Introduction.
SecurityVault scans code, images, cloud accounts and clusters, then tracks every finding through one ontology from the commit that introduced it to the workload running it. These pages describe the interfaces you integrate with: the esos CLI, the /api/v2 REST API, the runtime SDKs, outbound webhooks and Rego policy.
Where to start
- Quickstart — sign in, install the CLI, run a scan on a repository, read the lineage view.
- Core concepts — scans and tool plans, the finding ontology, lineage and provenance, policy and disposition.
- CLI reference —
esos scan,esos ci scan,esos findings,esos sbom,esos policy. - API reference — authentication, tenant header, core endpoints, errors and pagination.
- SDKs — IAST runtime agents for Python, Node.js, Java, Go, .NET and Ruby; IDE extensions; Terraform provider.
- Webhooks — outbound event delivery with HMAC signatures, and how inbound provider webhooks are verified.
- Policy authoring — Open Policy Agent Rego, the visual builder, fail-closed evaluation and signed decisions.
Surfaces
| Surface | What it is |
|---|---|
| Console | The web application at app.securityvault.io (or your own host when self-hosted). Persona-routed home views, Entity 360, lineage, attack paths, GRC console, auditor portal. |
| CLI | esos — Python package (pip install esos-cli) with a Go build for CI images. Device-flow login, scans, findings in table / JSON / SARIF / JUnit, SBOM generate / upload / diff, policy checks, exit codes for gates. |
| REST API | /api/v2 on the read, write, callback, stream and admin planes. Bearer JWT plus the X-Organization-ID header on every tenant-scoped call. |
| Runtime SDKs | IAST agents that observe request handling inside your application and report reachable sinks back to the platform. |
| IDE | VS Code extension and JetBrains plugin backed by /api/v2/developer/ide/scan-file. |
| Terraform | Provider esos for managing organisations, integrations and policies as code. |
| Webhooks | Signed outbound events to any HTTPS endpoint; two-way ticketing and chat connectors built in. |
Trust model in one paragraph
Scanners — including SecurityVault's own native engine — run as ephemeral Kubernetes Jobs with credentials for the target only. Results enter the platform through a single authenticated callback that verifies a per-scan token, an HMAC body signature and a replay nonce. Findings are resolved into an ontology under the tenant the scan belongs to. Policy evaluation fails closed. Dispositions are human-only. Read the architecture page for the full picture.