API reference - Pipefort

The Pipefort API exposes the endpoints below under /api/*. All endpoints except /api/health, /api/webhooks/github, and the public-scan endpoints require your access token in the Authorization header:

Authorization: Bearer <access-token>

The token is the access token you receive after signing in with GitHub. The API verifies it and identifies your account for the request.

Rate limiting & request IDs

Authenticated endpoints are rate-limited to 120 requests per user per minute; over-budget requests get 429 with a Retry-After header. An org-wide “Scan all” stays well inside this — the limit exists to trip runaway clients, not real use. Every response carries an X-Request-Id header (honoring one supplied by a fronting proxy) — include the id when reporting an issue so the request can be found in the logs.

`GET /api/health`

Unauthenticated health check. Returns { "status": "ok" }.

`GET /api/capabilities`

Which optional deployment-level integrations are configured. Requires auth, but reports server configuration rather than org state — every caller gets the same answer.

{ "github_app": true, "pr_webhooks": true }

pr_webhooks is whether the GitHub App webhook secret is set. The console reads it so it can tell an absence apart from a zero: without it nothing ever records that a fix merged, so the Insights funnel shows its verified stage as — instead of 0.

`GET /api/repos`

Refreshes the user’s repositories from GitHub (across all their installations) and persists them. Returns the stored rows. Response

{
  "connected": true,
  "repositories": [
    {
      "id": "uuid",
      "full_name": "owner/repo",
      "private": false,
      "html_url": "https://github.com/owner/repo"
    }
  ]
}

If the user hasn’t connected any GitHub App installations yet, returns { "connected": false, "repositories": [] }.

`POST /api/scan`

Scans a single repository. The client loops this across repos client-side for org-wide scans, keeping each request short. Request

{
  "repo_id": "uuid-from-GET-/api/repos",
  "ruleset": "all"        // or "owasp"
}

ruleset defaults to "all" if omitted. Response

{
  "scan_id": "uuid",
  "repo_id": "uuid",
  "workflow_files": 3,
  "counts": {
    "high": 2,
    "medium": 1,
    "low": 0,
    "info": 0
  },
  "findings": 3,
  "new_findings": 1
}

findings is the number of findings persisted; the rows themselves are read directly from the database, scoped to your account. new_findings is how many of them were first seen by this scan. counts is the severity rollup of open findings — triaged findings are persisted but excluded — and reflects any rule preferences the user has set; filtering happens server-side before persistence, so the persisted findings and counts always agree.

`POST /api/public-scan`

Unauthenticated. Powers the public repo scanner on the landing page: scans a public GitHub repository’s workflow files and returns a partial (“teaser”) report. Returns 503 if the public scanner isn’t configured on the deployment. Request

{ "repo": "owner/repo" }

Pasted GitHub URLs (https://github.com/owner/repo) are accepted. Response

{
  "slug": "k7Qw2mXbP4aZ",
  "repo": "owner/repo",
  "default_branch": "main",
  "workflow_files": 14,
  "findings": 23,
  "counts": { "HIGH": 4, "MEDIUM": 11, "LOW": 6, "INFO": 2 },
  "top_findings": [
    { "severity": "HIGH", "category": "CICD-SEC-4", "rule_id": "expression-injection", "title": "..." }
  ],
  "locked_findings": 20,
  "cached": false,
  "scanned_at": "2026-07-09T18:03:11Z"
}

top_findings carries at most 3 entries and never includes file, line, description, or recommendation — the full report requires signing in. slug is the share-link id (omitted if persistence failed); cached: true marks a replayed result (results are cached for 1 hour per repo). Repos with no workflows return "no_workflows": true. Errors: 400 invalid input · 404 repository not found or not public (private repos are indistinguishable from missing ones) · 429 rate-limited (5/min per IP, 30/min global; honors Retry-After) · 502 GitHub unreachable · 503 not configured.

`GET /api/public-scan/{slug}`

Unauthenticated. Replays a stored public scan by its share slug — the backend for pipefort.com/scan/{slug}. Same response shape as POST /api/public-scan (always cached: true). 404 for unknown slugs. Responses are immutable and CDN-cacheable (Cache-Control: max-age=3600).

