> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rafter.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Reference

> Complete API reference for Rafter's public scanning API

## Welcome to the Rafter API

The Rafter API provides programmatic access to our security scanning capabilities. Use this API to integrate security scanning into your applications, automation workflows, and CI/CD pipelines.

## Base URL

```
https://rafter.so
```

## API Endpoints

| Method | Endpoint            | Description                                                                     |
| ------ | ------------------- | ------------------------------------------------------------------------------- |
| GET    | `/api/static/usage` | Check your API quota and remaining scans                                        |
| POST   | `/api/static/scan`  | Trigger a new security scan for a repository (supports `fast` and `plus` modes) |
| GET    | `/api/static/scan`  | Check scan status and retrieve results                                          |

## Authentication

All API requests require authentication using an API key. Include your API key in the `x-api-key` header with every request.

```bash theme={null}
curl -H "x-api-key: RFabc-your-api-key-here" \
  https://rafter.so/api/static/usage
```

<Note>
  Your API key starts with `RF` and should be kept secure. Never commit it to version control. Use environment variables or secure secret management systems.
</Note>

## Rate Limiting

The API implements rate limiting to ensure fair usage:

* **Rate Limit**: 100 requests per minute per IP address
* **Quota**: Based on your subscription plan

## Response Formats

The API supports multiple response formats:

### JSON (Default)

All endpoints return JSON responses by default:

```json theme={null}
{
  "status": "completed",
  "vulnerabilities": [
    {
      "rule_id": "SEC001",
      "level": "error",
      "file": "src/auth.js",
      "line": 42,
      "message": "Hardcoded API key detected"
    }
  ]
}
```

### Markdown (format=md)

Some endpoints support Markdown format for human-readable reports:

```bash theme={null}
curl -H "x-api-key: RFabc-your-key" \
  "https://rafter.so/api/static/scan?scan_id=123&format=md"
```

## Error Handling

The API uses standard HTTP status codes:

| Status Code | Description                             |
| ----------- | --------------------------------------- |
| 200         | Success                                 |
| 400         | Bad Request - Missing required fields   |
| 401         | Unauthorized - Invalid API key          |
| 403         | Forbidden - Quota exceeded              |
| 404         | Not Found - Resource not found          |
| 429         | Too Many Requests - Rate limit exceeded |
| 500         | Internal Server Error - Server error    |

Error responses include a descriptive message:

```json theme={null}
{
  "error": "Invalid or inactive API key."
}
```

## Getting Started

<CardGroup cols={3}>
  <Card title="Check Usage" icon="gauge" href="/api-reference/endpoint/usage">
    Check your API quota and remaining scans.
  </Card>

  <Card title="Trigger Scan" icon="play" href="/api-reference/endpoint/static/scan">
    Start a new security scan for your repository.
  </Card>

  <Card title="Get Results" icon="download" href="/api-reference/endpoint/static/get">
    Retrieve scan results and vulnerability reports.
  </Card>
</CardGroup>

## CLI

While you can use the API directly with HTTP requests, we also provide powerful [CLI tools](/guides/basics).

## Support

* **Documentation**: This API reference
* **Support**: Visit our [support page](https://rafter.so/help)