Browse documentation
Introduction.
SecurityVault scans code, images, cloud accounts and clusters, then connects findings to available repository, build and workload context. These pages cover the interfaces you integrate with: the esos CLI, the /api/v2 REST API, runtime agents, outbound webhooks and Rego policy.
Where to start
- Quickstart — sign in, install the CLI, scan a repository and read the lineage view.
- Core concepts — scans and tool plans, the finding ontology, lineage and provenance, policy and disposition.
- CLI reference —
esos auth,esos scan,esos ci scan,esos findings,esos sbom generate. - API reference — authentication, the organisation header, core endpoints, errors and pagination.
- SDKs and extensions — IDE extensions and planned IAST runtime agents.
- Webhooks — signed outbound events, and how inbound provider webhooks are verified.
- Policy authoring — Open Policy Agent Rego, the visual builder, fail-closed evaluation and signed decisions.
Surfaces
| Surface | What it is |
|---|---|
| Console | The web application at app.securityvault.io (or your own host when self-hosted): persona home views, Entity 360, lineage, attack paths, the GRC console and the auditor portal. |
| CLI | esos — a Python package downloaded from the console when signed in. Device-flow login, scans, findings as table, JSON, SARIF or JUnit, SBOM generation, and exit codes for pipeline gates. |
| REST API | /api/v2 on a single hostname. A bearer token plus the X-Organization-ID header on every organisation-scoped call. |
| Runtime agents | Planned IAST agents would add evidence from executed application paths. This capability is not available today. |
| IDE | VS Code extension and JetBrains plugin that scan the file you are editing. |
| Webhooks | Signed outbound events to any HTTPS endpoint, plus built-in two-way ticketing and chat connectors. |
Trust model in one paragraph
Scanners — including SecurityVault's own native engine — run isolated and short-lived, with credentials for the target only. Results enter the platform through a single authenticated, signed and replay-protected ingestion path, and are resolved into the ontology under the organisation that owns the scan. Policy evaluation fails closed. Dispositions are human-only. The architecture page and the security overview have the full picture.
Next steps
- Run your first scan with the quickstart.
- See what the platform covers: SAST, SCA and SBOM, container security and deployment gates.
- Look up a term in the glossary.