API › Projects

List projects

Your projects, with their sites, their score out of 100 and their open issues. The site ids (targets[].id) are what you pass to start a scan.

GEThttps://api.rustine.io/v1/projects

OAuth permission: scans:read · an API key has them all

Open in Claude Open in ChatGPT

Query parameters

limitintegeroptional
How many objects to return, 1 to 100 (default 20).
starting_afterstringoptional
Cursor: the id of the last object of the previous page.

Response

objectstring
dataarray of object
- idstring
  Project id.
- objectstring
- namestring
  Project name.
- scorenumber | null
  Score out of 100; null before the first finished scan.
- gradestring | null
  Grade from A to F; null before the first finished scan.
  ABCDF
- open_issuesinteger
  Open issues across the project's targets, hidden ones included.
- pausedboolean
  Paused because the plan covers fewer projects: readable, but no scan, recheck, fix or new address.
- last_scan_atstring | null
  End of the last finished scan of any target.
- targetsarray of object
  - idstring
    Target id: a site (domain) or a GitHub repository of the project.
  - objectstring
  - project_idstring
    Project the target belongs to.
  - kindstring
    domain (a site) or repository.
    domainserverrepository
  - addressstring
    Hostname of a site (app.example.com) or owner/repo of a repository.
  - verifiedboolean
    Whether the workspace proved it controls this target. Without proof, issue details stay hidden and only quick scans run.
  - scorenumber | null
    Score out of 100; null before the first finished scan.
  - gradestring | null
    Grade from A to F; null before the first finished scan.
    ABCDF
  - last_scan_atstring | null
    End of the last finished scan.
  - hidden_issuesobject | null
    Unverified site: what its hidden issues amount to, counts only (never which, nor where). Null when nothing is hidden.
    - urgentinteger
      Open critical and high issues hidden until the site is verified.
    - laterinteger
      Open medium and low issues hidden until the site is verified.
has_moreboolean
Whether more objects follow: pass the last id as starting_after.

Errors

Status	error.code	What happens
400	parameter_invalid	A parameter is missing or invalid; `param` names it.
400	cursor_invalid	`starting_after` is not the id of an item of this list.
401	authentication_required	No key in the request. Pass it in the `Authorization: Bearer rst_…` header, never in the address.
401	invalid_api_key	The key or OAuth token is wrong, revoked or expired. Check it is copied in full, or create a new key.
402	api_plan_required	The workspace is on the Free plan. The API comes with Pro, or on a 14-day trial with Solo.
402	api_trial_ended	Solo's 14-day trial is over. Move to Pro: your keys work again at once.
403	scope_missing	The OAuth token lacks the permission this route needs (shown on its page). Reconnect the agent to grant it. An API key has every permission.
429	rate_limited	Too many requests for this key (120 per minute). Wait `Retry-After` seconds.
500	internal_error	An error on our side, reported automatically. Retry later; give the `Request-Id` to support if it comes back.
503	service_unavailable	Rustine is unavailable for a moment. Retry with the same `Idempotency-Key`.