Platform API
Authenticated endpoints.
Customer and administrator operations are exposed through the platform REST API. Every endpoint enforces role-based permissions and tenant isolation.
Authentication
POST/api/auth/registerCreate a customer account
POST/api/auth/loginIssue a session
Customer
GET/api/customer/dashboardDashboard summary
POST/api/websitesOnboard a website
GET/api/websitesList websites
GET/api/websites/:idWebsite record
POST/api/websites/:id/scanQueue a scan
GET/api/websites/:id/scansScan history
GET/api/scans/:idScan results and findings
POST/api/accreditation/applySubmit an application
GET/api/accreditation/:idAccreditation record
POST/api/organizationsOrganization profile
POST/api/organizations/documentsUpload verification documents
Administration
GET/api/admin/customersCustomer search
GET/api/admin/websitesWebsite management
GET/api/admin/scansScan control
GET/api/admin/accreditationsAccreditation records
POST/api/admin/accreditations/:id/approveApprove
POST/api/admin/accreditations/:id/rejectReject — reason required
POST/api/admin/accreditations/:id/suspendSuspend — reason required
POST/api/admin/accreditations/:id/revokeRevoke — reason required
Scanner result contract. Each scanner returns a standardized object: { category, status, severity, score, details, timestamp } — so new checks can be added without changing the scoring or decision engines.