Agent & CI/CD Integration

Let machines run CodeCritical scans — one API key, every plan, zero browser sessions.

The 4-step flow (shared by agents & CI)

1

Mint a key (once, interactive)

Sign in and open Settings → API Keys. Give the key a name — the secret cc_sk_… is shown exactly once — store it in your secret manager.

2

Upload source

POST /api/v1/scan/upload with header X-Api-Key and a .zip of the source. A jobId comes back immediately.

3

Poll status

GET /api/v1/scan/{id}/status every ~10 s until COMPLETED or FAILED. Don't spin — engines are containerised.

4

Fetch results

JSON verdict + score via GET /api/v1/scan/{id}, or the LLM-ready markdown via /export/llm.

Why agents use CodeCritical

  • Key-scoped access: API keys are limited to the scan rails — uploads, polling, results, exports and history. Dashboard surfaces (settings, billing, credentials, admin) return 403.
  • Provide a downloadable skill file so the agent never has to guess the flow — see the download card below.
  • Bad key ⇒ 401; expired quota ⇒ 429 with machine-readable code: "QUOTA_EXHAUSTED" ("Monthly scan quota reached") — surface that as "upgrade", never a retry loop. 503 (code: "MAINTENANCE") means platform maintenance — brief retry is correct there.

Minimal snippet

# Upload (once per change)
curl -X POST https://codecritical.nemesisnet.co.za/api/v1/scan/upload \
  -H "X-Api-Key: $CC_API_KEY" -F "[email protected]"
# -> { "status": "success", "data": { "jobId": 37 } }

# Poll
curl -s https://codecritical.nemesisnet.co.za/api/v1/scan/37/status \
  -H "X-Api-Key: $CC_API_KEY"

# Results
curl -s https://codecritical.nemesisnet.co.za/api/v1/scan/37 \
  -H "X-Api-Key: $CC_API_KEY" -o result.json

# LLM-friendly report
curl -s https://codecritical.nemesisnet.co.za/api/v1/scan/37/export/llm \
  -H "X-Api-Key: $CC_API_KEY" -o report.md

Downloads

skill.mdAgent-consumable skill file (frontmatter + full flow + guardrails) — drop it into your agent's skills folder.github-action.ymlReady GitHub Actions workflow: archive → upload → poll → verdict gate → report artifacts.

API access is available on all plans, including Free. Keys belong to your user account — mint, rotate and revoke them under Settings → API Keys at any time.