`GET /api/public-stats`

Unauthenticated. The anonymized global aggregate shown on the landing page: coarse headline milestones plus the ten rules firing most often across all Pipefort scans (each repository’s latest scan, tenant and public teaser scans combined). Headline figures are public marketing strings ("1k+", "10k+") — exact counts are never exposed by this endpoint, and customer repositories, organizations, and users are never identified. recent lists the latest anonymous public teaser scans (public repos only). Response

{
  "repos_scanned": "1k+",
  "findings": "10k+",
  "repos_with_high": "1k+",
  "top_rules": [
    {
      "rule_id": "cicd-sec-3-unpinned-action",
      "title": "Unpinned third-party action",
      "category": "CICD-SEC-3",
      "severity": "MEDIUM",
      "description": "Third-party actions referenced by tag or branch can be silently replaced with malicious code."
    }
  ],
  "recent": [
    { "repo": "octo/app", "findings": 7, "counts": { "HIGH": 2 }, "scanned_at": "..." }
  ]
}

Rules are ranked severity-first, then by internal (unpublished) frequency, capped at 10; titles, severities, and descriptions come from the rule catalog, not stored findings. top_rules is empty until enough repositories have been scanned. Responses are cached (CDN s-maxage=300 plus a 5-minute in-process cache).

`GET /api/public/actions`

Unauthenticated. The public directory of scored marketplace actions — the latest scored version per action, joined to its repository metadata. Powers the action risk-score explorer at pipefort.com/actions. Query parameters

Param	Default	Notes
`sort`	`score`	`score` = riskiest first (score ascending) · `name` = alphabetical
`limit`	`200`	Maximum rows; capped at `500`. Invalid/`0` values fall back to the default.

Response

{
  "actions": [
    {
      "owner": "acme", "name": "deploy-action", "commit_sha": "0bd0b3…",
      "score": 42, "grade": "F", "scored_at": "2026-07-01T06:00:00Z",
      "stars": 12, "archived": false, "owner_verified": false
    }
  ]
}

Cached at the CDN for 5 minutes (s-maxage=300).

`GET /api/public/actions/{owner}/{name}`

Unauthenticated. Full risk-score detail for one action. Returns 404 when the action has never been seen. Case-insensitive on owner/name. status is one of:

scored — latest holds the newest scored version with its full explanation payload: signals (the raw scoring inputs), breakdown (post-cap per-family deductions: static, metadata, tag, advisory), finding_counts, and algorithm_version. Cached for 5 minutes.
pending — the action is queued for the daily worker; latest is null. Not cached (no-store).
unknown — in the catalog but never scored; latest is null.

versions lists every scored version, newest first, each with the refs observed at that commit. See what the families mean. Response (trimmed, status: "scored")

{
  "owner": "acme", "name": "deploy-action",
  "stars": 12, "archived": false, "owner_verified": false,
  "repo_created_at": "2021-03-02T00:00:00Z",
  "repo_pushed_at": "2026-06-20T00:00:00Z",
  "default_branch": "main",
  "status": "scored",
  "latest": {
    "commit_sha": "0bd0b3…", "score": 42, "grade": "F",
    "scored_at": "2026-07-01T06:00:00Z", "refs": ["v1", "v1.2.0"],
    "algorithm_version": 2,
    "signals": { "finding_counts": { "high": 2 }, "archived": false, "stars": 12 },
    "breakdown": { "static": 16, "metadata": 8, "tag": 0, "advisory": 20 },
    "finding_counts": { "high": 2, "medium": 3, "low": 0, "info": 0 }
  },
  "versions": [
    {
      "commit_sha": "0bd0b3…", "score": 42, "grade": "F",
      "scored_at": "2026-07-01T06:00:00Z", "refs": ["v1", "v1.2.0"]
    }
  ]
}

`POST /api/public/actions/{owner}/{name}/request`

Unauthenticated. Request an on-demand score for an action not yet in the catalog. No request body. The repository is validated (must exist and be public), then scored synchronously (~5–10 s) using the same analysis as the daily worker. When GitHub is unreachable the request degrades to enqueueing for the daily worker instead of failing.

