Public API

GET	Returns
/api/products	Every release on sale: slug, product_name, docker_tag, version, base_os, image_manifest_digest, signed and key_fingerprint, run_user, attestations, built_from, rebuild (whether and when the offline rebuild matched), at_release (the grade it shipped with) and today's Docker Scout grade with its reasons.
/api/releases/<slug>	A product's release history, newest first: tag, version, revision, release date, base OS, whether it is reproducible and whether its notes are kept.
/api/releases/<slug>/<tag>/notes	That release's RELEASE_NOTES.md, as plain text.
/api/scans	The first and latest recorded scan of every image (scans["readystack/<slug>:<tag>"]: grade, score, counts, base OS, digest, how it was scored), the rubric, and Docker Hub pull counts.
/api/scout-evidence/<slug>/<tag>	What Docker Scout reported for the release at release and on today's re-check.
/api/defects	The defect log, newest first. Filters: product, release_tag, severity, status, class, type; paging with limit (up to 500) and offset.
/api/defects/summary	Counts by severity, outcome, type and class.
/api/queue-page	What our build system is doing now (building, in review, queued, planned, with the release each builds) and every release for sale with its grades.
/keys/cosign.pub	The public key every release is signed with.

The current release of one product, its digest and whether its offline rebuild matched:

$ curl -s https://readystack.dev/api/products | jq '.[] | select(.slug=="caddy") | {docker_tag, image_manifest_digest, rebuild}'

Its latest scan, by its exact tag (the scan list also holds earlier releases of the same product):

$ T=$(curl -s https://readystack.dev/api/products | jq -r '.[] | select(.slug=="caddy") | .docker_tag')
$ curl -s https://readystack.dev/api/scans | jq --arg r "readystack/caddy:$T" '.scans[$r].latest'

Open defects in that release:

$ curl -s "https://readystack.dev/api/defects?product=caddy&release_tag=$T&status=open" | jq '.defects[] | {severity, title}'