Developer reference

CBOM API

Base URL: https://vajrashield.in · Policy: cbom-policy-v1

Upload a repository zip (source + lockfiles) → get JSON, Markdown, HTML, SARIF, PDF. Static analysis only — not HSM, network, or regulatory sign-off.

Validate findings with your engineers before sharing counts externally. First pilot? Request a briefing.

Typical flow

Export zip — export script
POST /api/scanner/preflight?limits=assessment
Login — Vajra Gate or POST /api/auth/login
POST /api/tenant/cbom/upload
GET /api/tenant/cbom/report/bundle

1. Pre-flight (no auth)

Check zip size, structure, secret-like filenames — no scan yet.

curl -sS -X POST 'https://vajrashield.in/api/scanner/preflight?limits=assessment' \
  -F 'archive=@repo-cbom.zip'

ready, blocking[], warnings[], stats.lockfiles · limits: preview 10MB · assessment 25MB

2. Tenant session

curl -sS -X POST https://vajrashield.in/api/auth/login \
  -H 'Content-Type: application/json' \
  -c cookies.txt \
  -d '{"mnemonic_raw":"word1 word2 ... word12","mode":"STANDARD"}'

3. Upload scan

curl -sS -X POST https://vajrashield.in/api/tenant/cbom/upload \
  -b cookies.txt \
  -F 'archive=@repo-cbom.zip' \
  -o CBOM_REPORT.json

3 req/min · 120s timeout · needs VAJRA_TENANT_CBOM_UPLOAD=1

4. Download bundle

curl -sS -OJ https://vajrashield.in/api/tenant/cbom/report/bundle \
  -b cookies.txt

CI upload

Headers X-Vajra-Tenant-Id + X-Vajra-Cbom-Ci-Token

curl -sS -X POST https://vajrashield.in/api/tenant/cbom/ci-upload \
  -H 'X-Vajra-Tenant-Id: <tenant-uuid>' \
  -H 'X-Vajra-Cbom-Ci-Token: <secret>' \
  -F 'archive=@repo-cbom.zip'

Endpoints

Method	Path	Auth
POST	/api/scanner/preflight	None
GET	/api/tenant/cbom/status	Session
POST	/api/tenant/cbom/upload	Session
POST	/api/tenant/cbom/ci-upload	CI token
GET	/api/tenant/cbom/report	Session
GET	/api/tenant/cbom/report/bundle	Session

Common errors

ZIP_INVALID_FORMAT / ZIP_UNSAFE — fix archive
SCAN_TIMEOUT — smaller repo or .vajra-cbom-ignore
NO_REPORT — upload first
CI_TOKEN_INVALID — check credentials with operator

Full markdown pack for NDA engagements: docs/client_packs/CBOM_API.md (on request).