API Reference

The Rorix REST API lets you integrate vulnerability scanning, SBOM generation, and project management into your own tools and workflows.

Base URL

https://rorix.io/api

Authentication

All authenticated endpoints require an API key passed in the Authorization header:

Authorization: Bearer rxk_your_api_key_here

See the Authentication page for details on creating and managing API keys.

Endpoints

| Method | Endpoint | Description | | --- | --- | --- | | POST | /api/audit | Scan dependencies for vulnerabilities | | POST | /api/scan | Rate-limited scan (no auth required) | | POST | /api/sbom | Generate an SBOM | | GET | /api/vulnerabilities/summary | Get vulnerability summary | | GET | /api/vulnerabilities/:id | Get vulnerability details | | GET | /api/vulnerabilities/aging | Get vulnerability aging data | | GET | /api/projects | List projects | | POST | /api/projects | Create a project | | GET | /api/projects/:id | Get project details | | DELETE | /api/projects/:id | Delete a project | | GET | /api/projects/:id/scans | List scans for a project | | POST | /api/projects/:id/scan | Trigger a scan for a project |

Scan Rate Limits

The scan endpoints currently enforce per-IP limits:

| Endpoint | Limit | | --- | --- | | POST /api/scan | 10 requests per minute | | POST /api/sbom | 20 requests per minute | | POST /api/audit | 30 requests per minute |

A limited request returns HTTP 429. These endpoints do not currently emit rate-limit response headers.

Error Format

Errors return a non-2xx status and a JSON message:

{
  "error": "Missing or invalid file content"
}

NuGet registry endpoints use a structured { error: { code, message } } envelope; the general REST endpoints currently use the string form above.