Catalog of the public Admin API under /v1. Base URL:
https://guard.unveilr.ai (or your self-hosted origin).
All routes below require Authorization: Bearer … unless noted. Gateway traffic
uses /mcp/* on the same origin — see Govern .
Machine-readable contract
Operators regenerate OpenAPI with make openapi → docs/openapi.json. Ask
your Unveilr contact for the current export if you generate clients.
Health (no auth)
Method Path Purpose GET /healthzLiveness GET /readyzReadiness (DB reachable)
Overview & onboarding
Method Path Purpose GET /v1/overviewDashboard KPIs GET /v1/onboardingFirst-value checklist
Repos & scans (Discover / Guard)
Method Path Purpose GET /v1/reposList repos POST /v1/reposRegister repo GET /v1/repos/{repoId}Get repo DELETE /v1/repos/{repoId}Remove repo POST /v1/repos/{repoId}/scanTrigger scan POST /v1/repos/{repoId}/importImport scan artifact POST /v1/repos/{repoId}/ingestIngest CLI/CI upload POST /v1/repos/{repoId}/pr-checkPR gate check GET /v1/repos/{repoId}/scansScan history GET /v1/repos/{repoId}/aibomRepo AI-BOM GET /v1/repos/{repoId}/aibom/cyclonedxCycloneDX export POST /v1/repos/{repoId}/reachabilityReachability analysis POST /v1/repos/{repoId}/enrichEnrichment
Method Path Purpose GET /v1/findingsList (cursor pagination ) GET /v1/findings/{findingId}Get finding PATCH /v1/findings/{findingId}Workflow fields (owner, assignee, …) POST /v1/findings/{findingId}/statusTriage status POST /v1/findings/{findingId}/suppressSuppress finding GET /v1/findings/suppressionsList suppressions POST /v1/findings/suppressionsCreate suppression DELETE /v1/findings/suppressions/{id}Delete suppression GET /v1/remediationRemediation hub POST /v1/remediation/findings/{findingId}Open remediation GET /v1/remediation/{id}Get remediation POST /v1/remediation/{id}/dismissDismiss GET /v1/detectionsDetection catalog
Findings query parameters
repoId, severity, category, status, scanner, mode, blastRadius,
owner, assignee, overdue, limit (1–200), cursor.
Org AI inventory
Method Path Purpose GET /v1/aibomOrg AI-BOM GET /v1/aibom/cyclonedxOrg CycloneDX GET /v1/agentsAgent inventory GET /v1/agents/{agentId}Agent detail GET /v1/identity/graphIdentity / asset graph
Method Path Purpose GET/POST /v1/serversList / create GET/PATCH/DELETE /v1/servers/{serverId}CRUD POST /v1/servers/{serverId}/approveApprove server GET /v1/servers/{serverId}/toolsTools on server POST /v1/servers/discoverDiscover server GET /v1/tools · /v1/tools/{toolId}List / get PATCH /v1/tools/{toolId}Update POST /v1/tools/{toolId}/approve · /reapproveApproval POST /v1/servers/{serverId}/toolsAdd tool POST /v1/mcp/access-tokenMCP client access token
Policies
Method Path Purpose GET/POST /v1/policiesList / create GET/PATCH/DELETE /v1/policies/{policyId}CRUD GET /v1/policies/templatesTemplates GET /v1/policies/packsPacks POST /v1/policies/packs/{packId}/installInstall pack POST /v1/policies/simulateSimulate decision
Policy mutations require an admin, security, policy-admin, or tenant-admin
identity and emit policy_changed evidence. Request bodies are strict: unknown
selector/condition fields return 422 instead of being ignored. Simulation may
include draftPolicy, draftPolicyId, and includeActivePolicies to evaluate
an unsaved rule with the gateway's real engine. Full schema and examples:
Runtime policies .
Agent identities & govern (runtime)
Method Path Purpose GET/POST /v1/agent-identitiesList / register POST /v1/agent-identities/bootstrapFast register path PATCH /v1/agent-identities/{id}Update POST /v1/agent-identities/{id}/approveLab: approve + mint uvt_ POST /v1/agent-identities/{id}/approve-externalEnterprise: bind Okta/Entra/OIDC subject POST /v1/agent-identities/{id}/revokeKill switch GET /v1/agent-identities/{id}/onrampSnippets GET/POST /v1/identity-providersList / create external agent IdP POST /v1/identity-providers/discoverOIDC discovery (issuer → JWKS) PATCH /v1/identity-providers/{id}Update provider POST /v1/identity-providers/{id}/refresh-jwksClear JWKS cache DELETE /v1/identity-providers/{id}Remove (if unbound) POST /v1/govern/checkAllow/deny (IdP JWT or uvt_)
Govern request body:
{ "tool" : "ledger.query" , "server" : "ledger" , "arguments" : { } }
Response includes decision (allow | deny), reason, agent,
findings, evidenceId. Details: Govern check .
Sessions, approvals, correlation
Method Path Purpose GET /v1/sessionsSessions GET /v1/sessions/{id}/eventsSession events GET /v1/approvalsPending approvals POST /v1/approvals/{id}/approve · /denyDecide POST/GET /v1/correlation/runtimeRuntime join
Evidence & compliance (Prove)
Method Path Purpose GET /v1/evidence/eventsLedger events GET /v1/evidence/verifyVerify chain GET /v1/evidence/exportExport window (since=…) POST /v1/ingest/eventsIngest events GET /v1/complianceFrameworks GET /v1/compliance/{framework}Report GET /v1/compliance/{framework}/boardBoard pack (text) GET/POST /v1/compliance/{framework}/attestationsAttestations
Organization & tokens
Method Path Purpose GET/PATCH /v1/orgOrg settings GET /v1/org/membersMembers GET /v1/org/sso-setup · /scim-setupIdP setup links GET /v1/org/directory-usersDirectory users GET/POST/DELETE /v1/tokensService tokens
Notifications & ticketing
Method Path Purpose GET/POST /v1/notificationsChannels (Slack / webhook / SIEM) DELETE /v1/notifications/{id}Remove POST /v1/notifications/{id}/testTest delivery GET/PUT/DELETE /v1/integrations/ticketing/{provider}Jira / ServiceNow POST /v1/integrations/ticketing/{provider}/testTest POST /v1/integrations/ticketing/.../findings/{id}Create ticket GET /v1/findings/{id}/tickets · /v1/ticketsTicket links
Method Path Purpose POST /v1/github/connectConnect App GET /v1/github/setupSetup metadata POST /v1/github/webhookGitHub webhook (signed) * /v1/integrations/agent-platforms/*AgentCore / Foundry connections, sync, assets
Method Path Purpose GET/POST /v1/platform/tenantsList / provision tenants POST /v1/platform/tenants/{id}/…Invite / admin actions
Requires role super_admin or platform_admin.
Not a customer API
Do not integrate against /internal/* (quarantine, introspect, control-plane,
internal approvals). Those are for the MCP Gateway and operators only.