Code Audit Documentation

The shortest integration path does not create a project. Omit project_id when uploading and creating a task to reuse the same default project as New Audit.

1. 01

   Read catalogs

   GET /models · GET /analysis-types

   Discover the models and analysis types actually allowed by the workspace plan.

2. 02

   Upload source

   POST /uploads

   Omit project_id to use the default project automatically.

3. 03

   Create an audit

   POST /tasks

   Send source_asset_id and analysis_type; omit model to use auto. billing_mode defaults to usage_based with reports included; send outcome_based for the lower model rate and separately unlocked reports. First request a Credits estimate and send its billing_rate_multiplier as expected_billing_rate_multiplier; refresh the estimate after a 409. Set allow_insufficient_credits only after explicit confirmation.

4. 04

   Poll and report

   GET /tasks/{id} · POST /findings/{id}/report · POST /tasks/{id}/report/download

   Poll task status. Usage-Based reports unlock automatically at no extra charge. Outcome-Based finding reports unlock explicitly with Credits or one Golden Finger; task bundles support Credits only.

BASE_URL="https://sec.transplane.sg/v1"

curl -fsS "$BASE_URL/models" \
  -H "Authorization: Bearer $CODE_AUDIT_KEY"

curl -fsS -X POST "$BASE_URL/tasks" \
  -H "Authorization: Bearer $CODE_AUDIT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "source_asset_id": "asset_uuid",
    "analysis_type": 0,
    "model": "auto",
    "billing_mode": "usage_based",
    "expected_billing_rate_multiplier": 5,
    "allow_insufficient_credits": false
  }'

Every request requires a Bearer API key. Keys currently have general OpenAPI access across their workspace; scopes are not yet supported. The full key is shown only once, so store it in server-side environment variables or CI secrets.

Authorization: Bearer sk-xxxxxxxxx

Access model

Workspace-wide access

Compatibility prefix

https://sec.transplane.sg/openapi/v1

Read the models and analysis types allowed by the current plan before creating a task. Both catalog endpoints are read-only GET requests and do not consume quota.

{
  "models": ["auto", "model-a"],
  "default_model": "auto",
  "stale": false,
  "descriptions": {
    "model-a": "Example model"
  }
}

{
  "analysis_types": [
    {
      "value": 0,
      "code": "flexible",
      "name": "Flexible audit",
      "description": "Flexible 0-day vulnerability audit"
    }
  ],
  "default_analysis_type": 0
}

Endpoints are grouped by discovery, projects, assets, tasks, reports, and billing. Operations that may create usage or charges use POST.

error_code is the stable machine contract. message is diagnostic and may include dynamic content, so it should not control program flow.

The Code Audit API follows standard HTTP/JSON conventions and can be integrated with backend services, CI pipelines, and internal security platforms.

• TypeScript fetchHTTP/JSON
• Python requestsHTTP/JSON
• Go net/httpHTTP/JSON