Skip to content
Agentic Suite

API and triggers

All endpoints are under /api/v1 and require an organization-scoped bearer token. Triggering a review also requires an active subscription and available quota. See Billing and limits.

Trigger a review

POST /api/v1/security/review-reports/scan
Authorization: Bearer <token>
Content-Type: application/json

Provide exactly one target: a local repository path, or a repository and pull request number.

Review a pull request:

{
  "repo": "your-org/your-repo",
  "pr_number": 42,
  "surfaces": ["auth", "tenant_isolation"],
  "execute": false
}

Review a local repository (self-hosted):

{
  "repo_path": "/srv/your-repo",
  "base": "origin/main"
}

Fields:

  • repo_path: a local path on the backend host. Use this or repo plus pr_number, not both.
  • repo and pr_number: a GitHub pull request.
  • base: optional base ref for a diff review of a local repository.
  • surfaces: optional list to limit which finders run. Omit to run all five.
  • execute: optional. Defaults to false (dry-run). See Safety.

The call returns 202 Accepted and queues the review. The report appears in the history when the worker finishes.

List review history

GET /api/v1/security/review-reports?limit=50&verdict=flagged
Authorization: Bearer <token>

Query parameters:

  • skip and limit: pagination.
  • repo: filter by repository.
  • verdict: reviewed or flagged.

Fetch one report

GET /api/v1/security/review-reports/{report_id}
Authorization: Bearer <token>

Returns the full report including the summary, the findings, and the rendered Markdown. Reports are always scoped to your organization.

Errors

  • 402 Payment Required: no active subscription, or the token quota for the billing period is exhausted.
  • 429 Too Many Requests: the organization reached its daily review limit.
  • 404 Not Found: the report does not exist in your organization.