cyber.trackr.live

Appearance

API Operations ​

The cyber.trackr.live API provides comprehensive access to cybersecurity compliance data including DISA STIGs, SRGs, RMF controls, CCIs, and SCAP documents.

  • Getting Started Guide - Make your first API call in 30 seconds
  • Base URL: https://cyber.trackr.live/api
  • Authentication: None required (public API)
  • Response Format: JSON

Common Endpoints ​

Most Used ​

http
GET /stig                                    # List all STIGs/SRGs
GET /stig/{title}/{version}/{release}        # Get specific STIG
GET /rmf/5                                   # List RMF Rev 5 controls
GET /cci                                     # List all CCIs

Endpoint Categories ​

📋 STIG & SRG Documents ​

  • List Documents: Get all available STIGs and SRGs
  • Document Summary: Get document metadata and requirement list
  • Requirement Details: Get full requirement specification with check/fix text

🔒 RMF Controls ​

  • RMF Rev 4 & 5: Access NIST RMF control families and individual controls
  • Control Details: Full control text, implementation guidance, and relationships

🎯 CCI References ​

  • CCI List: Browse Common Control Identifiers
  • CCI Details: Get detailed CCI information and RMF mappings

📊 SCAP Content ​

  • SCAP Documents: Security Content Automation Protocol documents
  • SCAP Requirements: Individual SCAP requirement details

Rate Limits & Performance ​

  • No Authentication Required: All endpoints are publicly accessible
  • Rate Limits: Please be respectful with request frequency
  • Response Format: All responses are JSON
  • CORS Enabled: Safe for browser-based applications

Interactive Documentation ​

The interactive API documentation below allows you to:

  • ✅ Try requests directly from your browser
  • ✅ See real response data from the live API
  • ✅ Explore all endpoints with full parameter details
  • ✅ Copy working code examples in multiple languages
v1.0.3

Cyber Trackr API​

Download OpenAPI Document

Complete OpenAPI 3.1.1 specification for cyber.trackr.live API.
This API provides access to DISA STIGs, SRGs, RMF controls, CCIs, and SCAP data.

DISA Cybersecurity Ecosystem Hierarchy

NIST RMF Controls (high-level policy framework)
    ↓ (decomposed into atomic, testable statements)
CCIs (Control Correlation Identifiers - bridge policy to implementation)
    ↓ (grouped by technology class into generic requirements)  
SRGs (Security Requirements Guides - technology class "what" to do)
    ↓ (implemented as vendor-specific "how" to do it)
STIGs (Security Technical Implementation Guides - vendor/product specific)
    ↓ (automated versions for scanning tools)
SCAP (Security Content Automation Protocol documents)

Critical Relationships

  • RMF Controls contain assessment procedures that reference CCIs
  • CCIs map back to RMF Controls and forward to STIG/SRG requirements
  • SRGs define generic technology requirements that STIGs implement specifically
  • V-IDs can appear in both SRG and corresponding STIG (same requirement, different specificity)
  • SV-IDs are XCCDF rule identifiers with revision tracking across document releases

Contact​

Community OpenAPI Documentation

Servers​

https://cyber.trackr.live/apiProduction server (default)
https://{subdomain}.trackr.live/apiConfigurable server endpoint

API Documentation​

Self-documenting API root endpoint

Operations​

GET/

Get API documentation​

GET
/

Returns self-documenting schema showing all available endpoints

Responses​

API endpoint documentation

application/json
JSON
{
"server_api_root": "https://cyber.trackr.live/api",
"additionalProperties": "string"
}

Playground​

Samples​

Documents​

Security Technical Implementation Guides (STIGs) and Security Requirements Guides (SRGs)

Operations​

GET/stigGET/stig/{title}/{version}/{release}GET/stig/{title}/{version}/{release}/{vuln}

List all STIGs and SRGs​

GET
/stig

Returns complete list of Security Technical Implementation Guides (STIGs) and
Security Requirements Guides (SRGs). Note: These are mixed in one endpoint.

