Back to Home

Developer Hub & API Reference

Integrate Verallax scans, fetch findings, generate executive reports, and query our AI Remediation engine dynamically using Postman, curl, or custom backend scripts.

Documentation

1. Authentication

All requests to the Verallax API must include a bearer token in the `Authorization` header. You can generate API Keys directly from the **Settings** page in your dashboard.

Authorization: Bearer vx_key_live_abc123...

2. Postman Integration

To get started quickly, you can import our pre-built Postman collection. Set your environment variables for `baseUrl` and `apiKey` inside Postman.

How to import into Postman:

  1. Download or copy the collection JSON from your dev settings.
  2. Click **Import** inside Postman and select the file.
  3. Configure bearer token authorization under the Collection parent folder.

3. Querying AI Remediation dynamically

Verallax allows you to request AI remediation, Terraform code snippets, and AWS CLI fixes programmatically. This endpoint checks cache flags and automatically generates instructions using the configured LLM if not already cached.

GET/api/v1/ai/recommendations/{finding_id}

**Query parameters**: None required. Assumes organization and tenant details from authorization headers.

{
  "finding_id": 142,
  "risk_explanation": "The S3 bucket does not have Server-Side Encryption (SSE) enabled, meaning objects stored in this bucket are not encrypted at rest. If an attacker gains unauthorized access to the underlying storage disks, they could read the data.",
  "remediation_steps": [
    "Open the AWS S3 Console",
    "Navigate to the Properties tab of the bucket",
    "Under Default Encryption, click Edit and select Enable"
  ],
  "aws_cli_commands": [
    "aws s3api put-bucket-encryption --bucket my-unsafe-bucket --server-side-encryption-configuration '{\"Rules\": [{\"ApplyServerSideEncryptionByDefault\": {\"SSEAlgorithm\": \"AES256\"}}]}'"
  ],
  "terraform_fix": "resource \"aws_s3_bucket_server_side_encryption_configuration\" \"example\" {\n  bucket = aws_s3_bucket.my_bucket.id\n\n  rule {\n    apply_server_side_encryption_by_default {\n      sse_algorithm = \"AES256\"\n    }\n  }\n}"
}

4. Scans & Findings API

List active findings or trigger on-demand AWS account sweeps.

GET/api/v1/findings

**Query parameters**: `severity` (optional), `status` (optional), `service` (optional), `page` (default 1), `limit` (default 50).