> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# InfraAudit REST API — overview and base URL

> InfraAudit REST API base URL, versioning scheme, authentication method, content type requirements, and a working curl example to get you started.

The InfraAudit API is a JSON REST API served by the Go backend. Every endpoint returns `application/json` unless you request a file download, and every protected endpoint requires a Bearer token in the `Authorization` header. This page covers the conventions that apply to all requests.

## Base URL

For SaaS:

```
https://api.infraaudit.dev/v1
```

For self-hosted deployments the default base URL is:

```
http://localhost:8080
```

## Versioning

All endpoints are under the `/api/v1/` path prefix. A small set of legacy endpoints (auth, providers, resources, drifts, baselines, alerts, and Kubernetes) are also accessible without the `/v1/` prefix for frontend compatibility. New integrations should always use the `/api/v1/` paths.

## Authentication

All protected endpoints require a `Bearer` token:

```http theme={null}
Authorization: Bearer <access_token>
```

See [Authentication](/api/authentication) for how to obtain a token.

## Content type

All request bodies must be `application/json`. Set the header on every mutating request:

```http theme={null}
Content-Type: application/json
```

Responses are always `application/json` unless the endpoint returns a file download (`application/pdf` or `text/csv`).

## Quick example

Retrieve the first page of cloud resources using curl:

```bash theme={null}
curl https://api.infraaudit.dev/v1/resources \
  -H "Authorization: Bearer $TOKEN"
```

Response:

```json theme={null}
{
  "data": [
    {
      "id": 1,
      "name": "web-server-01",
      "resource_type": "ec2_instance",
      "region": "us-east-1",
      "status": "active"
    }
  ],
  "meta": {
    "total": 247,
    "page": 1,
    "per_page": 20
  }
}
```

## Health endpoints

These endpoints do not require authentication and are useful for monitoring and readiness checks.

| Endpoint                  | Purpose                                              |
| ------------------------- | ---------------------------------------------------- |
| `GET /health`             | Liveness check                                       |
| `GET /healthz`            | Liveness check (alias)                               |
| `GET /readyz`             | Readiness check — verifies DB and Redis connectivity |
| `GET /metrics`            | Prometheus metrics                                   |
| `GET /swagger/index.html` | Interactive Swagger UI                               |

## Next steps

* [Authentication](/api/authentication) — how to get and pass a token
* [Errors](/api/errors) — HTTP status codes and error response format
* [Pagination](/api/pagination) — how list endpoints page results
* [Rate limiting](/api/rate-limiting) — limits and how to handle 429 responses
* [Endpoint reference](/api/reference/overview) — full list of API endpoints