> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# REST API endpoints for drift detection — GET /drifts

> Trigger drift detection scans, list and filter findings by severity and provider, acknowledge drift, and resolve findings via the InfraAudit REST API.

The drifts endpoints let you trigger configuration drift detection scans, retrieve findings, and manage drift status through resolution. Drifts compare a resource's current configuration against a captured baseline.

Base path: `/api/v1/drifts`

***

## POST /drifts/detect — trigger drift scan

Starts a drift detection scan across all connected providers. Returns immediately with a job ID you can use to track progress.

```http theme={null}
POST /api/v1/drifts/detect
Authorization: Bearer <token>
```

### Response `202`

```json theme={null}
{
  "job_id": 42,
  "status": "running",
  "message": "Drift detection scan started"
}
```

***

## GET /drifts — list drift findings

Returns a paginated list of drift findings.

```http theme={null}
GET /api/v1/drifts
Authorization: Bearer <token>
```

### Query parameters

<ParamField query="provider_id" type="integer">
  Filter by provider ID.
</ParamField>

<ParamField query="resource_id" type="integer">
  Filter by resource ID.
</ParamField>

<ParamField query="severity" type="string">
  Filter by severity: `critical`, `high`, `medium`, or `low`.
</ParamField>

<ParamField query="type" type="string">
  Filter by drift type: `configuration`, `security`, or `compliance`.
</ParamField>

<ParamField query="status" type="string">
  Filter by status: `detected`, `investigating`, or `resolved`.
</ParamField>

<ParamField query="page" type="integer" default="1">
  Page number.
</ParamField>

<ParamField query="per_page" type="integer" default="20">
  Results per page. Maximum is 100.
</ParamField>

### Response

```json theme={null}
{
  "data": [
    {
      "id": 1,
      "resource_id": 15,
      "resource_name": "data-lake-bucket",
      "resource_type": "s3_bucket",
      "drift_type": "security",
      "severity": "critical",
      "status": "detected",
      "summary": "S3 bucket BlockPublicAcls changed from true to false",
      "baseline_value": true,
      "current_value": false,
      "detected_at": "2024-01-15T14:30:00Z"
    }
  ],
  "meta": { "total": 12, "page": 1, "per_page": 20 }
}
```

***

## GET /drifts/{id} — get drift details

Returns the full drift record including the JSON diff between the baseline and the current configuration.

```http theme={null}
GET /api/v1/drifts/{id}
Authorization: Bearer <token>
```

***

## PATCH /drifts/{id} — update drift status

Updates the status of a drift finding. Valid transitions are `detected → investigating → resolved`.

```http theme={null}
PATCH /api/v1/drifts/{id}
Authorization: Bearer <token>
Content-Type: application/json
```

### Request body

<ParamField body="status" type="string" required>
  New status: `investigating` or `resolved`.
</ParamField>

```json theme={null}
{
  "status": "investigating"
}
```

***

## POST /drifts/{id}/resolve — resolve a drift

Marks a drift as resolved. Optionally captures a new baseline from the current configuration.

```http theme={null}
POST /api/v1/drifts/{id}/resolve
Authorization: Bearer <token>
Content-Type: application/json
```

### Request body

<ParamField body="capture_baseline" type="boolean" default="false">
  When `true`, captures the current configuration as a new baseline after resolving.
</ParamField>

```json theme={null}
{
  "capture_baseline": true
}
```

***

## GET /drifts/summary — get drift summary

Returns aggregate drift counts by severity and status.

```http theme={null}
GET /api/v1/drifts/summary
Authorization: Bearer <token>
```

### Response

```json theme={null}
{
  "total": 12,
  "by_severity": {
    "critical": 1,
    "high": 4,
    "medium": 5,
    "low": 2
  },
  "by_status": {
    "detected": 8,
    "investigating": 3,
    "resolved": 1
  }
}
```