Authentication

GET /api/v1/stigs is public.

GET /api/v1/stigs/{slug}/download requires a SAMS bearer token in the Authorization header.

Authorization: Bearer ss_token_app_your_application_token

Validation Flow

Protected requests are validated against:

https://sams.opencontrols.ai/api/v1/validate

If the bearer token is missing, malformed, expired, invalid, or attached to an inactive subscription, Stigviewer returns 401 Unauthorized.

Error Shape

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing or invalid Authorization header"
  }
}