API Reference

Base URL: https://api.patchlynx.com/v1

All requests require Bearer token authentication. Rate limits: 100 req/min on Pro, 500 req/min on Team.

POST /scans

Trigger a new reachability scan on a connected repository. Returns a scan object with a unique ID you can poll for results.

Requires Bearer token with scans:write scope.

Request

json
POST /scans
Content-Type: application/json

{
  "repo_id": "repo_abc123",
  "ref": "main",
  "threshold": {
    "severity": "medium",
    "reachable_only": true
  }
}

Response 201 Created

json
{
  "id": "scan_7xKp2m4nQ9",
  "status": "queued",
  "repo_id": "repo_abc123",
  "created_at": "2025-05-08T14:22:33Z"
}
GET /scans/{id}

Retrieve the status and metadata of a scan. Poll until status == "complete".

json
{
  "id": "scan_7xKp2m4nQ9",
  "status": "complete",
  "duration_ms": 11420,
  "total_advisories": 284,
  "reachable_count": 6,
  "completed_at": "2025-05-08T14:22:45Z"
}
GET /scans/{id}/findings

Returns the ranked list of reachable vulnerabilities for a completed scan. Sorted by severity × reachability score.

json
{
  "findings": [
    {
      "cve_id": "CVE-2021-23337",
      "package": "lodash",
      "version": "4.17.20",
      "severity": "critical",
      "reachable": true,
      "call_path": "/api/payment/process -> controllers/payment.js:47 -> lodash",
      "fix_version": "4.17.21"
    }
  ]
}
POST /repos

Connect a new repository to your Patchlynx account. Requires OAuth scope on the repository.

GET /repos

List all connected repositories for the authenticated account.