Developer reference

CBOM API

Base URL: https://vajrashield.in · Policy: cbom-policy-v1

Staging — curl examples below use . Production pilots use https://vajrashield.in when live.

Upload a repository zip (source + lockfiles) → get JSON, Markdown, HTML, SARIF, PDF. Static analysis only — not HSM, network, or regulatory sign-off.

Bank engineer

Pre-flight → tenant session → upload → bundle.

CI engineer

Use CI token, map tenant ID, and push archive from pipeline.

First pilot

Request briefing first, then export source zip and validate findings.

Validate findings with your engineers before sharing counts externally. First pilot? Request a briefing.

Typical flow

Export zip — export script
POST /api/scanner/preflight?limits=assessment
Login — Vajra Gate or POST /api/auth/login
POST /api/tenant/cbom/upload
GET /api/tenant/cbom/report/bundle

1. Pre-flight (no auth)

Check zip size, structure, secret-like filenames — no scan yet.

curl -sS -X POST 'https://vajrashield.in/api/scanner/preflight?limits=assessment' \
  -F 'archive=@repo-cbom.zip'

ready, blocking[], warnings[], stats.lockfiles · limits: preview 10MB · assessment 25MB

2. Tenant session

curl -sS -X POST https://vajrashield.in/api/auth/login \
  -H 'Content-Type: application/json' \
  -c cookies.txt \
  -d '{"mnemonic_raw":"word1 word2 ... word12","mode":"STANDARD"}'

3. Upload scan

curl -sS -X POST https://vajrashield.in/api/tenant/cbom/upload \
  -b cookies.txt \
  -F 'archive=@repo-cbom.zip' \
  -o CBOM_REPORT.json

3 req/min · 120s timeout · needs VAJRA_TENANT_CBOM_UPLOAD=1

4. Download bundle

curl -sS -OJ https://vajrashield.in/api/tenant/cbom/report/bundle \
  -b cookies.txt

CI upload

Headers X-Vajra-Tenant-Id + X-Vajra-Cbom-Ci-Token

curl -sS -X POST https://vajrashield.in/api/tenant/cbom/ci-upload \
  -H 'X-Vajra-Tenant-Id: <tenant-uuid>' \
  -H 'X-Vajra-Cbom-Ci-Token: <secret>' \
  -F 'archive=@repo-cbom.zip'

Endpoints

Method	Path	Auth
POST	/api/scanner/preflight	None
GET	/api/tenant/cbom/status	Session
POST	/api/tenant/cbom/upload	Session
POST	/api/tenant/cbom/ci-upload	CI token
GET	/api/tenant/cbom/report	Session
GET	/api/tenant/cbom/report/bundle	Session

Common errors

ZIP_INVALID_FORMAT / ZIP_UNSAFE — fix archive
SCAN_TIMEOUT — smaller repo or .vajra-cbom-ignore
NO_REPORT — upload first
CI_TOKEN_INVALID — check credentials with operator

Full markdown pack for NDA engagements: docs/client_packs/CBOM_API.md (on request).