First call in 2 minutes

Create a key, keep it in an environment variable and call the API. Then start your first scan.

1. Create a key

In the app, open Settings › API keys, name the key (“mysaas CI”) and click Create key. You need the Pro plan, or the Solo plan’s trial (see Access), and two-factor authentication turned on.

The key starts with rst_ and is shown once. Copy it right away.

2. Keep it in a variable

export RUSTINE_API_KEY="rst_..."

In your CI, put it in the secrets (GitHub Actions: Settings › Secrets and variables › Actions). Never in a committed file, never in an address.

3. Call the API

The command on the right lists your projects. If you see your project and its score, everything works. A 401 means the key is missing or mistyped: see Errors.

4. Start a scan

Take the id of a site in targets and start a quick scan:

curl https://api.rustine.io/v1/targets/8d2e4f6a-9b1c-4d3e-a5f7-0b2c4d6e8f1a/scans \
  -H "Authorization: Bearer $RUSTINE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"kind":"quick"}'

The scan runs in the background. Poll Get a scan every few seconds until done, then list the project’s issues.

The fix for an issue: Unlock the fix. Paste it into your agent, deploy, then recheck.
Your agent can do all of this by itself: Connect your agent.

const res = await fetch("https://api.rustine.io/v1/projects", { headers: { Authorization: `Bearer ${process.env.RUSTINE_API_KEY}` }, }) const page = await res.json() console.log(page.data.map((p) => `${p.name}: ${p.score}/100`))

import os import requests page = requests.get( "https://api.rustine.io/v1/projects", headers={"Authorization": f"Bearer {os.environ['RUSTINE_API_KEY']}"}, ).json() print([f"{p['name']}: {p['score']}/100" for p in page["data"]])

{ "object": "list", "data": [ { "id": "4f9c2a7e-1b3d-4e5f-8a6b-7c8d9e0f1a2b", "object": "project", "name": "My SaaS", "score": 62, "grade": "C", "open_issues": 3, "targets": [ { "id": "8d2e4f6a-9b1c-4d3e-a5f7-0b2c4d6e8f1a", "kind": "domain", "address": "app.mysaas.com", "verified": true } ] } ], "has_more": false }

First call in 2 minutes

1. Create a key

2. Keep it in a variable

3. Call the API

4. Start a scan

Next