Reports

HarborGuard reports come in two families:

Technical reports (/api/reports) — generic posture, executive, SLA, and SBOM reports stored in the reports table.
Compliance evidence packs (/api/reports/compliance-pack) — framework-specific bundles stored in the compliance_reports table.

Both kinds expose the same retrieval, sharing, and download endpoints.

Base path: /api/reports

Method	Path	Min role
GET	`/api/reports`	`viewer`
POST	`/api/reports`	`developer`
GET	`/api/reports/{reportId}`	`viewer`
DELETE	`/api/reports/{reportId}`	`admin`
GET	`/api/reports/{reportId}/artifact`	`viewer`
GET	`/api/reports/{reportId}/download`	`viewer`
POST	`/api/reports/{reportId}/regenerate`	`developer`
POST	`/api/reports/{reportId}/share`	`admin`
POST	`/api/reports/compliance-pack`	`admin`
GET	`/api/reports/compliance`	viewer (any)
GET	`/api/reports/executive`	`viewer`
GET	`/api/reports/posture`	`viewer`
GET	`/api/reports/technical`	`viewer`
GET	`/api/reports/sla`	`viewer`
GET	`/api/reports/sla/entries`	`viewer`

GET

/reports

Authorization

`X-API-Key`<token>

Organization API key (hg_ak_*). Created from Settings → API Keys.

In: header

`Authorization`
Required
Bearer <token>

Authorization: Bearer hg_ak_... for organization API keys, or Authorization: Bearer hg_pat_... for Personal Access Tokens that impersonate a specific user.

In: header

`next-auth.session-token`<token>

NextAuth session cookie. Web only — set automatically at sign-in. Not usable for server-to-server.

In: cookie

Query Parameters

`page`integer

Page number (1-indexed)

Default: 1Minimum: 1

`limit`integer

Page size (1–200)

Default: 50Minimum: 1Maximum: 200

`type`string

Value in: "posture" | "executive" | "sla" | "technical" | "sbom_report"

`status`string

`sort`string

Sortable: createdAt, type, status.

curl -X GET "https://harborguard.co/api/reports?page=1&limit=50&type=posture&status=string&sort=createdAt%3Adesc" \
  -H "X-API-Key: <token>"

{
  "data": [
    {
      "id": "string",
      "type": "posture",
      "format": "PDF",
      "status": "QUEUED",
      "scope": "string",
      "frequency": "ONE_TIME",
      "createdAt": "2019-08-24T14:15:22Z",
      "completedAt": "2019-08-24T14:15:22Z",
      "sizeBytes": 0
    }
  ],
  "meta": {
    "page": 1,
    "pageSize": 50,
    "total": 312,
    "totalPages": 7,
    "hasNext": true,
    "hasPrev": true
  },
  "links": {
    "self": "/api/scans?page=1&limit=50",
    "next": "string",
    "prev": "string"
  }
}

POST

/reports

Authorization

`X-API-Key`<token>

Organization API key (hg_ak_*). Created from Settings → API Keys.

In: header

`Authorization`
Required
Bearer <token>

Authorization: Bearer hg_ak_... for organization API keys, or Authorization: Bearer hg_pat_... for Personal Access Tokens that impersonate a specific user.

In: header

`next-auth.session-token`<token>

NextAuth session cookie. Web only — set automatically at sign-in. Not usable for server-to-server.

In: cookie

Request Body

application/jsonRequired

`type`
Required
string

Value in: "posture" | "executive" | "sla" | "technical" | "sbom_report"

`format`string

Default: "PDF"Value in: "PDF" | "CSV" | "JSON" | "XLSX"

`scope`string

Value in: "org" | "registry" | "custom"

`tagIds`array<string>

`sections`array<string>

`frequency`string

Value in: "ONE_TIME" | "DAILY" | "WEEKLY" | "MONTHLY"

`scanId`string

`layerId`string

`packageId`string

curl -X POST "https://harborguard.co/api/reports" \
  -H "X-API-Key: <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "executive",
    "format": "PDF",
    "scope": "org",
    "frequency": "MONTHLY"
  }'

Created

GET

/reports/{reportId}

Authorization

`X-API-Key`<token>

Organization API key (hg_ak_*). Created from Settings → API Keys.

