Kolega DevSec Public API

Authentication

Organization API key. Generate keys in Organization Settings -> API Keys and send them as Bearer tokens.

• Generate API keys in Organization Settings -> API Keys.
• Send the key in the Authorization header as a Bearer token.
• Keys are organization-scoped and intended for requests under /api/v1.

Quickstart

Typical flow: list repositories, trigger a scan batch, poll the batch progress endpoint, read aggregated batch results, review findings, create a fix, then poll fix progress before opening pull requests.

curl -s "https://api.kolega.dev/api/v1/repositories?limit=10" \
  -H "Authorization: Bearer kcp_live_your_api_key_here" \
  -H "Accept: application/json"

curl -s "https://api.kolega.dev/api/v1/repositories/$REPOSITORY_ID/scans" \
  -X POST \
  -H "Authorization: Bearer kcp_live_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "scan_type": "deep_ai_scan"
  }'

curl -s "https://api.kolega.dev/api/v1/repositories/$REPOSITORY_ID/scans/$SCAN_ID/progress" \
  -H "Authorization: Bearer kcp_live_your_api_key_here"

curl -s "https://api.kolega.dev/api/v1/repositories/$REPOSITORY_ID/scans/$SCAN_ID/results" \
  -H "Authorization: Bearer kcp_live_your_api_key_here"

curl -s "https://api.kolega.dev/api/v1/repositories/$REPOSITORY_ID/fixes" \
  -X POST \
  -H "Authorization: Bearer kcp_live_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "finding_ids": ["'$FINDING_ID'"],
    "title": "Remediate SQL injection in auth flow",
    "instructions": "Preserve current API behavior and add regression coverage.",
    "source_repo": "acme/auth-service",
    "source_repo_provider": "github",
    "source_scan_branch": "main"
  }'

curl -s "https://api.kolega.dev/api/v1/repositories/$REPOSITORY_ID/fixes/$FIX_ID/progress" \
  -H "Authorization: Bearer kcp_live_your_api_key_here"

curl -s "https://api.kolega.dev/api/v1/repositories/$REPOSITORY_ID/fixes/$FIX_ID/pull-requests" \
  -X POST \
  -H "Authorization: Bearer kcp_live_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

• scan_type accepts secrets_scan, semgrep_scan, deep_ai_scan, or sbom_scan.
• GET /repositories/{repository_id}/scans/{scan_id} now returns the scan batch detail created by POST /scans.
• GET /repositories/{repository_id}/scans/{scan_id}/progress is the primary polling endpoint for live scan progress.
• GET /repositories/{repository_id}/scans/{scan_id}/results returns findings aggregated across every repository in the batch.
• GET /repositories/{repository_id}/fixes/{fix_id}/progress is the primary polling endpoint for active fixes.
• GET /me returns the calling key's organization, scopes, and quota period — handy for verifying credentials before automating.
• GET /finding-events is an organization-wide, reverse-chronological feed of finding lifecycle events for audit trails and webhook-style polling.
• POST /repositories/{repository_id}/fixes/{fix_id}/refine re-runs the agent with follow-up instructions; POST .../cancel stops a pending or running fix.

Account

Inspect the identity, organization, and scopes of the calling API key.

Repositories

Discover the repository ids and source inventory available to the calling organization.

Scans

Create scan batches, poll live batch progress, inspect batch details, and fetch aggregated findings.

Findings

List findings for a repository, inspect one finding, or update its lifecycle status.

Finding Events

Stream organization-wide finding lifecycle events for audit trails and webhook-style polling.

Fixes

Create remediation runs, poll fix progress, inspect diffs, and create pull requests.

Quotas

Check current organization quota balances exposed by the public API.