External interfaces¶
Every way the released software (the container image and the Helm chart) talks to people and other systems. Each entry links to its full reference. Anything not listed here is internal and may change without notice.
What the platform serves¶
| Interface | Who uses it | Reference |
|---|---|---|
Web UI (/, port 8000, process aap api) |
People, through a browser; sign-in through OpenID Connect (/auth/login, /auth/callback) |
User guide |
REST API (/api/v1/..., same process) |
The web UI and your own scripts; every operation is in the OpenAPI 3.1 contract, with the permission it needs | API reference · OpenAPI |
Health (/api/v1/health/live, /api/v1/health/ready) |
Kubernetes probes, load balancers | API reference |
Webhook receiver (/github/webhook, /gitlab/webhook, port 8001, process aap hook) |
GitHub and GitLab; deliveries must carry a valid signature (GitHub HMAC) or secret token (GitLab) | Connect your organization · GitLab |
What the platform reads¶
| Interface | Format | Reference |
|---|---|---|
| Settings | aap.yaml (JSON Schema) or AAP_* environment variables |
Settings |
| Rules | YAML in config/ and catalogue/, validated by schemas |
Configure |
| Secrets | One file per secret (mounted Kubernetes or Docker secrets), or Azure Key Vault | Settings · chart README |
| Application contract | .security/application.yaml, asvs.yaml and threat models in each application repository |
Schemas · template |
| Evidence | evidence-manifest.json written by the shipped pipelines, optionally signed as an in-toto statement |
Manifest schema · Evidence type v1 · Evidence model |
| Helm values | values.yaml, validated by values.schema.json |
chart README |
What the platform calls¶
All outbound calls are HTTPS, read-only unless stated, and each is optional unless your settings switch it on.
| System | Why | Reference |
|---|---|---|
| Your OpenID Connect identity provider | Sign-in | Settings |
| GitHub (through a read-only GitHub App) or GitLab (read-only group token) | Repository settings, workflow runs and evidence artifacts; GitHub Issues or GitLab Issues when switched on (write) | Connect your organization |
| Sigstore (the public-good trust root, shipped with the image) and GitHub's attestation API | Verifying signed evidence | Evidence model |
| OSV, CISA KEV, FIRST EPSS, endoflife.date | Vulnerability and end-of-life data; no account needed | Configure |
| Evidence storage: S3 (Object Lock) or Azure Blob (immutability policy) | Writing and reading evidence, write-once | Settings |
| Jira, Dependency-Track, DefectDojo, Defender for Cloud, Security Hub, Sentinel, a SIEM over HTTPS or syslog, chat webhooks | Optional plugins | Integrations · Writing a plugin |
The command line¶
The image's aap command (also installed as fortproof). Operators run it inside the deployment
(kubectl exec deploy/fortproof-worker -- aap ...) or from a checkout (uv run aap ...).
| Command | What it does |
|---|---|
aap api · aap hook · aap worker |
Run the web UI and API, the webhook receiver, or the background worker |
aap migrate |
Apply database migrations and create partitions |
aap config load |
Load the rules (catalogue and config) into the database, with their versions |
aap settings check <file> |
Validate an aap.yaml and show the settings it maps to |
aap db provision-logins |
Set the per-process database logins' passwords from the secret store |
aap integrations status · aap integrations run <name> |
What is configured and missing, with the last runs; run one integration now |
aap bootstrap github-app · gitlab · jira · dependency-track · defectdojo |
Create an integration's least-privilege credentials from nothing |
aap bootstrap trust-root |
Refresh the Sigstore trust root used to verify signatures |
aap apps register <owner/repo> |
Register an application from its repository's .security/application.yaml |
aap pipelines export · approve · caller |
Render the shipped workflows, trust a released commit of them, print an application's caller workflow |
aap secrets put <name> |
Store a secret in the secret store |
aap storage init-s3 |
Evaluation only: create an evidence bucket with Object Lock |
aap snapshots backfill |
Compute earlier months' posture snapshots from the evidence on record |
aap demo seed |
Load the demo world |
aap <command> --help prints each command's options.
Plugins¶
A plugin is a Python package that publishes an aap.plugins.Plugin record through the aap.plugins entry-point
group: Writing a plugin.