{ "openapi": "3.1.0", "info": { "title": "BrandShyp Compliance Data API", "version": "1.0.0", "summary": "DISA STIG to NIST 800-53 mapping, and NIST 800-171 controls with DoD SPRS weights.", "description": "Two read-only compliance datasets, machine-readable.\n\n1. **STIG to NIST 800-53** — a mapping from DISA STIG rules through DoD CCIs to NIST SP 800-53 controls, with a lookup for one control's rules.\n2. **NIST SP 800-171 rev2** — all 110 controls with the DoD Assessment Methodology weights used to compute a SPRS score.\n\nAll source material is public U.S. Government work; the cross-reference and compilation are by BrandShyp and provided as-is. Verify against authoritative DISA/NIST sources for accreditation use.", "contact": { "name": "BrandShyp", "url": "https://brandshyp.org/contact-us/" }, "license": { "name": "CC BY 4.0", "url": "https://creativecommons.org/licenses/by/4.0/" } }, "externalDocs": { "description": "Developer portal", "url": "https://brandshyp.org/developers/" }, "servers": [ { "url": "https://brandshyp.org/api/v1", "description": "Production" } ], "security": [], "tags": [ { "name": "stig-nist", "description": "DISA STIG to NIST 800-53 mapping" }, { "name": "nist-800-171", "description": "NIST SP 800-171 rev2 controls + DoD weights" } ], "paths": { "/stig-nist": { "get": { "operationId": "getStigDiscovery", "tags": [ "stig-nist" ], "summary": "STIG to 800-53 discovery document", "responses": { "200": { "description": "Discovery document.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StigDiscovery" } } } }, "429": { "description": "Too many requests. Public endpoints are rate-limited at the CDN edge.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Dataset unavailable.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/stig-nist/mapping": { "get": { "operationId": "getStigMapping", "tags": [ "stig-nist" ], "summary": "The full STIG to CCI to 800-53 mapping cube", "responses": { "200": { "description": "The mapping cube.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StigMapping" } } } }, "429": { "description": "Too many requests. Public endpoints are rate-limited at the CDN edge.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Dataset unavailable.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/stig-nist/controls": { "get": { "operationId": "getStigControls", "tags": [ "stig-nist" ], "summary": "800-53 controls with count of STIG rules mapped to each", "responses": { "200": { "description": "The controls list.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StigControlList" } } } }, "429": { "description": "Too many requests. Public endpoints are rate-limited at the CDN edge.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Dataset unavailable.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/stig-nist/benchmarks": { "get": { "operationId": "getStigBenchmarks", "tags": [ "stig-nist" ], "summary": "The STIG benchmarks covered", "responses": { "200": { "description": "The benchmarks list.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StigBenchmarks" } } } }, "429": { "description": "Too many requests. Public endpoints are rate-limited at the CDN edge.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "503": { "description": "Dataset unavailable.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/stig-nist/control/{id}": { "get": { "operationId": "getStigControl", "tags": [ "stig-nist" ], "summary": "Lookup the CCIs and STIG rules for one 800-53 control", "parameters": [ { "name": "id", "in": "path", "required": true, "description": "A NIST 800-53 control identifier, e.g. AC-2.", "schema": { "type": "string", "pattern": "^[A-Za-z]{2}-[0-9]+$", "examples": [ "AC-2" ] } } ], "responses": { "200": { "description": "The control, its CCIs, and mapped STIG rules.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StigControlDetail" } } } }, "400": { "description": "Malformed control id.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "404": { "description": "Control not present in the mapping.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } }, "429": { "description": "Too many requests. Public endpoints are rate-limited at the CDN edge.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/nist-800-171": { "get": { "operationId": "getN171Discovery", "tags": [ "nist-800-171" ], "summary": "NIST 800-171 discovery document", "responses": { "200": { "description": "Discovery document.