Scanverra
Repo Scanner

API Reference

Repo Scanner

Static analysis for GitHub, Bitbucket, and Azure DevOps repositories - SAST, secrets detection, dependency CVE scanning, IaC checks, and code quality signals.

POST/api/repo/scanasync

Kick off a scan - code quality, security issues, AI fixes

Repo scans run asynchronously and return only a scanId immediately. Poll GET /api/repo/result below, or view results at https://www.scanverra.com/repo?scan={scanId}. Your GitHub, Bitbucket, or Azure DevOps account must be connected in Scanverra settings first — the scan runs against the token stored there, not one you pass per-request.

Request body

{
  "owner": "your-org",
  "repo": "your-repo",
  "branch": "main"
}

Response (immediate)

{
  "scanId": "clxyz..."
}

Example

curl -X POST https://www.scanverra.com/api/repo/scan \
  -H "X-API-Key: sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"owner":"acme","repo":"website","branch":"main"}'
GET/api/repo/resultsynchronous

Poll a scan by id until it's done

Query params

?id={scanId}

Response

{
  "id": "clxyz...",
  "status": "completed",
  "score": 82,
  "qualityGate": "passed",
  "issues": [...],
  "fixes": [...],
  "riskFindings": [...],
  "dependencyVulns": [...],
  "aiSummary": "..."
}

status is one of running, completed, or failed. Poll until it's not running.

Example

curl "https://www.scanverra.com/api/repo/result?id=clxyz..." \
  -H "X-API-Key: sk_live_..."

The only endpoint with a built-in gate

qualityGate is computed automatically: "failed" if any finding has severity: "critical", or if score < 60. score starts at 100 and is reduced by severity-weighted deductions capped per category (Security ≤50, Dependency ≤30, Quality ≤15, IaC ≤15). This is the only tool where a single field is a ready-made CI pass/fail signal — see CI/CD Integration.

PreviousBrowser TestNext Error Codes