STIGs

Access Security Technical Implementation Guides (STIGs) programmatically.

List STIGs

List all available STIGs with metadata. This endpoint requires a valid SAMS token.

GET /api/v1/stigs

Parameters

Name
search
Type
string
Description
Filter by title or slug (case-insensitive).
Name
page
Type
integer
Description
Page number (default: 1).
Name
limit
Type
integer
Description
Items per page (default: 100, max: 150).

Response

{
  "stigs": [
    {
      "slug": "active_directory_domain",
      "title": "Active Directory Domain STIG",
      "version": "3",
      "releaseDate": "2024-09-13",
      "findingCount": 75
    }
  ],
  "pagination": {
    "page": 1,
    "limit": 100,
    "total": 371,
    "totalPages": 4
  }
}

Download STIG

Download a complete STIG as a CKLB checklist, raw JSON, CSV, or XML. This endpoint requires a valid SAMS token.

GET /api/v1/stigs/{slug}/download

Parameters

Name
slug
Type
string
Description
The unique identifier for the STIG (e.g., microsoft_windows_server_2022).
Name
format
Type
string
Description
Export format:
- cklb (default): a DISA CKLB v1.0 checklist (.cklb), the JSON checklist format STIG Viewer 3 and C3PAO assessor tools import. Every rule starts at status: "not_reviewed".
- json: the raw benchmark record (all groups and profiles). This is a different shape from cklb, so use it for data processing, not for import into checklist tooling.
- csv, xml: flat exports of the findings.

Response

{
  "title": "Microsoft Windows Server 2022 Security Technical Implementation Guide",
  "id": "b1f2...uuid",
  "cklb_version": "1.0",
  "active": false,
  "mode": 1,
  "has_path": true,
  "target_data": { "host_name": "", "ip_address": "", "role": "None", "...": "" },
  "stigs": [
    {
      "stig_name": "Microsoft Windows Server 2022 Security Technical Implementation Guide",
      "stig_id": "Windows_Server_2022_STIG",
      "release_info": "Release: 4 Benchmark Date: 05 Feb 2026",
      "version": "2",
      "uuid": "c3d4...uuid",
      "size": 285,
      "rules": [
        {
          "group_id": "V-254123",
          "rule_id": "SV-254123r123456_rule",
          "rule_version": "WN22-00-000010",
          "severity": "high",
          "rule_title": "Windows Server 2022 must...",
          "discussion": "...",
          "check_content": "...",
          "fix_text": "...",
          "ccis": ["CCI-000366"],
          "status": "not_reviewed",
          "comments": "",
          "finding_details": "",
          "uuid": "d5e6...uuid"
        }
      ]
    }
  ]
}

Page through a single STIG's individual controls (its rules/findings) without downloading the whole benchmark. Useful when tooling only needs a subset of rules. This endpoint requires a valid SAMS token.

GET /api/v1/stigs/{slug}/controls

Parameters

Name
slug
Type
string
Description
The STIG identifier (e.g., red_hat_enterprise_linux_9).
Name
page
Type
integer
Description
Page number (default: 1).
Name
limit
Type
integer
Description
Items per page (default: 50, max: 100).
Name
severity
Type
string
Description
Comma-separated severity filter: high, medium, low.
Name
search
Type
string
Description
Case-insensitive filter on group ID, rule ID, or title.

Each entry uses the same finding shape as the single STIG response. stig.findingCount is the STIG's total control count; pagination.total reflects the count after any severity/search filters. Returns 404 if the slug is not found.

Response

{
  "stig": {
    "slug": "red_hat_enterprise_linux_9",
    "title": "Red Hat Enterprise Linux 9 Security Technical Implementation Guide",
    "version": "V2R8",
    "status": "accepted",
    "releaseDate": "2026-02-05",
    "findingCount": 446
  },
  "findings": [
    {
      "groupId": "V-257777",
      "title": "RHEL 9 must be a vendor-supported release.",
      "description": "...",
      "severity": "high",
      "ruleId": "SV-257777r1155676_rule",
      "ruleVersion": "RHEL-09-211010",
      "ruleTitle": "RHEL 9 must be a vendor-supported release.",
      "vulnDiscussion": "...",
      "fixText": "...",
      "checkContent": "...",
      "ruleIdent": "CCI-000366",
      "ruleIdents": ["CCI-000366"]
    }
  ],
  "pagination": { "page": 1, "limit": 50, "total": 28, "totalPages": 1 }
}

ruleIdents lists every CCI a rule satisfies; ruleIdent is the first CCI, kept for backward compatibility. Rules mapping to multiple CCIs (common in real STIGs) return the full set, e.g. V-257779 returns ["CCI-000048","CCI-001384","CCI-001385","CCI-001386","CCI-001387","CCI-001388"]. The same two fields appear on the single-STIG (GET /api/v1/stigs/{slug}) and list (GET /api/v1/lists/{id}/stigs) finding shapes, and CKLB exports carry the full list in each rule's ccis.

