file when traversal succeeds
    PostSkserverProvidersRequest:
      type: object
      properties:
        id:
          type: string
          description: Provider identifier
        enabled:
          type: boolean
          description: Whether the provider is enabled
        logging:
          type: boolean
          description: Whether logging is enabled for the provider
        type:
          type: string
          description: Provider type, e.g., "Execute"
        options:
          type: object
          description: Provider specific options
      required:
      - id
      - enabled
      - logging
      - type
      - options
    PostSkserverProvidersResponse:
      type: object
      properties:
        provider creation result:
          type: string
          description: Confirmation that the provider was created; may include persisted settings
    PostV1TransitDecryptEchelongraphRequest:
      type: object
      properties:
        ciphertext:
          type: string
          description: wrapped DEK (e.g., "vault:v1:AQECAHj8H5jK4Z9wL...")
      required:
      - ciphertext
    PostV1TransitDecryptEchelongraphResponse:
      type: object
      properties:
        data.plaintext:
          type: string
          description: Base64‑encoded plaintext DEK (e.g., "kJh3T9xQ4Z2wL1vPdR8mN0y...")
  securitySchemes:
    Bearer:
      type: http
      scheme: bearer
      x-source: https://echelongraph.io/docs/api-reference
tags:
- name: Api
- name: Auth
- name: Collections
- name: Insecure
- name: Model Versions
- name: Models
- name: Signalk
- name: Skserver
- name: Sse
- name: Transit
security:
- Bearer: []