API and SDK usage

REST patterns for TypeScript and Python

All product API routes use bearer authentication and workspace-scoped authorization. Mutations that support replay protection accept a stable Idempotency-Key; propagate X-Correlation-ID through your own logs.

const response = await fetch(`${baseUrl}/api/v1/scans`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${token}`,
    "Content-Type": "application/json",
    "Idempotency-Key": crypto.randomUUID(),
  },
  body: JSON.stringify({
    workspace_id: "ws_123",
    repository_id: "repo_456",
    scan_type: "security",
  }),
});
if (!response.ok) throw new Error(await response.text());
const scan = await response.json();

import uuid
import httpx

response = httpx.post(
    f"{base_url}/api/v1/scans",
    headers={
        "Authorization": f"Bearer {token}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={
        "workspace_id": "ws_123",
        "repository_id": "repo_456",
        "scan_type": "security",
    },
    timeout=30,
)
response.raise_for_status()
scan = response.json()

These examples use standard HTTP clients and match the generated OpenAPI 3.1 contract. Generated SDK packages should pin the committed openapi.json digest and expose the same errors and idempotency behavior.