API References - Vigolium Documentation

Browse the full Vigolium API surface below. Each row links to a dedicated reference page with request/response details, parameters, and examples. Base URL: http://localhost:9002 (default)

General

Category	Description	Reference
Overview	Server startup, health checks, authentication, and common endpoints	View →
Authentication	Bearer token auth, file-based user system, roles, and login	View →

Core Endpoints

Category	Description	Reference
Projects	Multi-tenant data isolation, all scan data is scoped to a project	View →
Scan	Single-target scans, scan management, history, pause/resume, and logs	View →
Findings	List, retrieve, and delete vulnerability findings with filtering	View →
HTTP Records	Request/response records with filtering, pagination, and sorting	View →
Ingestion	Import data via URLs, curl commands, HAR, OpenAPI, Burp, Postman	View →

AI & Agent

Category	Description	Reference
Agent	Query, autopilot, swarm, and audit run modes with SSE streaming and OpenAI-compatible chat	View →

Configuration & Scope

Category	Description	Reference
Config	View and update server configuration with hot reload support	View →
Scope	Control which HTTP records are in scope for scanning	View →
Modules	List active and passive scanner modules with search and tag filtering	View →

Integrations & Extensions

Category	Description	Reference
Extensions	Manage JavaScript and YAML extensions for custom scanning logic	View →
Storage	Cloud object storage for source code uploads and scan result archives	View →

Data & Diagnostics

Category	Description	Reference
Stats	Aggregated statistics on HTTP records, modules, and findings	View →
OAST Interactions	Out-of-band security testing interactions from interactsh callbacks	View →
Diagnostics	System readiness check (DB, agent provider, tools, dirs)	View →
Database	Unified CRUD API for any database table with pagination and filtering	View →

Security WarningImportant security considerations when running Vigolium: agent mode is intentionally unsandboxed and extensions can execute arbitrary commands.