In: header

`Authorization`
Required
Bearer <token>

Authorization: Bearer hg_ak_... for organization API keys, or Authorization: Bearer hg_pat_... for Personal Access Tokens that impersonate a specific user.

In: header

`next-auth.session-token`<token>

NextAuth session cookie. Web only — set automatically at sign-in. Not usable for server-to-server.

In: cookie

Path Parameters

`reportId`
Required
string

curl -X GET "https://harborguard.co/api/reports/string" \
  -H "X-API-Key: <token>"

{
  "data": {
    "id": "string",
    "type": "posture",
    "format": "PDF",
    "status": "QUEUED",
    "scope": "string",
    "frequency": "ONE_TIME",
    "createdAt": "2019-08-24T14:15:22Z",
    "completedAt": "2019-08-24T14:15:22Z",
    "sizeBytes": 0,
    "intelligence": {}
  }
}

DELETE

/reports/{reportId}

Authorization

`X-API-Key`<token>

Organization API key (hg_ak_*). Created from Settings → API Keys.

In: header

`Authorization`
Required
Bearer <token>

Authorization: Bearer hg_ak_... for organization API keys, or Authorization: Bearer hg_pat_... for Personal Access Tokens that impersonate a specific user.

In: header

`next-auth.session-token`<token>

NextAuth session cookie. Web only — set automatically at sign-in. Not usable for server-to-server.

In: cookie

Path Parameters

`reportId`
Required
string

curl -X DELETE "https://harborguard.co/api/reports/string" \
  -H "X-API-Key: <token>"

GET

/reports/{reportId}/artifact

Authorization

`X-API-Key`<token>

Organization API key (hg_ak_*). Created from Settings → API Keys.

In: header

`Authorization`
Required
Bearer <token>

Authorization: Bearer hg_ak_... for organization API keys, or Authorization: Bearer hg_pat_... for Personal Access Tokens that impersonate a specific user.

In: header

`next-auth.session-token`<token>

NextAuth session cookie. Web only — set automatically at sign-in. Not usable for server-to-server.

In: cookie

Path Parameters

`reportId`
Required
string

curl -X GET "https://harborguard.co/api/reports/string/artifact" \
  -H "X-API-Key: <token>"

{}

GET

/reports/{reportId}/download

Authorization

`X-API-Key`<token>

Organization API key (hg_ak_*). Created from Settings → API Keys.

In: header

`Authorization`
Required
Bearer <token>

Authorization: Bearer hg_ak_... for organization API keys, or Authorization: Bearer hg_pat_... for Personal Access Tokens that impersonate a specific user.

In: header

`next-auth.session-token`<token>

NextAuth session cookie. Web only — set automatically at sign-in. Not usable for server-to-server.

In: cookie

Query Parameters

`format`string

Default: "PDF"Value in: "PDF" | "CSV" | "XLSX" | "JSON"

Path Parameters

`reportId`
Required
string

curl -X GET "https://harborguard.co/api/reports/string/download?format=PDF" \
  -H "X-API-Key: <token>"

{}

POST

/reports/{reportId}/regenerate

Authorization

`X-API-Key`<token>

Organization API key (hg_ak_*). Created from Settings → API Keys.

In: header

`Authorization`
Required
Bearer <token>

Authorization: Bearer hg_ak_... for organization API keys, or Authorization: Bearer hg_pat_... for Personal Access Tokens that impersonate a specific user.

In: header

`next-auth.session-token`<token>

NextAuth session cookie. Web only — set automatically at sign-in. Not usable for server-to-server.

In: cookie

Path Parameters

`reportId`
Required
string

curl -X POST "https://harborguard.co/api/reports/string/regenerate" \
  -H "X-API-Key: <token>"

Created

POST

/reports/{reportId}/share

Authorization

`X-API-Key`<token>

Organization API key (hg_ak_*). Created from Settings → API Keys.

In: header

`Authorization`
Required
Bearer <token>

Authorization: Bearer hg_ak_... for organization API keys, or Authorization: Bearer hg_pat_... for Personal Access Tokens that impersonate a specific user.

In: header

`next-auth.session-token`<token>

NextAuth session cookie. Web only — set automatically at sign-in. Not usable for server-to-server.

In: cookie

Request Body

application/jsonOptional

`expiresInHours`integer

Default: 72Minimum: 1Maximum: 720

Path Parameters

`reportId`
Required
string

curl -X POST "https://harborguard.co/api/reports/string/share" \
  -H "X-API-Key: <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "expiresInHours": 168
  }'

POST

/reports/compliance-pack

Authorization

`X-API-Key`<token>

Organization API key (hg_ak_*). Created from Settings → API Keys.