Status	Body	Meaning
`200`	`{"status":"scored","score":88,"grade":"B"}`	Scored synchronously.
`200`	`{"status":"already_scored"}`	Already in the catalog (no work done).
`202`	`{"status":"queued"}` / `{"status":"already_queued"}`	GitHub unavailable — the daily worker will score it.
`400`	—	Invalid `owner`/`name`.
`404`	—	Repository missing or not public.
`429`	—	Rate-limited (3/min per IP plus a global cap; honors `Retry-After`).
`503`	—	On-demand scoring is not configured.

`GET /api/attack-paths`

Returns toxic combinations across every repository the user owns, computed from each repo’s latest-scan findings. Powers the Attacker Mind dashboard. Repositories with no combinations are omitted. Response

{
  "repos": [
    {
      "repo_id": "uuid",
      "full_name": "acme/demo",
      "html_url": "https://github.com/acme/demo",
      "combos": [
        {
          "id": "pwn-request",
          "title": "Pwn Request — untrusted PR code runs with a writable token",
          "severity": "CRITICAL",
          "scope": "file",
          "file": ".github/workflows/ci.yml",
          "impact": "...",
          "break_chain": "...",
          "break_chain_rule": "cicd-sec-1-ppe-checkout",
          "stages": [
            { "order": 0, "title": "...", "description": "...", "rule_id": "cicd-sec-1-ppe-checkout" }
          ],
          "components": [
            { "rule_id": "cicd-sec-1-ppe-checkout", "finding": { "...": "..." } }
          ]
        }
      ]
    }
  ],
  "total_combos": 1,
  "critical_count": 1,
  "high_count": 0,
  "repos_searched": 4,
  "coverage": [
    {
      "id": "secret-exposure-in-logs",
      "title": "Secret Exposure in Logs — debug logging meets an exposed credential",
      "severity": "HIGH",
      "platform": "github",
      "impact": "...",
      "break_chain": "...",
      "break_chain_rule": "cicd-sec-7-debug-logging-enabled",
      "searched_repos": 4,
      "blinded_repos": 0,
      "blinding_rules": []
    }
  ]
}

Detection runs the same engine as the CLI, so a combination never includes a finding from a rule disabled in Rule settings. coverage is every combination the engine ships, whether or not it matched — the denominator repos is the numerator of. Without it, a client cannot tell an exhaustive search that found nothing from a search that never ran, because both produce an empty repos array.

Field	Meaning
`searched_repos`	Repositories where every mandatory ingredient rule was enabled, so finding nothing there is a real negative.
`blinded_repos`	Repositories where the combination could not have been detected at all.
`blinding_rules`	The disabled rules responsible. Only rules that left a requirement with no satisfiable alternative are named — disabling one branch of an OR-group costs nothing and is not listed.
`platform`	`github` or `gitlab`, derived from the mandatory ingredients. Never both: a chain needing a GitLab-only rule cannot form on GitHub, so a client should not report it as a clean result for a GitHub-only organization.

A combination with searched_repos: 0 and blinded_repos: 0 was not evaluated anywhere — the organization has no finished scans. Treat that as “unknown”, not as “clean”. Each component’s finding carries its fingerprint. A combination itself has no stable identity to age — it is correlated on every read — so the fingerprint is what lets a client join back to the finding ledger and date the chain from its ingredients.

`GET /api/repositories/{repo_id}/combos`

Returns the toxic combinations for a single repository, computed from its latest-scan findings — the per-repo counterpart of /api/attack-paths. Powers the Attacker Mind card on the repository detail page. The user must own the repo (404 otherwise). combos is never null — an empty array means no combinations (and also covers a repo that has never been scanned). Response

