​
Welcome to the Rafter API

The Rafter API provides programmatic access to our security scanning capabilities. Use this API to integrate security scanning into your applications, automation workflows, and CI/CD pipelines.

​
Base URL

https://rafter.so

​
API Endpoints

MethodEndpointDescription
GET/api/static/usageCheck your API quota and remaining scans
POST/api/static/scanTrigger a new security scan for a repository
GET/api/static/scanCheck scan status and retrieve results

​
Authentication

All API requests require authentication using an API key. Include your API key in the x-api-key header with every request. 
curl -H "x-api-key: RFabc-your-api-key-here" \
  https://rafter.so/api/static/usage
Your API key starts with RF and should be kept secure. Never commit it to version control. Use environment variables or secure secret management systems.

​
Rate Limiting

The API implements rate limiting to ensure fair usage:
  • Rate Limit: 100 requests per minute per IP address
  • Quota: Based on your subscription plan

​
Response Formats

The API supports multiple response formats:

​
JSON (Default)

All endpoints return JSON responses by default: 
{
  "status": "completed",
  "vulnerabilities": [
    {
      "rule_id": "SEC001",
      "level": "high",
      "file": "src/auth.js",
      "line": 42,
      "message": "Hardcoded API key detected"
    }
  ]
}

​
Markdown (format=md)

Some endpoints support Markdown format for human-readable reports: 
curl -H "x-api-key: RFabc-your-key" \
  "https://rafter.so/api/static/scan?scan_id=123&format=md"

​
Error Handling

The API uses standard HTTP status codes:
Status CodeDescription
200Success
400Bad Request - Missing required fields
401Unauthorized - Invalid API key
403Forbidden - Quota exceeded
404Not Found - Resource not found
429Too Many Requests - Rate limit exceeded
500Internal Server Error - Server error
Error responses include a descriptive message: 
{
  "error": "Invalid or inactive API key."
}

​
Getting Started

Check Usage

Check your API quota and remaining scans.

Trigger Scan

Start a new security scan for your repository.

Get Results

Retrieve scan results and vulnerability reports.

​
CLI

While you can use the API directly with HTTP requests, we also provide powerful CLI tools.

​
Support

  • Documentation: This API reference
  • Support: Visit our support page