Responses​

Complete list of STIGs and SRGs grouped by document name

application/json
JSON
{
"additionalProperties": [
]
}

Playground​

Samples​

Get STIG or SRG document details​

GET
/stig/{title}/{version}/{release}

Returns complete document with all requirements

Parameters​

Path Parameters

title*

Document title exactly as it appears in the list endpoint

Typestring
Required
Example"Juniper_SRX_Services_Gateway_ALG"
Min Length1
Max Length200
version*

Major version number of the document

Typestring
Required
Example"3"
Pattern"^\\d+$"
release*

Release number within the version

Typestring
Required
Example"3"
Pattern"^\\d+(\\.\\d+)?$"

Responses​

Complete document details with all requirements

application/json
JSON
{
"id": "Juniper_SRX_SG_ALG_STIG",
"title": "Juniper SRX Services Gateway ALG Security Technical Implementation Guide",
"description": "string",
"status": "accepted",
"published": "2024-12-19",
"requirements": {
"additionalProperties": {
}
}
}

Playground​

Server
Variables
Key
Value

Samples​

Get individual STIG/SRG requirement details​

GET
/stig/{title}/{version}/{release}/{vuln}

Returns complete details for a specific requirement

Parameters​

Path Parameters

title*

Document title exactly as it appears in the list endpoint

Typestring
Required
Example"Juniper_SRX_Services_Gateway_ALG"
Min Length1
Max Length200
version*

Major version number of the document

Typestring
Required
Example"3"
Pattern"^\\d+$"
release*

Release number within the version

Typestring
Required
Example"3"
Pattern"^\\d+(\\.\\d+)?$"
vuln*

Vulnerability/Requirement ID (V-XXXXXX format)

Typestring
Required
Example"V-214518"
Pattern"^V-\\d{6}$"

Responses​

Complete requirement details

application/json
JSON
{
"id": "V-214518",
"rule": "SV-214518r997541_rule",
"severity": "string",
"requirement-title": "string",
"requirement-description": "string",
"mitigation-statement": "string",
"identifiers": [
[
"V-66003",
"SV-80493",
"CCI-000213"
]
],
"check-text": "string",
"fix-text": "string",
"check-id": "string",
"fix-id": "string",
"group": "string",
"version": "string",
"stig": "string",
"stig-title": "string",
"stig-description": "string",
"stig-published": "string",
"stig-status": "string"
}

Playground​

Server
Variables
Key
Value

Samples​

RMF Controls​

Risk Management Framework controls (NIST 800-53 rev 4 & 5)

Operations​

GET/rmf/4GET/rmf/5GET/rmf/4/{control}GET/rmf/5/{control}

List RMF revision 4 controls​

GET
/rmf/4

Returns all Risk Management Framework revision 4 controls with titles

Responses​

Complete list of RMF rev 4 controls

application/json
JSON
{
"controls": {
"additionalProperties": "string"
}
}

Playground​

Samples​

List RMF revision 5 controls​

GET
/rmf/5

Returns all Risk Management Framework revision 5 controls with titles

Responses​

Complete list of RMF rev 5 controls

application/json
JSON
{
"controls": {
"additionalProperties": "string"
}
}

Playground​

Samples​

Get RMF revision 4 control details​

GET
/rmf/4/{control}

Returns complete RMF control details including CCI mappings

Parameters​

Path Parameters

control*

RMF control identifier (family-number format)

Typestring
Required
Example"AC-1"
Pattern"^[A-Z]+-\\d+$"

Responses​

Complete RMF control details with CCI mappings

application/json
JSON
{
"number": "AC-1",
"title": "POLICY AND PROCEDURES",
"family": "ACCESS CONTROL",
"baseline": [
[
"LOW",
"MODERATE",
"HIGH",
"PRIVACY"
]
],
"statements": "string",
"assessment_procedures": [
{
"assessment_procedures": "AC-1.3",
"cci": "CCI-000001",
"description": "string"
}
]
}

Playground​

Server
Variables
Key
Value

Samples​

Get RMF revision 5 control details​

GET
/rmf/5/{control}

Returns complete RMF control details including CCI mappings

Parameters​

Path Parameters

control*

RMF control identifier (family-number format)

Typestring
Required
Example"AC-1"
Pattern"^[A-Z]+-\\d+$"

Responses​

Complete RMF control details with CCI mappings

application/json
JSON
{
"number": "AC-1",
"title": "POLICY AND PROCEDURES",
"family": "ACCESS CONTROL",
"baseline": [
[
"LOW",
"MODERATE",
"HIGH",
"PRIVACY"
]
],
"statements": "string",
"assessment_procedures": [
{
"assessment_procedures": "AC-1.3",
"cci": "CCI-000001",
"description": "string"
}
]
}

Playground​

Server
Variables
Key
Value

Samples​

SCAP​

Security Content Automation Protocol documents

Operations​

GET/scapGET/scap/{title}/{version}/{release}GET/scap/{title}/{version}/{release}/{vuln}

List all SCAP documents​

GET
/scap

Returns list of Security Content Automation Protocol documents.
These are automated scanning versions of STIGs.

