API reference

The address, formats and conventions shared by every route of API v1, then each route one by one.

Address: https://api.rustine.io/v1

Authentication: Authorization: Bearer rst_… (Authentication).
Format: JSON in and out, snake_case fields, ISO 8601 dates (UTC), UUID ids.
Lists: { "object": "list", "data": [...], "has_more": false }, with limit and starting_after (Pagination).
Errors: { "error": { "type", "code", "message", "doc_url" } } (Errors).
Writes: send an Idempotency-Key on POST requests (Idempotency).
Language: error messages and issue texts come in the language of the key’s owner.

Every response carries Request-Id (give it to support), Rustine-Version (the contract version that answered, see Versions) and the X-RateLimit-* headers (Rate limits and quotas).

The full specification is served as-is at /openapi.json (OpenAPI 3.1): import it into Postman, Insomnia or a client generator.

Routes

GET /projects	List projects
POST /projects	Create a project
GET /projects/{project_id}	Get a project
POST /projects/{project_id}/targets	Add a site
POST /targets/{target_id}/scans	Start a scan
GET /scans/{scan_id}	Get a scan
GET /projects/{project_id}/scans	List a project's scans
GET /projects/{project_id}/issues	List issues
GET /issues/{issue_id}	Get an issue
POST /issues/{issue_id}/fix	Unlock the fix
GET /issues/{issue_id}/fix	Read a fix
POST /issues/{issue_id}/recheck	Recheck an issue
PATCH /issues/{issue_id}	Mark an issue
GET /account	Your plan and quotas