Docs

REST API

Every request and response shape below matches what the API returns, not a simplified version of it.

Authentication

Every request carries an Authorization: Bearer <api key> header. Generate a key from Settings, API keys, in the dashboard. A key is shown once, at creation, and stored hashed afterward.

100 requests per minute per key. A request over that limit gets a 429 response.

Control checks

List your control checks

GET /api/v1/control-checks returns every control check for your organization, newest first.

curl https://app.verazo.eu/api/v1/control-checks \
  -H "Authorization: Bearer <api key>"

Create a control check

POST /api/v1/control-checks creates one control check, with the same validation the dashboard's own new-check form applies. A controlId that does not match one of the checks in the control-check catalog is rejected with a 400 response, never run.

curl -X POST https://app.verazo.eu/api/v1/control-checks \
  -H "Authorization: Bearer <api key>" \
  -H "Content-Type: application/json" \
  -d '{
    "controlId": "github-branch-protection-enabled",
    "target": "acme-corp/backend@main",
    "integrationId": "int_..."
  }'

target is a required string whose exact format depends on the check (see each check category page for the exact format). integrationId is required for any check that needs a stored credential, and omitted for a check like tls-certificate-valid that needs none. schedule is an optional cron expression. Leaving it out creates a one-off check you trigger manually.

Evidence

GET /api/v1/evidence returns every evidence record for your organization, newest first, optionally filtered to one check with ?controlCheckId=. The dashboard's own Evidence page also supports a point-in-time view by date. That view is not yet exposed through this API.

Billing

GET /api/v1/billing returns your organization's current Stripe subscription status, read live from Stripe on every call, never cached into a status this platform could show stale.