{
  "combos": [
    {
      "id": "pwn-request",
      "title": "Pwn Request — untrusted PR code runs with a writable token",
      "severity": "CRITICAL",
      "scope": "file",
      "file": ".github/workflows/ci.yml",
      "impact": "...",
      "break_chain": "...",
      "break_chain_rule": "cicd-sec-1-ppe-checkout",
      "stages": [
        { "order": 0, "title": "...", "description": "...", "rule_id": "cicd-sec-1-ppe-checkout" }
      ],
      "components": [
        { "rule_id": "cicd-sec-1-ppe-checkout", "finding": { "...": "..." } }
      ]
    }
  ],
  "critical_count": 1,
  "high_count": 0
}

Like /api/attack-paths, detection respects the user’s current rule settings — globals merged with this repo’s overrides — so a rule turned off after the last scan can’t still form a combination. The response carries the same coverage array, scoped to this repository: searched_repos and blinded_repos are 1/0 or 0/1. A repository that has never been scanned returns coverage: [] rather than a list of combinations claiming to have been searched.

`GET /api/actions/ranking`

Returns marketplace actions ranked worst-first by their risk score, for API consumers building their own dashboards (the web app renders per-repo scores directly). One row per action — its latest scored version. Requires authentication. Query parameters

Param	Default	Meaning
`limit`	`50`	Max rows to return (capped at `200`).

Response — a JSON array, lowest score first:

[
  {
    "owner": "some-org",
    "name": "risky-action",
    "commit_sha": "a1b2c3...",
    "score": 42,
    "grade": "F",
    "scored_at": "2026-07-01T06:00:00Z"
  }
]

`GET /api/github/callback`

Links a freshly-created GitHub App installation to the signed-in user. GitHub redirects here with ?installation_id=...; the SPA forwards it with the user’s bearer token so the API can associate the two. Query params

Param	Required	Description
`installation_id`	yes	The numeric installation ID GitHub provides on the redirect.

Response

{
  "installation_id": 12345,
  "account": "octocat",
  "account_type": "User"
}

Organizations & invites

Back the Organizations feature. Conventions: acting on an org you’re not a member of is a 404 (indistinguishable from a nonexistent org); member-but-not-admin on admin-only routes is a 403; last-admin and personal-org guards are 409.

Endpoint	Who	What
`GET /api/orgs`	any	The caller’s orgs (creates their personal org on first call).
`POST /api/orgs` `{name}`	any	Create a team org; caller becomes admin.
`PATCH /api/orgs/{org_id}` `{name}`	admin	Rename.
`PUT /api/orgs/{org_id}/alerts/read`	member	Move the caller’s Alerts read watermark to now. Returns `{last_read_at}`. Idempotent.
`GET /api/orgs/{org_id}/pr-gate`	member	The org’s pull-request check policy (`{fail_on, new_only}`).
`PUT /api/orgs/{org_id}/pr-gate` `{fail_on, new_only}`	admin	Update the PR-check policy.
`GET /api/orgs/{org_id}/members`	member	Members with emails and roles.
`PUT /api/orgs/{org_id}/members/{user_id}/role` `{role}`	admin	Change a role (`409` on the last admin).
`DELETE /api/orgs/{org_id}/members/{user_id}`	admin or self	Kick / leave (`409` on the last admin or a personal org).
`GET /api/orgs/{org_id}/invites`	member	Pending invites.
`POST /api/orgs/{org_id}/invites` `{email, role}`	admin	Invite by email (`409` if already a member or already invited).
`DELETE /api/orgs/{org_id}/invites/{invite_id}`	admin	Revoke a pending invite.
`GET /api/invites`	any	Pending invites addressed to the caller’s JWT email.
`POST /api/invites/{invite_id}/accept`	invitee	Join; the JWT email must match (`404` otherwise).

List endpoints elsewhere in this reference (/api/repos, /api/attack-paths, /api/rule-settings*) accept an ?org=<uuid> query parameter, validated against membership (403 for non-members) and defaulting to the caller’s personal org.

