Appollo API

Scan trigger API that bridges Appollo Dashboard and the Appollo scanner on Kubernetes

How It Works · Quick Start · API · Scan Types · Kubernetes · Related Repos

---

Flask API that bridges the Appollo Dashboard and the Appollo scanner. The dashboard calls Appollo API to trigger on-demand scans; Appollo API creates a Kubernetes Job that runs Appollo and streams results back.

How it works

1. Dashboard POSTs { "scans": ["port-scan", "ssl-checker"], "target": "example.com" } to /run_scan
2. Appollo API builds an appollo.py CLI command and submits it as a Kubernetes Job
3. The scan pod calls back to /callback/scan on completion (optional — status also readable via K8s API)
4. Dashboard polls /job/<id>/status until the job is completed or failed

Quick start

Requirements: Python 3.11+, access to a Kubernetes cluster, Appollo image published to a registry.

git clone https://github.com/Groww-OSS/Appollo-API.git
cd Appollo-API
pip install -r requirements.txt

Set environment variables (see table below), then:

python app.py

The API listens on port 1337 by default.

Environment variables

Variable	Default	Description
PORT	1337	Port to listen on
SCAN_NAMESPACE	appollo-scans	Kubernetes namespace where scan Jobs are created
SCAN_IMAGE	appollo:latest	Container image used for scan Jobs
SCAN_CONFIG_MAP	appollo-configs	ConfigMap mounted into scan pods at /app/config
SCAN_CONFIG_SECRET	appollo-secrets	Secret mounted into scan pods at /app/config
SCAN_PVC_CLAIM	pvc-rwm	PersistentVolumeClaim mounted into scan pods at /etc/config
SCAN_IMAGE_PULL_SECRET	registry-secret	ImagePullSecret for the scan image (leave blank if not needed)
SCAN_SERVICE_ACCOUNT	appollo-sa	ServiceAccount used by scan pods
APPOLLO_API_NAMESPACE	appollo-scans	Namespace appollo-api itself runs in (used to build the callback URL)
APPOLLO_API_INTERNAL_URL	auto	Internal URL scan pods use to POST completion status back to appollo-api
SCAN_JOB_TTL_AFTER_FINISH	86400	Seconds before a finished Job is removed from the cluster
JOB_NOT_FOUND_INFER_DONE_AFTER_SEC	120	Seconds after submission to treat a missing Job as completed (TTL cleanup)

API endpoints

Method	Path	Description
POST	/run_scan	Start a scan Job. Body: { "scans": string[], "target"?: string }
GET	/job/<id>/status	Poll Job status: running, completed, failed
GET	/job/<id>/logs	Fetch scan pod logs
POST	/callback/scan	Receives completion callbacks from scan pods

Kubernetes setup

The k8s/ directory contains ready-to-use manifests:

• appollo-api-deployment.yaml — Deployment + Service for appollo-api
• rbac.yaml — ServiceAccount, Role, and RoleBinding for creating Jobs
• README.md — Detailed setup guide including RBAC, callback config, and troubleshooting

Apply with:

kubectl apply -f k8s/appollo-api-deployment.yaml -n appollo-scans

Supported scan types

Scan ID	Appollo flag	Description
update-inventory	-U	Refresh IP and DNS inventory from GCP, AWS, Cloudflare, GoDaddy
ssl-checker	-sc	SSL/TLS certificate expiry and configuration checks
firewall-port-scan	-fs	GCP/AWS firewall-aware port scan via naabu
exposed-services-scan	-es	HTTP probe each IP to classify exposure
ip-exposure-scan	-ipe	Classify every IP as public, vpn_internal, or unknown
external-probe-scan	-ep	Confirm reachability of services from outside the VPC
probe-all-scan	-pa	Run exposed-services + external-probe together
cloud-functions-scan	-cf	Discover public Lambda, API Gateway, Cloud Run, and Cloud Functions endpoints
cloud-storage-scan	-cs	Scan GCS and S3 buckets for public access
cert-transparency-scan	-ct	Check certificate transparency logs for unexpected certs
dast-scan	-dast	DAST checks: security headers, CORS, open redirect, info disclosure
nuclei-scan	-ns	Nuclei template-based vulnerability scan
subdomain-scan	-sub	Subdomain enumeration
dangling-dns	-dd	Detect DNS records pointing to unclaimed resources
wayback-scan	-ws	Collect historical URLs from Wayback Machine and CommonCrawl
tech-scan	-ts	Technology fingerprinting
dir-scan	-ds	Directory / endpoint fuzzing
email-security-scan	-em	SPF, DKIM, DMARC checks
aws-scan	-as	EC2, security groups, and S3 inventory from AWS
vendor-scan	-vs	Third-party vendor posture assessment
complete-scan	all flags	Run every scan type in sequence

Related repositories

Repository	Description
Appollo	Python ASM scanner — the engine that runs inside each scan Job
Appollo Dashboard	Next.js web UI — calls Appollo API to trigger scans

License

MIT