Loading…...
REST API for programmatic access to runs, findings, eligible Starter+ evidence packs, and coverage. Most API responses are JSON; errors use the DoesItDefend error envelope, while downloads use their documented media type.
The reference is organized by task, not by endpoint number: start from the section that matches what you are building, and follow its links into the full contract pages. Every linked page states the same facts the API enforces, so there is one source of truth per behavior.
All endpoints live under the api.doesitdefend.ai origin with the Bearer token from your tenant settings, and responses share one error envelope. When something behaves differently from this page, the reference pages and the changelog are checked before the ticket is filed.
Run creation, status polling, findings, and coverage endpoints. The run lifecycle and the shared error envelope are the two contracts every client of the API needs first.
Bearer-token auth for machine calls, key management, and the per-tenant rate limits. The reference page states the exact header and the rotation cadence expected of production integrations.
The TypeScript and Python SDKs plus the CLI — thin wrappers that mirror the REST API one-for-one, with typed responses and the same DID_API_TOKEN credential.
Shortcuts into the concept library behind the API: how scoring works, what the defense lattice organizes, and how brittleness is measured. Reading these first makes the response fields self-explanatory.
Where the platform connects outward today: GitHub PR gating is available, and the hub page tracks roadmap connectors such as signed webhooks and Slack OAuth.
Task-oriented entries: the quickstart, the FAQ, and the technical foundations. Start here if you want a working end-to-end path before reading contract details.