Public API

A versioned REST API for pulling findings and scan data into your own tooling, or triggering a scan from CI — separate from the session-cookie-authenticated API the web app itself uses, and versioned independently so it can stay a stable contract even as the web app changes underneath it.

Prefer talking to an AI tool instead of writing REST calls? See the MCP Server guide — same data, same API keys, reachable as MCP tools from Claude Code, Claude Desktop, and Cursor.

Authentication

Create a key from Settings → API Keys (owner-only). The full key is shown exactly once at creation — copy it immediately, since only its hash is ever stored afterward.

Send it as a Bearer token on every request:

curl https://your-instance/v1/repositories \
  -H "Authorization: Bearer vsk_..."

A key is scoped to the organization that created it — every response is automatically limited to that organization's own data. There's no way to read across organizations regardless of what a key can see.

Keys can be revoked individually at any time; a revoked key stops working immediately.

Endpoints

List repositories

GET /v1/repositories

Returns every repository connected to the organization, including its current security grade and open finding count.

Get a repository

GET /v1/repositories/:id

List a repository's scans

GET /v1/repositories/:id/scans

Most recent 50 scans, newest first.

Trigger a scan

POST /v1/repositories/:id/scans

Queues a full scan of the repository's default branch at its latest commit. Idempotent by commit — calling this repeatedly for a commit that's already been scanned (or is currently scanning) returns the existing scan rather than queuing a duplicate, so it's safe to call from a CI step without worrying about double-triggering.

Get a scan

GET /v1/scans/:id

List findings

GET /v1/findings

Query parameters (all optional):

Param	Values
severity	critical, high, medium, low
status	open, fixed, ignored, false_positive
repositoryId	a repository ID from the list-repositories response
search	matched against title, rule ID, and file path

curl "https://your-instance/v1/findings?severity=critical&status=open" \
  -H "Authorization: Bearer vsk_..."

Get a finding

GET /v1/findings/:id

Rate limits

60 requests per minute per organization across /v1/* — generous enough for a CI pipeline hitting it on every build, tight enough to stay a reasonable ceiling. A 429 response means you've hit it; back off and retry.