Batch fetch STIGs

Fetch up to 50 STIGs (including their findings) in a single request. Requires a valid SAMS token.

POST /api/v1/stigs/batch

Request body

Name
slugs
Type
array
Description
Array of STIG slugs (max: 50).

Response

{
  "stigs": [
    {
      "slug": "red_hat_enterprise_linux_8",
      "benchmarkId": "red_hat_enterprise_linux_8-benchmarkId",
      "title": "RHEL 8 STIG",
      "description": "...",
      "version": "1.5.0",
      "status": "Accepted",
      "releaseDate": "2024-11-15",
      "findingCount": 342,
      "profiles": [
        { "profileId": "P-123", "title": "STIG Profile", "description": "..." }
      ],
      "findings": [
        {
          "groupId": "V-214010",
          "title": "Audit daemon must...",
          "severity": "high",
          "ruleId": "SV-214010r814063_rule",
          "ruleTitle": "The Audit daemon must...",
          "vulnDiscussion": "...",
          "fixText": "...",
          "checkContent": "..."
        }
      ]
    }
  ],
  "meta": {
    "requested": 2,
    "found": 1,
    "notFound": ["nonexistent-slug"]
  }
}

Returns 400 if slugs is missing, empty, or longer than 50.

STIG catalog stats

Return aggregate counts across the current-version STIG catalog. The response is cached for five minutes. Requires a valid SAMS token.

GET /api/v1/stigs/stats

Response

{
  "catalog": {
    "totalBenchmarks": 456,
    "totalFindings": 87234,
    "totalProfiles": 1023
  },
  "severity": {
    "high": 12543,
    "medium": 45678,
    "low": 29013
  },
  "latestRelease": {
    "slug": "red_hat_enterprise_linux_9",
    "title": "RHEL 9 STIG",
    "releaseDate": "2024-11-20"
  }
}

STIG changelog

Track STIG version releases without polling every STIG. Returns current versions ordered by release date; pass since to get only what shipped after your last sync (for cache invalidation / rebuilds). This endpoint requires a valid SAMS token.

GET /api/v1/stigs/changelog

Parameters

Name
since
Type
string
Description
ISO date. Only include versions with a release date on or after this (e.g. 2026-01-01).
Name
slug
Type
string
Description
Restrict to a single STIG (its stable slug).
Name
page
Type
integer
Description
Page number (default: 1).
Name
limit
Type
integer
Description
Items per page (default: 50, max: 100).

releaseDate is the DISA benchmark date and is the authoritative "when did this version ship" signal. previousVersion is populated when the prior version is retained and is null otherwise (version history accrues over time as STIGs are updated).

Response

{
  "changes": [
    {
      "slug": "microsoft_windows_11",
      "title": "Microsoft Windows 11 Security Technical Implementation Guide",
      "newVersion": "V2R7",
      "previousVersion": "V1R5",
      "releaseDate": "2026-02-12"
    },
    {
      "slug": "red_hat_enterprise_linux_9",
      "title": "Red Hat Enterprise Linux 9 Security Technical Implementation Guide",
      "newVersion": "V2R8",
      "previousVersion": null,
      "releaseDate": "2026-02-05"
    }
  ],
  "pagination": { "page": 1, "limit": 50, "total": 82, "totalPages": 2 }
}

STIGs API playground

Experiment with listing and downloading STIGs using the API.

Live playground

Request

curl "https://www.stigviewer.com/api/v1/stigs?page=1&limit=10"

Method

GET

Endpoint

Access token (Authorization: Bearer)

Page

LimitMax: 150

Response

Send a request to see the live response here.

STIGs

List STIGs

Parameters

Response

Response

Download STIG

Parameters

Response

List STIG controls

Parameters

Response

Response

Batch fetch STIGs

Request body

Response

Response

STIG catalog stats

Response

Response

STIG changelog

Parameters

Response

Response

STIGs API playground

STIGs API playground

Request