`PUT /api/repositories/{repo_id}/monitor`

Toggles monitoring for one repository the user owns (404 otherwise). Monitored repos are scanned automatically when code is pushed to their default branch. Request

{ "monitored": true }

Response

{ "monitored": true }

`POST /api/webhooks/github`

Receives GitHub App webhook deliveries — the trigger behind monitored repos. Not bearer-authenticated: each delivery is authenticated by its GitHub signature (401 on a bad or missing signature). Only push events to a repo’s default branch trigger scans; every other delivery (ping, other events, other branches, branch deletions, replayed delivery IDs) is acknowledged with 200 and a short JSON reason. A push scan runs once per Pipefort user who monitors the pushed repo:

{ "scans": 1, "failed": 0 }

`PUT /api/repositories/{repo_id}/findings/{fingerprint}/status`

Triages one finding by its cross-scan fingerprint — see Finding triage. The ledger row is created at scan time, so triaging something never scanned (or another user’s repo) is a 404. Request

{ "status": "dismissed", "reason": "tolerated in CI" }

status is one of open (reopen), dismissed, accepted, false_positive, snoozed; reason is optional free text. expires_at (RFC3339) is required for accepted and snoozed and ignored for every other status. It must be in the future and no more than two years out; a request without it is a 400. This is what makes an accepted risk temporary rather than a dismissal by another name.

{
  "status": "accepted",
  "reason": "carrying it until the platform ticket lands",
  "expires_at": "2026-11-11T23:59:59Z"
}

Response — the new status plus the repo’s recomputed latest-scan counts (counts roll up open findings only, so triage changes them):

{ "status": "dismissed", "counts": { "high": 0, "medium": 1, "low": 2, "info": 0 } }

`GET /api/cron/expire-triage`

Returns lapsed accepted / snoozed findings to the queue as open and recomputes the affected repositories’ latest-scan counts. Scheduled daily; authenticated by the CRON_SECRET bearer token, not a user session, and 503 when no cron secret is configured.

{ "reopened": 3 }

Up to 500 rows per invocation — a larger backlog drains over successive runs.

Notification settings

Back the Notifications card in Settings. Your current settings are read directly (scoped to your account); the endpoints below handle writes and test delivery.

`PUT /api/notification-settings`

Upserts the user’s Slack webhook config. The URL must be an https://hooks.slack.com/… incoming webhook — anything else is a 400 (the server posts to this URL itself and restricts destinations to Slack).

{ "slack_webhook_url": "https://hooks.slack.com/services/T…/B…/…", "enabled": true }

`DELETE /api/notification-settings`

Removes the config. 204 on success.

`POST /api/notification-settings/test`

Sends a test message to the configured webhook. 404 when nothing is configured, 502 when Slack refuses the delivery, 200 {"delivered": true} on success.

Rule settings

The endpoints below back the Rule settings page (global toggles) and the Rule overrides card on each repository detail page (per-repo overrides). Reads return sparse rows — rules with no entry are treated as default-enabled per the catalog. The policy editor reads and writes by rule across every repository, so it uses the two org-scoped endpoints at the end of this section rather than looping the per-repo ones.

`GET /api/rules`

Returns the canonical rule catalog (static — same data the SPA renders).

{
  "rules": [
    {
      "id": "best-prac-2-missing-timeout",
      "category": "BEST-PRAC-2",
      "title": "Job timeout not configured",
      "default_severity": "LOW",
      "surface": "workflow",
      "description": "...",
      "doc_url": "/rules/best-prac-2"
    }
  ]
}

surface is "workflow" or "repo-settings".

`GET /api/rule-settings`

Returns the user’s sparse global preferences. Missing rule IDs are default-enabled.

{
  "settings": [
    { "rule_id": "best-prac-2-missing-timeout", "enabled": false, "updated_at": "..." }
  ]
}

`PUT /api/rule-settings/{rule_id}`

Upserts a global preference. Returns 204 No Content. Body:

{ "enabled": false }

Validates rule_id against the catalog; unknown slugs return 400.

`DELETE /api/rule-settings/{rule_id}`

Clears the global row, reverting the rule to default-enabled. Idempotent (204 even if no row existed).

`GET /api/repositories/{repo_id}/rule-overrides`

Returns the sparse list of override rows for one repo. The user must own the repo (verified via the same path POST /api/scan uses) — 404 otherwise.

