Information
- OpenAPI version:
3.1.0
Overview
DevSecure API 1.0.0
Section titled “DevSecure API 1.0.0”The DevSecure REST API. Every request is scoped to one workspace: the one the credential was created in.
Authentication. Send Authorization: Bearer <API key or access token>.
API keys start with devsk_. OAuth clients exchange their credentials at
POST /oauth/token for a short-lived access token (devsat_). Each operation
lists the scopes it needs.
Pagination. Lists return {"data": [...], "pagination": {"next_cursor", "has_more"}} and an X-Has-Next-Page header. Pass cursor to get the next
page; limit is 1-200 (default 50).
Errors. Every error has the same body:
{"error": {"code", "message", "request_id", "details"}}.
Rate limits. Responses carry X-RateLimit-Limit, X-RateLimit-Remaining
and X-RateLimit-Reset; a 429 adds Retry-After.
Idempotency. Operations that create or start something accept an
Idempotency-Key header and replay the first response for 24 hours.
Rolling out. Operations marked x-devsecure-availability: rolling-out
(starting scans, requesting autofixes, PDF reports) answer
501 not_implemented until they are enabled for your deployment.
Authentication
Section titled “Authentication”ApiKey
Section titled “ApiKey”An API key, or an access token from POST /oauth/token.
Security scheme type: http
Bearer format: devsk_ API key or devsat_ access token
OAuth2
Section titled “OAuth2”Client credentials grant. A token carries the client’s scopes or a subset.
Security scheme type: oauth2
Flow type: clientCredentials
Token URL: https://api.devsecure.io/oauth/token
Scopes:
- workspace:read - Read the workspace profile, plan and integration status.
- usage:read - Read plan limits and scan usage.
- repos:read - List code repositories and container images.
- scans:read - Read scans and scan history.
- scans:code_execute - Start code scans (SAST, SCA, secrets, IaC).
- scans:dast_execute - Start DAST scans against authorised targets.
- scans:container_execute - Start container image scans.
- scans:pentest_execute - Start pentests against approved targets.
- issues:read - Read issues, issue counts and issue groups, including code snippets.
- issues:triage - Resolve and reopen issues.
- issues:exceptions - Request false-positive, snooze and risk-acceptance exceptions. A person approves them.
- issues:export - Export issues as JSON or CSV.
- autofix:read - Read autofix jobs, their patches and the remediation policy.
- autofix:execute - Request AI autofix pull requests.
- autofix:settings_write - Change the workspace remediation policy.
- kubernetes:read - Read Kubernetes clusters, findings and images.
- kubernetes:triage - Change the status of Kubernetes findings.
- dast:read - List authorised DAST targets.
- pentest:read - Read pentest targets and reports.
- pentest:request_target - Request a pentest target. A person approves it.
- teams:read - List teams and their repositories.
- members:read - List workspace members, including email addresses.
- audit:read - Read the workspace audit log.
- reports:generate - Generate PDF reports.
- webhooks:read - List webhook subscriptions and deliveries.
- webhooks:manage - Create, change and delete webhook subscriptions.
OAuth2ClientBasic
Section titled “OAuth2ClientBasic”Client_id and client_secret, for POST /oauth/token only.
Security scheme type: http