Getting started

Find a STIG in the catalog

Use the STIG Catalog to find a security baseline for a product or technology. You can browse the catalog without signing in. 1. Open https://www.stigviewer.com/library/catalog. 2. Enter part of the product or guide name in the search field. For example, search for “Active Directory Domain.” 3. Review the matching title, version, and release date. Similar product names can refer to different guides. 4. Select the title or Open link to reach the guide’s page. With no search entered, sort by Title or Date. Search results prioritize matching names. Use the All Roles menu to narrow the results. If you cannot find a guide, clear your search and return the role menu to All Roles. The finding count and CAT I, CAT II, and CAT III breakdown describe findings in the guide. They do not report the compliance status of your organization’s systems. The catalog shows current versions. A versions link appears on a guide’s page when multiple versions are available. Include the guide title and required version when asking for help. Related API reference: https://docs.stigviewer.com/stigs

Why does the API ask for a token when I can browse the website?

Browsing the website and calling the API are separate access paths. You can browse the public STIG Catalog without signing in, but the STIG listing API requires authentication. Supply your API token in the Authorization header: Authorization: Bearer YOUR_TOKEN The authentication guide at https://docs.stigviewer.com/authentication explains obtaining a token through SAMS. A browser sign-in alone does not add that header to a script or integration. If a request returns 401 UNAUTHORIZED with “Missing or invalid Authorization header,” check that the header is present and uses the format above. Do not include quote characters around the token value in the header itself. A valid token can still be restricted by its scope or product access. Include the exact error message when asking for help instead of assuming every access problem means the token has expired. Keep your token private. Share the endpoint, status code, and error message with credentials removed. Related: https://www.stigviewer.com/library/catalog

What should I include in a support request?

Tell us what you were trying to do and what happened instead. This checklist helps you describe a STIGViewer problem clearly. Include: • The STIGViewer page URL or API endpoint. • The guide title and version, if your question concerns a STIG. • The steps that produced the problem and the exact error message. • Whether you are using the website or an API integration. • For API problems, the HTTP status code and a request example with credentials removed. A screenshot can help with a website problem. Remove API tokens, passwords, session cookies, and unrelated personal or customer information before sharing it. If a guide is missing from search, include the search phrase and any role filter you selected. If an API request fails, include the response message rather than only saying the request did not work. Related API reference: https://docs.stigviewer.com/

Troubleshoot a STIGViewer API error

Use the HTTP status and response body together to decide what to check next. Listing STIGs and downloading content both require a bearer token. 400 — Check request parameters against the endpoint documentation. Format names are case-sensitive. 401 — Check Authorization: Bearer YOUR_API_TOKEN and token validity. Never include the token in a support message. 403 — A valid token may lack product access or the required integration-token scope. Check the product and endpoint you intend to use. 402 — When machine-access enforcement is enabled, the request needs a paid or eligible trial entitlement. Review the response access information. 404 — For STIG detail/download requests, check the exact STIG slug. Other endpoints may refer to other missing resources. 429 — Wait for the interval in Retry-After or retry_after_seconds before retrying. 503 — The authentication service is temporarily unavailable. Retry shortly; this does not mean your token is invalid. 500 — If it persists, provide support with the endpoint, time, status and error body, omitting credentials. Authentication and STIG errors normally contain an error object with code and message. Paywall responses instead use an error string such as payment_required or rate_limit_exceeded. Subscription and rate-limit blocking depend on service configuration. Request JSON for API use; payment denials for requests accepting HTML can redirect to an upgrade page. API reference: https://docs.stigviewer.com/errors

Read every page of the STIG catalog API

Use GET /api/v1/stigs to retrieve current STIG versions. Each response contains a stigs array and a pagination object. 1. Send an authenticated request with page=1 and a positive integer limit of at most 150. 2. Process the entries in stigs. 3. Read pagination.totalPages. Increase page and continue until you have processed that final page. 4. Keep limit and any search value the same between requests. Example request URL: https://www.stigviewer.com/api/v1/stigs?page=1&limit=100 Supply the header Authorization: Bearer YOUR_API_TOKEN. Keep the token private. The default page is 1 and default limit is 100. pagination.total counts matching records; pagination.totalPages counts pages at the returned limit. An empty result can have totalPages: 0. Add search=windows to filter titles or slugs without case sensitivity. The listing returns current versions ordered by release date, newest first, then title. Historical versions are not included in this listing. Retain the exact returned slug when requesting details or downloads. API reference: https://docs.stigviewer.com/pagination

Choose a STIG export format

Use the authenticated endpoint GET /api/v1/stigs/{slug}/download?format={format}. Replace {slug} with the exact STIG slug. If format is omitted or empty, the endpoint uses cklb. cklb — A CKLB checklist document for a workflow that expects CKLB. json — Benchmark data serialized as JSON, including loaded groups and profiles. This structure differs from CKLB. csv — A table with one row per group for a spreadsheet or CSV consumer. xml — A simplified XML representation of benchmark and group data. This does not imply compatibility with an original DISA XML package. cklb-workforce — For callers with workforce entitlement, a JSON envelope containing checklist and workforceMapping. The envelope is not a bare CKLB document. workforce — Workforce mapping data in JSON-LD, subject to workforce entitlement and available mappings. Format names are exact and case-sensitive. Other nonempty values return 400 BAD_REQUEST after authentication and access checks. Understanding workforce results A successful download does not establish that mappings are present. Check X-OpenControls-Workforce-Entitled (true or false) and X-OpenControls-Workforce-Source (present, empty, or gated). present: mapping data is available. empty: the caller has entitlement but no NICE role or O*NET occupation mapping was found for that STIG. gated: workforce content was withheld. cklb-workforce returns plain CKLB; workforce returns an empty JSON-LD shell. These fallbacks can still return HTTP 200 when earlier authentication and access checks allow the request. Ordinary cklb, json, csv, and xml exports contain no workforce data and omit the workforce source header. API reference: https://docs.stigviewer.com/stigs