Veriom API reference

Every endpoint of the Veriom API, with parameters, responses and code samples, and a playground that sends real requests with your API token.

The reference covers 484 endpoints, generated from the API's own contract, so it changes when the API does. Requests go to https://api.veriom.ai.

Authenticate

Create a token in Settings → API tokens with the scopes your integration needs (see API tokens). Send it in the Authorization header. This request returns the token's workspace and scopes:

curl https://api.veriom.ai/v1/api-tokens/current \
  -H "Authorization: Bearer $VERIOM_API_TOKEN"

curl https://api.veriom.ai/v1/api-tokens/current \  -H "Authorization: Bearer $VERIOM_API_TOKEN"

Try a request

Open an endpoint, paste your token under Authorization, fill in the parameters and click Send. The request goes from your browser straight to https://api.veriom.ai and sends no cookies. Your token stays in this browser tab until you close it. A request that changes something really changes it, as it would from your own code.

Your role still applies

A token never does more than the role of the person who created it. A request outside the token's scopes or that person's role answers 403 and names the scope it needs.

Conventions

Versioning. Every path starts with /v1, and each response carries the version in X-API-Version.
Errors. A failed request answers application/problem+json with a code and a detail. Look the code up in Troubleshooting.
Pages. Lists take limit and cursor. Pass the next_cursor of one page to get the next; it is empty on the last page.
Retries. Requests that start work, such as an audit or a fix, take an Idempotency-Key header. Repeat the same key to retry without starting the work twice. Long-running work answers 202 Accepted.
Rate limits. Responses carry RateLimit headers. Past the limit, the API answers 429 with Retry-After.

Token scopes

Scope	Allows
`audits:read`	Inspect audit status, progress, evidence coverage, and completed artifacts.
`audits:write`	Create, retry, cancel, and otherwise operate workspace audits.
`decisions:approve`	Approve governed architecture decisions when the caller's role permits it.
`decisions:read`	Inspect architecture decisions and their evidence trail.
`decisions:write`	Prepare and update architecture decisions.
`evidence:write`	Submit typed, workspace-bound architecture evidence.
`exports:write`	Create deterministic exports from approved workspace artifacts.
`findings:read`	Inspect findings, scores, evidence, comments, and lifecycle state.
`findings:write`	Classify, assign, comment on, and update findings.
`ingestion:read`	Inspect evidence-ingestion capability, status, and diagnostics.
`members:read`	Inspect workspace members and their effective access.
`policies:read`	Inspect workspace policy and its versioned configuration.
`policies:write`	Update workspace policy when the caller's role permits it.
`remediations:approve`	Approve governed remediation proposals.
`remediations:read`	Inspect remediation proposals, checks, and delivery state.
`remediations:write`	Prepare and update bounded remediation proposals.
`reports:approve`	Approve canonical reports for governed release.
`reports:read`	Inspect reports and their evidence-backed sections.
`repositories:read`	Inspect authorized repository registrations and sync state.
`repositories:write`	Register and manage authorized repository connections.
`uploads:write`	Create and complete validated artifact uploads.
`usage:read`	Inspect workspace quotas, model usage, and attributable cost.
`workflow_actions:approve`	Approve a separately requested external workflow action.
`workflow_actions:read`	Inspect workflow-action grants, attempts, and results.
`workflow_actions:request`	Prepare a bounded ticket, ownership, or policy-exception action.

For code generators and agents

The full contract is at openapi.json, for client generators and tools. An AI assistant can work with Veriom through MCP instead: see Use Veriom from an AI assistant.

API reference

Authenticate

Try a request

Start with

Workspaces

Audits

Findings

Remediations

Conventions

Token scopes

For code generators and agents