{
  "overrides": [
    { "rule_id": "best-prac-2-missing-timeout", "enabled": true, "updated_at": "..." }
  ]
}

`PUT /api/repositories/{repo_id}/rule-overrides/{rule_id}`

Upserts an override for (user, repo, rule). Body { "enabled": bool }. Returns 204.

`DELETE /api/repositories/{repo_id}/rule-overrides/{rule_id}`

Clears the override, reverting the rule to inherit from the global setting. Idempotent.

`GET /api/rule-overrides`

Every repo-scoped override in the org, in one request. Optional ?rule_id=<id> narrows it to a single rule; an unknown slug returns 400. Org-scoped rows only — global toggles come from GET /api/rule-settings.

{
  "overrides": [
    {
      "repository_id": "0f1e...",
      "rule_id": "best-prac-2-missing-timeout",
      "enabled": true,
      "updated_by": "9a2c...",
      "updated_at": "2026-08-02T12:00:00Z"
    }
  ]
}

This exists because the per-repo endpoint is the wrong shape for a policy editor: eight repositories is eight requests, a real org is hundreds, and a client cannot tell “this repo has no override” apart from “that one request failed” — so at scale the per-repo path renders a policy that is not the policy in force.

`PUT /api/rule-overrides:batch`

Applies up to 500 policy changes in a single transaction. Either all of them land or none do. Request

{
  "changes": [
    { "repository_id": "0f1e...", "rule_id": "best-prac-2-missing-timeout", "value": "disabled" },
    { "repository_id": null,      "rule_id": "cicd-sec-3-unpinned-action",  "value": "inherit" }
  ]
}

repository_id: null targets the org default (the same row PUT /api/rule-settings/{rule_id} writes); a uuid targets that repository’s override.
value is "enabled", "disabled", or "inherit" — inherit deletes the row so the level above it decides.

Response

{ "applied": 2 }

Everything is validated before anything is written, so a rejected batch changes nothing:

Condition	Status
unknown `rule_id`, or a `value` outside the three	`400`
the same `(rule_id, repository_id)` targeted twice	`400`
more than 500 changes	`400`
a `repository_id` outside the resolved org	`404`

A repository in another org returns the same 404 as one that does not exist, so a batch cannot be used to probe for repository ids.

Workflow hardener

`POST /api/public/harden`

Unauthenticated. Takes a pasted GitHub Actions workflow and returns the hardened YAML — the same in-memory auto-fixer the app’s Open fix PR button uses. Nothing is stored. Shares the public teaser scan’s per-IP and global rate limits. Request

{ "yaml": "name: ci\non: [push]\n...", "categories": ["CICD-SEC-5"] }

categories is optional; omit it (or send []) to apply every available fix. Response

{
  "hardened": "...",
  "original": "...",
  "fixes_applied": 3,
  "changed": true,
  "available": [
    {
      "category": "BEST-PRAC-2",
      "title": "Add job timeouts",
      "count": 1,
      "hunks": [{ "old_start": 9, "old_lines": 0, "new_start": 10, "new_lines": 1 }]
    }
  ],
  "applied_categories": ["BEST-PRAC-2", "CICD-SEC-3", "CICD-SEC-5"],
  "unattributed_hunks": []
}

hunks is which lines of this response’s diff the category is responsible for, in 1-based line numbers: old_* indexes original, new_* indexes hardened, and a pure insertion has old_lines: 0. It is what lets a client untick a fix and revert exactly its lines, or hover one to isolate them — without re-posting once per category to work it out by subtraction. A category that was not applied has no hunks: this diff does not contain its fix. unattributed_hunks is normally empty; when it is not, the categories do not account for every changed line, and a client should say so rather than present its checkboxes as complete. Errors: 400 empty or oversized body, 422 not a parseable Actions workflow, 429 rate limited, 504 timed out resolving action versions (retry, or drop CICD-SEC-3 from categories).

`GET /api/badge/{owner}/{repo}[.svg]`

The embeddable README badge. Unauthenticated, reads the public-scan store only, and always returns a 200 SVG — even for an invalid or never-scanned repo — so a README never renders a broken image.

