Use the authenticated endpoint GET /api/v1/stigs/{slug}/download?format={format}. Replace {slug} with the exact STIG slug. If format is omitted or empty, the endpoint uses cklb.
cklb — A CKLB checklist document for a workflow that expects CKLB.
json — Benchmark data serialized as JSON, including loaded groups and profiles. This structure differs from CKLB.
csv — A table with one row per group for a spreadsheet or CSV consumer.
xml — A simplified XML representation of benchmark and group data. This does not imply compatibility with an original DISA XML package.
cklb-workforce — For callers with workforce entitlement, a JSON envelope containing checklist and workforceMapping. The envelope is not a bare CKLB document.
workforce — Workforce mapping data in JSON-LD, subject to workforce entitlement and available mappings.
Format names are exact and case-sensitive. Other nonempty values return 400 BAD_REQUEST after authentication and access checks.
Understanding workforce results
A successful download does not establish that mappings are present. Check X-OpenControls-Workforce-Entitled (true or false) and X-OpenControls-Workforce-Source (present, empty, or gated).
present: mapping data is available.
empty: the caller has entitlement but no NICE role or O*NET occupation mapping was found for that STIG.
gated: workforce content was withheld. cklb-workforce returns plain CKLB; workforce returns an empty JSON-LD shell. These fallbacks can still return HTTP 200 when earlier authentication and access checks allow the request.
Ordinary cklb, json, csv, and xml exports contain no workforce data and omit the workforce source header.
API reference: https://docs.stigviewer.com/stigs