Responses​

List of SCAP documents grouped by name

application/json
JSON
{
"additionalProperties": [
]
}

Playground​

Samples​

Get SCAP document details​

GET
/scap/{title}/{version}/{release}

Returns complete SCAP document with all requirements (same structure as STIG)

Parameters​

Path Parameters

title*

Document title exactly as it appears in the list endpoint

Typestring
Required
Example"U_MS_Windows_10_V3R2_STIG_SCAP_1-2_Benchmark"
Min Length1
Max Length200
version*

Major version number of the document

Typestring
Required
Example"3"
Pattern"^\\d+$"
release*

Release number within the version

Typestring
Required
Example"2"
Pattern"^\\d+(\\.\\d+)?$"

Responses​

Complete SCAP document details

application/json
JSON
{
"id": "Juniper_SRX_SG_ALG_STIG",
"title": "Juniper SRX Services Gateway ALG Security Technical Implementation Guide",
"description": "string",
"status": "accepted",
"published": "2024-12-19",
"requirements": {
"additionalProperties": {
}
}
}

Playground​

Server
Variables
Key
Value

Samples​

Get individual SCAP requirement details​

GET
/scap/{title}/{version}/{release}/{vuln}

Returns complete details for specific SCAP requirement (same structure as STIG requirement)

Parameters​

Path Parameters

title*

Document title exactly as it appears in the list endpoint

Typestring
Required
Example"U_MS_Windows_10_V3R2_STIG_SCAP_1-2_Benchmark"
Min Length1
Max Length200
version*

Major version number of the document

Typestring
Required
Example"3"
Pattern"^\\d+$"
release*

Release number within the version

Typestring
Required
Example"2"
Pattern"^\\d+(\\.\\d+)?$"
vuln*

Vulnerability/Requirement ID (V-XXXXXX format)

Typestring
Required
Example"V-220697"
Pattern"^V-\\d{6}$"

Responses​

Complete SCAP requirement details

application/json
JSON
{
"id": "V-214518",
"rule": "SV-214518r997541_rule",
"severity": "string",
"requirement-title": "string",
"requirement-description": "string",
"mitigation-statement": "string",
"identifiers": [
[
"V-66003",
"SV-80493",
"CCI-000213"
]
],
"check-text": "string",
"fix-text": "string",
"check-id": "string",
"fix-id": "string",
"group": "string",
"version": "string",
"stig": "string",
"stig-title": "string",
"stig-description": "string",
"stig-published": "string",
"stig-status": "string"
}

Playground​

Server
Variables
Key
Value

Samples​

CCI​

Control Correlation Identifiers (bridge RMF to implementation)

Operations​

GET/cciGET/cci/{item}

List all Control Correlation Identifiers​

GET
/cci

Returns complete list of CCIs with their definitions

Responses​

Complete list of CCIs with definitions

application/json
JSON
{
"additionalProperties": "string"
}

Playground​

Samples​

Get CCI details with RMF mapping​

GET
/cci/{item}

Returns complete CCI details including RMF control mapping

Parameters​

Path Parameters

item*

Control Correlation Identifier (CCI-XXXXXX format)

Typestring
Required
Example"CCI-000001"
Pattern"^CCI-\\d{6}$"

Responses​

Complete CCI details with RMF control mapping

application/json
JSON
{
"cci": "CCI-000001",
"cci_definition": "string",
"rmf": "AC-1",
"family": "Access Control",
"name": "Access Control Policy And Procedures"
}

Playground​

Server
Variables
Key
Value

Samples​

Powered by VitePress OpenAPI

Released under the Apache-2.0 License.

Copyright © 2025 MITRE Corporation