How averysmallsoap/restackapi works
Restack is a backend API that coordinates web-application security scans and exposes findings, reports, and analytics to the web application. The main workflow begins with an API request, runs scanner integrations, normalizes and analyzes results, then persists and serves scan data. Separate capabilities include scheduled scans, report export, and analytics. The excerpts show key orchestration and persistence links; some route and integration details are unsampled, so those relationships are omitted rather than inferred.
Main entry points: ScannerManager.py Scanner manager · database.py Database access · main.py REST API · background_runnable.py Scan runner
Components 20
API and orchestration
- REST API
main.py - Scan runner
modules/utils/background_runnable.py - Scan tracker
services/ScanTracker.py
Scanning
- Scanner manager
services/managers/ScannerManager.py - Scanner adapters
modules/interfaces/IScannerAdapter.py - WhatWeb discovery
modules/scanners/discovery/WhatWebScanner.py - Wapiti scanner
modules/scanners/WapitiScanner.py - ZAP scanner
modules/scanners/ZapScanner.py - Nuclei scanner
modules/scanners/vulnerabilities/nuclei.py - Other discovery tools
modules/scanners/discovery
Results and storage
- Vulnerability analysis
modules/analytics/vulnerability_analysis.py - Database access
modules/db/database.py - Scan data models
modules/db/table_collection.py - Report generation
services/FileReportGenerator.py
Analytics
- Analytics calculations
modules/analytics - AI summaries
modules/analytics/ai_recosum.py
Scheduling
- Schedule manager
services/managers/ScheduleManager.py - Scheduler service
scheduler_service.py - Schedule records
modules/db/table_collection.py
Other components
- Web application
Connections 22
- Web application → REST API: requests scans
README.md - REST API → Scanner manager: starts scans
main.py - REST API → Report generation: exports reports
main.py - REST API → Analytics calculations: serves analytics
main.py - Scanner manager → WhatWeb discovery: starts discovery
services/managers/ScannerManager.py - Scanner manager → ZAP scanner: dispatches scans
services/managers/ScannerManager.py - Scanner manager → Wapiti scanner: dispatches scans
services/managers/ScannerManager.py - Scanner manager → Nuclei scanner: dispatches scans
services/managers/ScannerManager.py - Scanner manager → Scanner adapters: implements contract
- Scan runner → Scanner manager: runs scans
modules/utils/background_runnable.py - Scan runner → Vulnerability analysis: analyzes findings
modules/utils/background_runnable.py - Scan runner → Database access: saves results
modules/utils/background_runnable.py - Scan runner → AI summaries: generates summaries
modules/utils/background_runnable.py - Vulnerability analysis → Database access: loads configuration
modules/analytics/vulnerability_analysis.py - Database access → Scan data models: uses models
modules/db/database.py - Report generation → Database access: reads reports
services/FileReportGenerator.py - Analytics calculations → Database access: queries scan data
modules/analytics/formal/correlation_regression.py - Scheduler service → Schedule manager: runs scheduling
scheduler_service.py - Schedule manager → Schedule records: reads schedules
services/managers/ScheduleManager.py - Schedule manager → Scan runner: starts scheduled scans
services/managers/ScheduleManager.py - REST API → Scan tracker: tracks scan state
main.py - Scan tracker → Database access: persists scan state
services/ScanTracker.py