Reference - Rafter

Welcome to the Rafter API

The Rafter API provides programmatic access to our security scanning capabilities. Use this API to integrate security scanning into your applications, automation workflows, and CI/CD pipelines.

Base URL

https://rafter.so

API Endpoints

Method	Endpoint	Description
GET	`/api/static/usage`	Check your API quota and remaining scans
POST	`/api/static/scan`	Trigger a new security scan for a repository (supports `fast` and `plus` modes)
GET	`/api/static/scan`	Check scan status and retrieve results
POST	`/api/static/sites`	Register a Site for live-application monitoring and kick off its first scan
GET	`/api/static/sites`	List your registered Sites, paginated
GET	`/api/static/sites/:id`	Check a Site’s status, latest run, and findings summary
POST	`/api/static/sites/scan`	Trigger a re-scan of a Site you already own

Authentication

All API requests require authentication using an API key. Include your API key in the x-api-key header with every request.

curl -H "x-api-key: RFabc-your-api-key-here" \
  https://rafter.so/api/static/usage

Your API key starts with RF and should be kept secure. Never commit it to version control. Use environment variables or secure secret management systems.

Rate Limiting

The /api/static/sites* endpoints are rate-limited per account (see each Sites endpoint’s reference page for its specific limit); a 429 response includes X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers. The scan and usage endpoints (/api/static/scan, /api/static/usage) are not currently rate-limited beyond your scan quota.

Response Formats

The API supports multiple response formats:

JSON (Default)

All endpoints return JSON responses by default:

{
  "status": "completed",
  "vulnerabilities": [
    {
      "rule_id": "SEC001",
      "severity": "error",
      "file_path": "src/auth.js",
      "line_start": 42,
      "title": "Hardcoded API key detected"
    }
  ]
}

Markdown (format=md)

Some endpoints support Markdown format for human-readable reports:

curl -H "x-api-key: RFabc-your-key" \
  "https://rafter.so/api/static/scan?scan_id=123&format=md"

Error Handling

The API uses standard HTTP status codes:

Status Code	Description
200	Success
400	Bad Request - Missing required fields or invalid input
401	Unauthorized - Invalid API key
403	Forbidden - Quota/plan limit reached, or insufficient API key scope
404	Not Found - Resource not found
422	Unprocessable Entity - A supplied `github_token` failed GitHub access verification (trigger-scan only)
429	Too Many Requests - Rate limit exceeded (Sites endpoints only)
500	Internal Server Error - Server error
502	Bad Gateway - A completed scan’s report could not be read from storage

Error responses include a descriptive message:

{
  "error": "Invalid or inactive API key."
}

Getting Started

Check Usage

Check your API quota and remaining scans.

Trigger Scan

Start a new security scan for your repository.

Get Results

Retrieve scan results and vulnerability reports.

Register a Site

Monitor a live domain instead of a code repository.

CLI

While you can use the API directly with HTTP requests, we also provide powerful CLI tools.

Support

Documentation: This API reference
Support: Visit our support page

​Welcome to the Rafter API

​Base URL

​API Endpoints

​Authentication

​Rate Limiting

​Response Formats

​JSON (Default)

​Markdown (format=md)

​Error Handling

​Getting Started

Check Usage

Trigger Scan

Get Results

Register a Site

​CLI

​Support

Welcome to the Rafter API

Base URL

API Endpoints

Authentication

Rate Limiting

Response Formats

JSON (Default)

Markdown (format=md)

Error Handling

Getting Started

CLI

Support