Skip to main content

CI Gate & Export

Once you trust the API risk grade, make it enforce. API Security ships a score gate for your pipeline and a SARIF export for your code-scanning tooling.

Score gate​

The gate fails a pipeline when the API risk score drops below a threshold you set. The page gives you a copy-paste CI snippet; the gate returns a non-zero exit code below the threshold so the build stops. Run it in report mode first, then set the threshold to a number you are prepared to hold the line on.

This is the same fail-closed philosophy as the main CI/CD gate, scoped to the API estate: risky API changes do not merge silently.

SARIF 2.1.0 export​

Export API findings as SARIF 2.1.0 so they show up natively in your code-scanning surface (for example GitHub code scanning). It is the standard interchange format, so the findings live where your engineers already triage - no separate portal required.

API-scoped compliance​

The Overview tab includes an API-scoped compliance view: your API findings mapped to PCI-DSS, HIPAA, GDPR, ISO 27001, SOC 2, NIST 800-53 and the OWASP API Top 10, so an auditor sees API posture against the frameworks that matter, filtered to the API surface only.

Last updated on