API & endpoints

The mental model

Four kinds of thing, one consumption pattern (fetch → verify → use). Pick your entry point:

Start here 1 call

The manifest is the index: counts, per-domain metadata + SHA-256, the artifact checksum map, the signature, and a usage block describing everything below.

copycurl -s https://apeiris.ai/integration/manifest.json | jq '{controls: .total_controls, domains: .total_domains, signed: (.integrity.signature != null)}'

Build on Apeiris for vendors

If you're building a GRC platform, an AI gateway, a scanner, or an agent framework, Apeiris is designed to be the knowledge layer you embed — vendor-neutral, versioned, and verifiable — so you don't maintain your own control taxonomy or crosswalks. Three patterns, all no-auth:

A minimal, dependency-free client — fetch, verify the checksum, and read a proof chain:

copy// browser or Node 18+ — no SDK, no key
const BASE = "https://apeiris.ai/integration/";
const manifest = await (await fetch(BASE + "manifest.json")).json();

// 1) fetch a domain's controls, verifying the pinned SHA-256 first
const slug = "model";
const buf = await (await fetch(`${BASE}domains/${slug}-controls-full.json`)).arrayBuffer();
const hex = [...new Uint8Array(await crypto.subtle.digest("SHA-256", buf))]
  .map(b => b.toString(16).padStart(2, "0")).join("");
const pinned = manifest.domains.find(d => d.slug === slug).sha256;
if (hex !== pinned) throw new Error("integrity mismatch — fail closed");
const controls = JSON.parse(new TextDecoder().decode(buf)).dataset.controls;

// 2) read a framework obligation's proof chain (evidence + verdict + gap)
const proof = await (await fetch(BASE + "proofmap.json")).json();
const iso = proof.frameworks.find(f => f.framework === "iso_42001");
const ob = iso.obligations[0];
console.log(ob.requirement_id, ob.verdict,
  ob.proof_chain.map(c => `${c.id}: ${(c.evidence_required||[]).length} evidence`));

Point an MCP client at the read-only servers (from the apeiris-control-core repo):

copy{
  "mcpServers": {
    "apeiris-graph": { "command": "node", "args": ["adapters/graph-mcp/server.js"] },
    "apeiris-atlas": { "command": "node", "args": ["adapters/atlas-mcp/server.js"] }
  }
}

Controls 12

One matrix per domain. Each control carries validation_objective, evidence_required[], machine_tests[], frameworks[] crosswalks, threat.atlas (MITRE ATLAS provenance), blocking_effect, layer_code, and a stable canonical_id. Each frameworks[] mapping carries fit (direct/supporting/partial/adjacent), mapping_confidence, and basis — anchored (the cited id is validated against the framework's captured primary text in CI) or asserted (cited but not yet ingested as an anchor). Mapped ≠ satisfied: the crosswalk states a relationship; the evidence is what you produce.

copy# one control, fully
curl -s https://apeiris.ai/integration/domains/security-controls-full.json \
  | jq '.dataset.controls[] | select(.id=="IA-04")'

Sources & crosswalks

The normative sources behind the mappings, the framework crosswalks, and the captured anchors that make every citation verifiable.

MITRE ATLAS & the knowledge graph

Analytics

Generated, checksum-pinned views over the corpus. Regenerated deterministically; consumed by the analysis hub and the advisor.

Agent interface — MCP 2 servers

Two read-only MCP servers (stdio JSON-RPC) let agents query the corpus through one governed, checksum-verified interface — every response carries provenance. From the apeiris-control-core repo: · Full MCP reference →

copynpm run atlas:mcp     # MITRE ATLAS knowledge base
npm run graph:mcp     # the knowledge graph

atlas-mcp — MITRE ATLAS Q&A + how it maps to Apeiris controls:

graph-mcp — traverse the same graph the explorer loads:

Full per-tool request/response examples in the adapter READMEs (adapters/atlas-mcp, adapters/graph-mcp).

Conformance & controlled vocabularies

One machine-readable contract for building on the corpus: the identifier grammar, every closed vocabulary you'll encounter (derived live from the data, so it's always accurate), what each value means, the integrity model, the evidence ontology, and the invariants a correct consumer must respect. Validate against it; treat a value outside a listed set as an error, not a default.

copycurl -s https://apeiris.ai/integration/conformance.json | jq '.controlled_vocabularies | keys'

Two invariants worth repeating. Mapped ≠ satisfied: a crosswalk states a relationship (its fit), not that the obligation is met — the evidence is what you produce. And basis tells you whether a citation is anchored (validated against the framework's captured primary text in CI) or asserted (cited, not yet machine-validated).

Verify integrity

Don't trust — recompute. Every artifact's SHA-256 is pinned; the manifest is Ed25519-signed.

copy# recompute a domain artifact's hash vs the manifest
curl -s https://apeiris.ai/integration/domains/security-controls-full.json | sha256sum
curl -s https://apeiris.ai/integration/manifest.json \
  | jq -r '.domains[] | select(.slug=="security") | .sha256'