[![Pipefort](https://pipefort.com/api/badge/OWNER/REPO.svg)](https://pipefort.com)

It reflects the latest public scan of that repository within 90 days, which matches the public-scan retention window. Note that GitHub proxies README images through Camo, which caches aggressively and ignores the response’s max-age, so badges refresh on the order of hours regardless.

Bulk remediation campaigns

Org-wide fix-PR campaigns with per-repo tracking — see Bulk remediation campaigns. Like scanning, the campaign is client-driven: the browser loops the per-repo endpoint with bounded concurrency so each request stays short.

`POST /api/campaigns`

Creates a campaign over the selected repositories. Admin only (403 for members); resolves the org like other org-scoped calls (?org= or the personal org). Repos outside the org are silently skipped; 400 if none remain — and in that case nothing is persisted, so no empty campaign is left behind. Request

{
  "name": "Pin actions to SHA — Q3",
  "repo_ids": ["repo-uuid", "..."],
  "ruleset": "all"          // optional, defaults to "all"
}

ruleset must be one of all, owasp, slsa, or a specific SLSA level (slsa-build-l1…l3, slsa-source-l1…l4); anything else is 400. An unrecognized value would match no rule at all, which would make every repository look clean. Response — 201 with the campaign and its per-repo rows (all pending):

{
  "campaign": {
    "id": "uuid", "org_id": "uuid", "name": "Pin actions to SHA — Q3",
    "ruleset": "all", "status": "running", "total_repos": 2,
    "created_at": "2026-07-27T00:00:00Z"
  },
  "repos": [
    {
      "repo_id": "uuid", "repo_full_name": "acme/widgets",
      "status": "pending", "pr_count": 0, "fixes_applied": 0, "pr_urls": []
    }
  ]
}

`POST /api/campaigns/{campaign_id}/repos/{repo_id}/remediate`

Remediates one repository in a campaign (admin only): fetches and scans its workflow files in memory, opens (or reuses) one fix PR/MR per remediable file, and persists the per-repo status plus the campaign’s rollup. Every fixable rule for a given file is applied in a single commit, so prs_opened counts files remediated, not findings. Before anything is opened, the repository’s row is claimed — moved from pending to running — which is what makes the endpoint safe to retry:

404 when the campaign is unknown, or the repo isn’t part of it, or it belongs to a different organization. This is checked before any PR is opened.
409 when the repository is already being remediated, or already finished in this campaign. A double-click or client retry is a no-op rather than a second set of pull requests. A repo that failed can be retried — re-POSTing it claims the row again and puts the campaign back into running.
A run that dies mid-flight leaves the row running; it becomes retryable again after 15 minutes.

Response

{
  "repo_id": "uuid",
  "provider": "github",
  "status": "succeeded",     // succeeded | no_change | failed
  "prs_opened": 1,           // distinct PRs/MRs
  "fixes_applied": 3,
  "pr_urls": ["https://github.com/acme/widgets/pull/7"],
  "error": ""                // set when status is "failed"
}

error can also be set alongside succeeded: that is a partial remediation — some files got PRs while others failed (an expired token, branch protection rejecting a push). The dashboard renders those repos as Partial rather than as a clean success.

`GET /api/campaigns/{campaign_id}`

The tracker: campaign, per-repo statuses, and the derived rollup. Any org member may read; 404 for non-members.

{
  "campaign": { "id": "uuid", "name": "...", "status": "completed", "total_repos": 2, "...": "..." },
  "repos": [
    { "repo_id": "uuid", "repo_full_name": "acme/widgets", "status": "succeeded", "pr_count": 1, "fixes_applied": 3, "pr_urls": ["..."] }
  ],
  "rollup": {
    "total": 2, "pending": 0, "running": 0,
    "succeeded": 1, "failed": 0, "no_change": 1,
    "prs_opened": 1, "status": "completed"
  }
}

Reading data directly (no API call)

Reading scans, findings, repositories, installations, and rule settings does not go through these endpoints — the dashboard reads them directly from the database, scoped to your account so you only ever see your own data. The API only handles writes (persisting scan results and rule preferences), GitHub-side reads (which need an installation token), and the installation link callback.

