DevMeth API v1

Scan any public git repository for the 48 known AI-code failure patterns and read the findings as JSON. The API runs the same engine, with the same pinned scanner versions and the same catalog, as the website — identical findings, deterministic, delivered as data.

Honest scope

v1 scans repositories only (public git URLs). Live-URL scanning arrives in v1.1 with an ownership-verification step.
We check the 48 known AI-code failure patterns — we do not pentest, and findings are advisory.
All evidence in responses is masked before storage — full secrets never appear.
Scanned code is deleted after the scan completes — the same rule as the website.

Quickstart

1 — Bootstrap an org (you get a dashboard token + your first API key, shown once):

curl -X POST https://your-deployment.example/api/v1/orgs \
  -H "content-type: application/json" \
  -d '{"email":"you@example.com"}'

# → 201 { "orgId": "…", "dashboardToken": "…", "apiKey": { "key": "dvm_…" } }

2 — Create a scan and poll until it is done:

curl -X POST https://your-deployment.example/api/v1/scans \
  -H "authorization: Bearer dvm_YOUR_KEY" \
  -H "content-type: application/json" \
  -d '{"repoUrl":"https://github.com/acme/launch"}'

# → 202 { "scanId": "…", "status": "queued", "statusUrl": "/api/v1/scans/…" }

curl https://your-deployment.example/api/v1/scans/SCAN_ID \
  -H "authorization: Bearer dvm_YOUR_KEY"

# → 200 { "status": "done", "summary": { "critical": 2, "high": 3, … },
#          "findings": [ { "checkId": "C18", "severity": "critical", … } ] }

Authentication

Two bearer token types, both shown exactly once when issued:

API key (dvm_…) — creates and reads scans. Stored as a SHA-256 hash; only the prefix is ever displayed again.
Dashboard token (64-hex) — manages keys for your org (create, list, revoke). Treat it like a password.

Endpoints

Full request/response schemas: openapi.json (OpenAPI 3.1).

post	/api/v1/orgs	Bootstrap an org (returns a dashboard token + your first API key)
get	/api/v1/keys	List this org's keys (masked — prefix only)
post	/api/v1/keys	Mint a new API key (shown exactly once)
delete	/api/v1/keys/{id}	Revoke a key (row kept for audit)
post	/api/v1/scans	Create a repo scan (git URL — public repos in v1)
get	/api/v1/scans/{id}	Read a scan (queued/running state, or masked findings when done)
delete	/api/v1/scans/{id}	Delete a scan and its findings (deletion promise)
post	/api/v1/ci/scan	Trigger a CI run on a pull request (repos with the App installed)
get	/api/v1/ci/scans/{id}	Read a CI run's status (the statusUrl from POST /api/v1/ci/scan)
get	/api/openapi.json	This document

Limits & billing

Per key: 10 scans/hour, 50/day. Org bootstrap: 3/hour per IP. A 429 response includes retryAfterSec.
The API ships with the CI tier ($19.99/month), which includes a monthly scan allowance. During the pre-launch window the per-key limits above apply.
DELETE on a scan is immediate and honors the deletion promise — findings are lifted at once.

Questions or a partner integration (template sellers bundling "verified" scans)? See our contact page.