Declara
⌘K
engineerP0Updated
Was this page helpful?

No OpenAPI spec exists for this API yet. This page is hand-maintained against the actual route code, not generated — if it and the code ever disagree, treat the code as correct and report the drift.

Authentication

Every request carries an API key as a bearer token:

Authorization: Bearer dcl_xxxxxxxxxxxxxxxxxxxxxxxx

Keys are shown in full exactly once, at creation. After that, Declara stores only a SHA-256 hash — it cannot show you the secret again, and support cannot look it up for you. If you lose it, revoke the key and mint a new one.

Scopes

A key is created with one or more scopes, and a request fails with 403 if the key's scopes don't cover the endpoint:

ScopeGrants
sboms:writePOST /api/v1/products/{id}/sboms
alerts:readGET /api/v1/alerts
cases:readGET /api/v1/cases
products:readGET /api/v1/products

Endpoints

GET /api/v1/alerts

Lists alerts. Defaults to status=open.

Query parameters: status (open, monitoring, closed, all), tier (A, B, C), cursor, limit.

Each alert includes its product, its advisory (id, summary, CVSS, EPSS, whether it's in KEV), and a fixed note: "An alert means a component you ship appears in an exploitation catalogue. It is a reason to assess, not a reportable event."

GET /api/v1/cases

Lists cases with their deadlines.

Query parameters: state (any of the case states — see The reporting clock, explained), cursor, limit.

Each case includes awareAt, its computed deadlines for early warning, notification, and final report (null until the relevant clock has a starting point), and the submission timestamp for each stage that's been filed.

GET /api/v1/products

Lists products and their versions, so CI can resolve a product name to an id.

Query parameters: cursor, limit.

Each product includes its versions, each version's support status, and whether it has an active SBOM.

POST /api/v1/products/{id}/sboms

Pushes an SBOM for a specific version. Requires sboms:write.

Query parameter: ?version= (required) — the release this document belongs to. A version that hasn't been seen before is created automatically.

Body: the raw SBOM document, up to 4 MB. Larger documents must go through the browser upload, which writes straight to storage rather than through this endpoint.

Response: 202 Accepted with an uploadId — parsing runs in the background.

Errors

Every error response has the same shape:

{ "error": { "code": "invalid_request", "message": "..." } }

Match on code, not on the message text — the wording is free to improve.

Pagination

List endpoints use cursor pagination: pass limit (default 50, max 200) and cursor (from a previous response's nextCursor). nextCursor is null on the last page.

Usage metering

Every request is metered per API key, per day. This is recorded for visibility — it is not currently billed on. Don't read a usage number as a charge.

Related