The HTTP server. It serves the machine API and the dashboard’s origin, and it is the process a load balancer sits in front of.

​
Synopsis

No arguments, no flags, no subcommands. Configuration is read from the process environment; see Environment variables.

​
Building and running it

From source, with the toolchain requirement the scanning engine imposes:
The make wrappers set GOEXPERIMENT for you, which is the reason to prefer them:
Building without GOEXPERIMENT=jsonv2 fails with an error naming a standard library package rather than the cause — From source covers that failure and why the requirement exists. In the container image the binary is built from cmd/api but installed as /app/main, and it is the image’s default command — so an API container names no command at all. The name is a build artefact rather than a statement of intent; worker ships in the same image and is selected by overriding the command.

​
Environment it reads

The full list is in Environment variables. The ones that decide how this process in particular behaves: Missing required configuration is a fatal startup error rather than a warning. That is deliberate and is explained in Configuration overview: a security control that a missing environment variable can silently disable is not a control.

​
Running scans in-process

SCAN_WORKER_ENABLED=true makes this process also consume the scan queue, collapsing the two binaries into one. It exists for single-node and evaluation deployments where running a second process is not worth it. It is not the recommended production shape:
  • A scan is minutes of CPU and disk in the same process that is meant to answer requests in milliseconds.
  • Scan capacity and request capacity stop scaling separately.
  • Restarting the API to deploy a fix also interrupts every scan in flight.
The default compose file sets it to false here and runs a separate worker. See Topology.

​
Shutdown

The process stops on SIGINT or SIGTERM. If this process is also running scans, the durability note in worker applies to it as well.

​
Health

/health and /ready are unauthenticated and are not under /api/v1 — they are the probes an orchestrator calls, so they must answer before the application is fully wired. What each reports is covered in Health and metrics.