Production APIs
How hosted Unveilr is exposed so every persona — developers, AppSec, tenant admins, platform operators, CI, and agents — can use the same production origin without private-repo access.
Step-by-step playbooks, auth, conventions, and the full /v1 catalog live under
API:
- Authentication — SSO,
uvt_tokens, scopes - Persona playbooks — first success per role
- Conventions — pagination, errors, rate limits
- Endpoint reference — Admin API catalog
- Govern check — runtime allow/deny for agents
DNS, CDN, Terraform cutover, and the internal completeness checklist live in the
monorepo (docs/PRODUCTION_APIS.md, docs/API_PRODUCTION_READY.md) — private
repo; ask your Unveilr contact. This site is the customer-facing contract.
The Unveilr git repository is not public. Install the CLI from a
checksummed partner binary (works today) or, after the GA cut, from the
binary CDN (get.unveilr.ai or your operator’s CloudFront URL). Never use
raw.githubusercontent.com.
Public surfaces
One HTTPS origin with path routing:
| Path | Service | Used by |
|---|---|---|
/v1/* | Admin API | Console BFF, CLI --upload, CI tokens, integrations |
/healthz, /readyz | API health | Load balancers, ops probes |
/gateway/healthz, /gateway/readyz | Gateway health | Runtime gateway and API control-plane readiness |
/mcp/* | MCP Gateway | Runtime agent traffic |
/* | Web console | Humans (SSO) |
Current primary origin: https://guard.unveilr.ai
export UNVEILR_API=https://guard.unveilr.ai
export UNVEILR_CONSOLE=https://guard.unveilr.ai
Optional brand aliases (only after your operator confirms DNS is live):
| Alias | Purpose |
|---|---|
https://api.unveilr.ai | Same Admin API under a shorter host |
https://get.unveilr.ai/install.sh | One-line CLI installer (CDN, not GitHub) — not live until GA |
Install the CLI
Works today:
# Hand-delivered binary + checksum from your Unveilr contact
shasum -a 256 -c unveilr.sha256
chmod +x unveilr && sudo mv unveilr /usr/local/bin/
unveilr --version
After GA CDN is live:
curl -fsSL https://get.unveilr.ai/install.sh | sh
# pin a release:
curl -fsSL https://get.unveilr.ai/install.sh | UNVEILR_VERSION=v0.1.0 sh
Before the short hostname exists, use the CloudFront (or S3) origin your operator
gives you — same install.sh layout — or stay on the partner-binary path.
Other methods: Installation.
Authenticate (quick map)
| Caller | How |
|---|---|
| Human in the console | WorkOS SSO → /o/<org-slug> |
| CLI | Tenant-bound service token from Settings → API Tokens |
| CI / automation | Service token from Settings → API Tokens |
| Agent runtime | Approved agent identity → Gateway or POST /v1/govern/check |
export UNVEILR_TOKEN=uvt_…
unveilr login --token "$UNVEILR_TOKEN" --api "$UNVEILR_API"
unveilr scan --upload
curl -fsS "$UNVEILR_API/v1/onboarding" \
-H "Authorization: Bearer $UNVEILR_TOKEN"
Never use client-selected X-Unveilr-* tenant headers. Full
detail: Authentication.
Personas — first success
| Persona | First success | Guide |
|---|---|---|
| Developer | Offline unveilr scan; optional --upload | Playbook |
| AppSec / GRC | Triage findings; export CycloneDX / evidence | Playbook |
| Tenant admin | Mint uvt_; connect GitHub; register agents | Playbook |
| Platform super admin | Provision org + invite tenant admin | Playbook |
| CI / CD | Observe mode on PR; optional upload | Playbook |
| Agent / runtime | Allow/deny via Gateway or govern check | Playbook |
Health checks
curl -fsS "$UNVEILR_API/healthz"
curl -fsS "$UNVEILR_API/readyz"
Self-hosted vs SaaS
| Mode | Origin | Docs |
|---|---|---|
| Unveilr-hosted / your staging | https://guard.unveilr.ai (or operator URL) | This page + API |
| Your AWS account | CloudFront URL from Terraform | Self-hosting |
Production hardening (OIDC, no dev headers, gateway token): see Self-hosting → Secure by default.