`GET /api/cron/refresh-fix-prs`

Asks GitHub what is happening inside every fix pull request with no recorded outcome, and stores the answer (see the fix tracker). Scheduled daily; authenticated by the CRON_SECRET bearer token, not a user session, and 503 when no cron secret or GitHub App is configured.

{ "considered": 12, "refreshed": 11, "failed": 1 }

Two GitHub calls per pull request (the pull request, then its head commit’s check runs), capped at 200 per invocation and ordered least-recently-checked first — so the cap rotates rather than starving the tail. A pull request that cannot be read keeps its previous answer instead of gaining a guess, which is why failed is reported separately rather than folded into refreshed.

​Rate limiting & request IDs

​GET /api/health

​GET /api/capabilities

​GET /api/repos

​POST /api/scan

​POST /api/public-scan

​GET /api/public-scan/{slug}

​GET /api/public-stats

​GET /api/public/actions

​GET /api/public/actions/{owner}/{name}

​POST /api/public/actions/{owner}/{name}/request

​GET /api/attack-paths

​GET /api/repositories/{repo_id}/combos

​GET /api/actions/ranking

​GET /api/github/callback

​Organizations & invites

​PUT /api/repositories/{repo_id}/monitor

​POST /api/webhooks/github

​PUT /api/repositories/{repo_id}/findings/{fingerprint}/status

​GET /api/cron/expire-triage

​Notification settings

​PUT /api/notification-settings

​DELETE /api/notification-settings

​POST /api/notification-settings/test

​Rule settings

​GET /api/rules

​GET /api/rule-settings

​PUT /api/rule-settings/{rule_id}

​DELETE /api/rule-settings/{rule_id}

​GET /api/repositories/{repo_id}/rule-overrides

​PUT /api/repositories/{repo_id}/rule-overrides/{rule_id}

​DELETE /api/repositories/{repo_id}/rule-overrides/{rule_id}

​GET /api/rule-overrides

​PUT /api/rule-overrides:batch

​Workflow hardener

​POST /api/public/harden

​GET /api/badge/{owner}/{repo}[.svg]

​Bulk remediation campaigns

​POST /api/campaigns

​POST /api/campaigns/{campaign_id}/repos/{repo_id}/remediate

​GET /api/campaigns/{campaign_id}

​Reading data directly (no API call)

​GET /api/cron/refresh-fix-prs

Rate limiting & request IDs

`GET /api/health`

`GET /api/capabilities`

`GET /api/repos`

`POST /api/scan`

`POST /api/public-scan`

`GET /api/public-scan/{slug}`

`GET /api/public-stats`

`GET /api/public/actions`

`GET /api/public/actions/{owner}/{name}`

`POST /api/public/actions/{owner}/{name}/request`

`GET /api/attack-paths`

`GET /api/repositories/{repo_id}/combos`

`GET /api/actions/ranking`

`GET /api/github/callback`

Organizations & invites

`PUT /api/repositories/{repo_id}/monitor`

`POST /api/webhooks/github`

`PUT /api/repositories/{repo_id}/findings/{fingerprint}/status`

`GET /api/cron/expire-triage`

Notification settings

`PUT /api/notification-settings`

`DELETE /api/notification-settings`

`POST /api/notification-settings/test`

Rule settings

`GET /api/rules`

`GET /api/rule-settings`

`PUT /api/rule-settings/{rule_id}`

`DELETE /api/rule-settings/{rule_id}`

`GET /api/repositories/{repo_id}/rule-overrides`

`PUT /api/repositories/{repo_id}/rule-overrides/{rule_id}`

`DELETE /api/repositories/{repo_id}/rule-overrides/{rule_id}`

`GET /api/rule-overrides`

`PUT /api/rule-overrides:batch`

Workflow hardener

`POST /api/public/harden`

`GET /api/badge/{owner}/{repo}[.svg]`

Bulk remediation campaigns

`POST /api/campaigns`

`POST /api/campaigns/{campaign_id}/repos/{repo_id}/remediate`

`GET /api/campaigns/{campaign_id}`

Reading data directly (no API call)

`GET /api/cron/refresh-fix-prs`