Run a Drift Scan and Retrieve Findings

export TOKEN="eyJhbGciOi..."
export BASE_URL="https://api.infraaudit.dev"

JOB=$(curl -s -X POST "$BASE_URL/api/v1/drifts/detect" \
  -H "Authorization: Bearer $TOKEN" | jq .)

echo $JOB
# { "job_id": 42, "status": "running", "message": "Drift detection scan started" }

JOB_ID=$(echo $JOB | jq -r '.job_id')

while true; do
  EXEC=$(curl -s "$BASE_URL/api/v1/jobs/1/executions/$JOB_ID" \
    -H "Authorization: Bearer $TOKEN")
  STATUS=$(echo $EXEC | jq -r '.status')
  echo "Job status: $STATUS"
  if [ "$STATUS" = "succeeded" ] || [ "$STATUS" = "failed" ]; then break; fi
  sleep 3
done

curl -s "$BASE_URL/api/v1/drifts/summary" \
  -H "Authorization: Bearer $TOKEN" | jq .

{
  "total": 5,
  "by_severity": {
    "critical": 1,
    "high": 2,
    "medium": 1,
    "low": 1
  }
}

curl -s "$BASE_URL/api/v1/drifts?severity=critical" \
  -H "Authorization: Bearer $TOKEN" | jq '.data[] | {id, summary, resource_name}'

{
  "id": 1,
  "summary": "BlockPublicAcls changed from true to false",
  "resource_name": "data-lake-bucket"
}

curl -s "$BASE_URL/api/v1/drifts/1" \
  -H "Authorization: Bearer $TOKEN" | jq '{summary, baseline_value, current_value}'

# Re-sync the provider to pull current state
curl -s -X POST "$BASE_URL/api/v1/providers/1/sync" \
  -H "Authorization: Bearer $TOKEN"

# Resolve the drift finding
curl -s -X POST "$BASE_URL/api/v1/drifts/1/resolve" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"capture_baseline": true}'