# First call in 2 minutes

> Create a key, keep it in an environment variable and call the API. Then start your first scan.

## 1. Create a key

In the app, open [Settings › API keys](https://app.rustine.io/en/settings?section=apiKeys), name the key ("mysaas CI") and click **Create key**. You need the Pro plan, or the Solo plan's trial (see [Access](https://docs.rustine.io/en/access.md)), and two-factor authentication turned on.

The key starts with `rst_` and is shown once. Copy it right away.

## 2. Keep it in a variable

```bash
export RUSTINE_API_KEY="rst_..."
```

In your CI, put it in the secrets (GitHub Actions: **Settings › Secrets and variables › Actions**). Never in a committed file, never in an address.

## 3. Call the API

The command on the right lists your projects. If you see your project and its score, everything works. A `401` means the key is missing or mistyped: see [Errors](https://docs.rustine.io/en/api/errors#invalid_api_key).

## 4. Start a scan

Take the `id` of a site in `targets` and start a quick scan:

```bash
curl https://api.rustine.io/v1/targets/8d2e4f6a-9b1c-4d3e-a5f7-0b2c4d6e8f1a/scans \
  -H "Authorization: Bearer $RUSTINE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"kind":"quick"}'
```

The scan runs in the background. Poll [Get a scan](https://docs.rustine.io/en/api/scans/get.md) every few seconds until `done`, then [list the project's issues](https://docs.rustine.io/en/api/issues/list.md).

## Next

- The fix for an issue: [Unlock the fix](https://docs.rustine.io/en/api/issues/unlock-fix.md). Paste it into your agent, deploy, then [recheck](https://docs.rustine.io/en/api/issues/recheck.md).
- Your agent can do all of this by itself: [Connect your agent](https://docs.rustine.io/en/mcp/connect.md).

## Examples

### curl

```bash
curl https://api.rustine.io/v1/projects \
  -H "Authorization: Bearer $RUSTINE_API_KEY"
```

### Node

```js
const res = await fetch("https://api.rustine.io/v1/projects", {
  headers: { Authorization: `Bearer ${process.env.RUSTINE_API_KEY}` },
})
const page = await res.json()
console.log(page.data.map((p) => `${p.name}: ${p.score}/100`))
```

### Python

```python
import os

import requests

page = requests.get(
    "https://api.rustine.io/v1/projects",
    headers={"Authorization": f"Bearer {os.environ['RUSTINE_API_KEY']}"},
).json()
print([f"{p['name']}: {p['score']}/100" for p in page["data"]])
```

### Response: 200 OK

```json
{
  "object": "list",
  "data": [
    {
      "id": "4f9c2a7e-1b3d-4e5f-8a6b-7c8d9e0f1a2b",
      "object": "project",
      "name": "My SaaS",
      "score": 62,
      "grade": "C",
      "open_issues": 3,
      "targets": [
        {
          "id": "8d2e4f6a-9b1c-4d3e-a5f7-0b2c4d6e8f1a",
          "kind": "domain",
          "address": "app.mysaas.com",
          "verified": true
        }
      ]
    }
  ],
  "has_more": false
}
```