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/N171Discovery" } } } }, "429": { "description": "Too many requests. Public endpoints are rate-limited at the CDN edge.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } }, "/nist-800-171/controls": { "get": { "operationId": "getN171Controls", "tags": [ "nist-800-171" ], "summary": "All 110 controls, by family, with DoD weights", "responses": { "200": { "description": "The controls, grouped by family.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/N171Controls" } } } }, "429": { "description": "Too many requests. Public endpoints are rate-limited at the CDN edge.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } } } } } } }, "components": { "schemas": { "StigDiscovery": { "type": "object", "properties": { "api": { "type": "string" }, "version": { "type": "string" }, "status": { "type": "string" }, "description": { "type": "string" }, "coverage": { "type": "object", "properties": { "stig_benchmarks": { "type": "integer" }, "stig_rules": { "type": "integer" }, "cci_items": { "type": "integer" }, "controls_800_53": { "type": "integer" }, "mapping_chain": { "type": "string" } } }, "source": { "type": "object" }, "license": { "$ref": "#/components/schemas/License" } } }, "StigMapping": { "type": "object", "description": "meta.stigs is the benchmark list; ctrl maps control id to title; cci maps a CCI to its 800-53 controls (key \"4\") and definition; rule maps a STIG rule id to its STIG id (s), benchmark index (b), title (t), CCIs (c), and severity (v).", "properties": { "meta": { "type": "object" }, "ctrl": { "type": "object" }, "cci": { "type": "object" }, "rule": { "type": "object" } } }, "StigControlList": { "type": "object", "properties": { "count": { "type": "integer" }, "controls": { "type": "array", "items": { "type": "object", "properties": { "control": { "type": "string", "examples": [ "AC-2" ] }, "title": { "type": "string" }, "rules_mapped": { "type": "integer" } } } } } }, "StigControlDetail": { "type": "object", "properties": { "control": { "type": "string" }, "title": { "type": "string" }, "ccis": { "type": "array", "items": { "type": "object", "properties": { "cci": { "type": "string", "examples": [ "CCI-000015" ] }, "definition": { "type": [ "string", "null" ] } } } }, "rules_mapped": { "type": "integer" }, "rules": { "type": "array", "items": { "$ref": "#/components/schemas/StigRule" } } } }, "StigRule": { "type": "object", "properties": { "rule": { "type": "string", "examples": [ "V-242381" ] }, "stig_id": { "type": [ "string", "null" ] }, "title": { "type": [ "string", "null" ] }, "severity": { "type": [ "string", "null" ], "examples": [ "medium" ] }, "benchmark": { "type": [ "string", "null" ] }, "ccis": { "type": "array", "items": { "type": "string" } } } }, "StigBenchmarks": { "type": "object", "properties": { "count": { "type": "integer" }, "benchmarks": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "title": { "type": "string" }, "ver": { "type": "string" }, "rules": { "type": "integer" } } } } } }, "N171Discovery": { "type": "object", "properties": { "api": { "type": "string" }, "version": { "type": "string" }, "status": { "type": "string" }, "description": { "type": "string" }, "coverage": { "type": "object" }, "caveat": { "type": "string" }, "license": { "$ref": "#/components/schemas/License" } } }, "N171Controls": { "type": "object", "properties": { "count": { "type": "integer" }, "families": { "type": "integer" }, "note": { "type": "string" }, "data": { "type": "array", "items": { "type": "object", "properties": { "family": { "type": "string", "examples": [ "3.1 Access Control" ] }, "controls": { "type": "array", "items": { "$ref": "#/components/schemas/N171Control" } } } } } } }, "N171Control": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "examples": [ "3.1.1" ] }, "title": { "type": "string" }, "weight": { "type": "integer", "description": "DoD deduction (5, 3, or 1) if unmet.", "examples": [ 5 ] }, "partial": { "type": "boolean", "description": "Whether a documented deduct-3 partial state applies." } } }, "License": { "type": "object", "properties": { "name": { "type": "string" }, "url": { "type": "string", "format": "uri" }, "attribution": { "type": "string" } } }, "Error": { "type": "object", "properties": { "error": { "type": "string" }, "status": { "type": "integer" } } } } } }