In: header

`Authorization`
Required
Bearer <token>

Authorization: Bearer hg_ak_... for organization API keys, or Authorization: Bearer hg_pat_... for Personal Access Tokens that impersonate a specific user.

In: header

`next-auth.session-token`<token>

NextAuth session cookie. Web only — set automatically at sign-in. Not usable for server-to-server.

In: cookie

Request Body

application/jsonRequired

`templateId`
Required
string

Framework key, e.g. soc2, pci-dss, nist-800-53, hipaa, fedramp, iso-27001, cmmc, cis-docker.

`name`
Required
string

`period`
Required
object

`scope`
Required
object

Registry / org / image filter.

`selectedSections`array<string>

`outputFormats`array<string>

Default: ["PDF","JSON"]

curl -X POST "https://harborguard.co/api/reports/compliance-pack" \
  -H "X-API-Key: <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "templateId": "string",
    "name": "string",
    "period": {
      "start": "2019-08-24",
      "end": "2019-08-24"
    },
    "scope": {},
    "selectedSections": [
      "string"
    ],
    "outputFormats": [
      "PDF",
      "JSON"
    ]
  }'

curl -X GET "https://harborguard.co/api/reports/sla/entries" \
  -H "X-API-Key: <token>"

X-API-Key<token>

AuthorizationRequiredBearer <token>

next-auth.session-token<token>

pageinteger

limitinteger

typestring

statusstring

sortstring

Response

TypeScript

X-API-Key<token>

AuthorizationRequiredBearer <token>

next-auth.session-token<token>

typeRequiredstring

formatstring

scopestring

tagIdsarray<string>

sectionsarray<string>

frequencystring

scanIdstring

layerIdstring

packageIdstring

X-API-Key<token>

AuthorizationRequiredBearer <token>

next-auth.session-token<token>

reportIdRequiredstring

Response

TypeScript

X-API-Key<token>

AuthorizationRequiredBearer <token>

next-auth.session-token<token>

reportIdRequiredstring

X-API-Key<token>

AuthorizationRequiredBearer <token>

next-auth.session-token<token>

reportIdRequiredstring

Response

TypeScript

X-API-Key<token>

AuthorizationRequiredBearer <token>

next-auth.session-token<token>

formatstring

reportIdRequiredstring

Response

TypeScript

X-API-Key<token>

AuthorizationRequiredBearer <token>

next-auth.session-token<token>

reportIdRequiredstring

X-API-Key<token>

AuthorizationRequiredBearer <token>

next-auth.session-token<token>

expiresInHoursinteger

reportIdRequiredstring

X-API-Key<token>

AuthorizationRequiredBearer <token>

next-auth.session-token<token>

templateIdRequiredstring

nameRequiredstring

periodRequiredobject

Attributes

scopeRequiredobject

Attributes

selectedSectionsarray<string>

outputFormatsarray<string>

X-API-Key<token>

AuthorizationRequiredBearer <token>

next-auth.session-token<token>

X-API-Key<token>

AuthorizationRequiredBearer <token>

next-auth.session-token<token>

X-API-Key<token>

AuthorizationRequiredBearer <token>

next-auth.session-token<token>

X-API-Key<token>

AuthorizationRequiredBearer <token>

next-auth.session-token<token>

X-API-Key<token>

AuthorizationRequiredBearer <token>

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>

`page`integer

`limit`integer

`type`string

`status`string

`sort`string

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>

`type`
Required
string

`format`string

`scope`string

`tagIds`array<string>

`sections`array<string>

`frequency`string

`scanId`string

`layerId`string

`packageId`string

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>

`reportId`
Required
string

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>

`reportId`
Required
string

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>

`reportId`
Required
string

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>

`format`string

`reportId`
Required
string

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>

`reportId`
Required
string

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>

`expiresInHours`integer

`reportId`
Required
string

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>

`templateId`
Required
string

`name`
Required
string

`period`
Required
object

`scope`
Required
object

`selectedSections`array<string>

`outputFormats`array<string>

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>

`X-API-Key`<token>

`Authorization`
Required
Bearer <token>

`next-auth.session-token`<token>