Skip to main content

Overview

The Nabla Evidence Engine API enables programmatic compliance assessments and evidence generation for federal and defense security frameworks. Generate OSCAL-compliant assessment results from infrastructure-as-code, SBOMs, and system metadata without manual evidence collection. Base URL: https://api.usenabla.com

Supported Frameworks

Nabla provides compliance assessments for the following security frameworks:

FedRAMP

NIST 800-53 security controls for federal cloud services

CMMC 2.0

Defense Industrial Base cybersecurity requirements

FIPS 140-3

Cryptographic module validation and compliance

NIST 800-172

Enhanced security requirements for CUI

Authentication

All API endpoints require authentication using a customer API key passed via the X-Customer-Key header.
Contact Nabla to obtain your API key.

Output Formats

All assessment endpoints support multiple output formats:

Evidence Sources

Nabla accepts evidence from multiple sources:

Infrastructure-as-Code

  • Terraform State: Remote state files (S3, GCS, Azure Blob, HTTP)
  • Repository URLs: Direct Terraform configuration analysis

Software Supply Chain

  • SBOM: CycloneDX, SPDX formats
  • Package Locks: npm, poetry, cargo, go.mod

System Metadata

  • System Info: FIPS mode status, OpenSSL configuration
  • Crypto Policies: OS-level cryptographic policies

Configuration Management

  • Kubernetes: Manifests, Helm charts
  • Ansible: Playbooks, inventories
Evidence Scope: Assessments are based on declared infrastructure in code and metadata. Runtime configurations not reflected in evidence sources will not be assessed.

Assessment Response

All assessment endpoints return a standardized response structure:

Additional Capabilities

Architecture Diagrams

Generate Mermaid diagrams from Terraform state using AI:

Next Steps

Framework Schemas

Explore detailed framework documentation

OpenAPI Spec

Download the complete OpenAPI specification

Support