Getting started
The DevSecure API is a JSON REST API at https://api.devsecure.io. Every
endpoint lives under /v1.
1. Create an API key
Section titled “1. Create an API key”In the DevSecure dashboard, open Integrations → API keys and choose Create API key. Give it a name and pick only the scopes your integration needs. You can grant only scopes your own role allows.
The key is shown once. Store it in your secret manager or CI secrets. A key looks like this (this one is fake):
devsk_exampleexample00_EXAMPLE-not-a-real-key-EXAMPLE-0000000002. Check the key
Section titled “2. Check the key”Send the key in the Authorization header, never in the URL.
curl -s https://api.devsecure.io/v1/credential \ -H "Authorization: Bearer $DEVSECURE_API_KEY"{ "id": "0b6f4c1e-8f2a-4d47-9a51-3f1f2c9d7e10", "name": "CI pipeline", "type": "api_key", "key_prefix": "devsk_exampleexample00", "scopes": ["issues:read", "scans:read"], "workspace_id": "6a1d2f3e-4b5c-4d6e-8f70-1a2b3c4d5e6f", "created_at": "2026-10-01T09:30:00Z", "expires_at": "2028-09-30T09:30:00Z", "access_token_expires_at": null}3. List open critical issues
Section titled “3. List open critical issues”curl -s "https://api.devsecure.io/v1/issues?status=open&severity=critical&limit=20" \ -H "Authorization: Bearer $DEVSECURE_API_KEY"Lists return data and pagination. Pass pagination.next_cursor back as
cursor to get the next page. See Pagination.
Next steps
Section titled “Next steps”- Use OAuth client credentials for services that should not hold a long-lived key.
- Handle errors and rate limits.
- Subscribe to webhooks instead of polling.