DevGuard CSAF API#

The DevGuard CSAF API serves Common Security Advisory Framework (CSAF) documents for your assets. Reports are generated on demand from your current assessments rather than stored, so a request always reflects the present state.

Beyond the endpoints below, DevGuard serves the full CSAF distribution structure — provider-metadata.json, the aggregator listing, per-year indexes, changes.csv, and each advisory alongside its OpenPGP signature and checksums. Those paths and how to consume another vendor's provider are documented in CSAF Reports in DevGuard.

---

Related Documentation#

• CSAF Reports in DevGuard — the distribution endpoints and upstream consumption
• CSAF & VEX Standards — what a CSAF document contains and how it differs from CycloneDX VEX
• Export & Publish VEX — enabling public access and publishing as a trusted provider
• VEX Rules API — the decisions these documents report
• Use the DevGuard API — authentication and conventions
• DevGuard API Reference