Live in public beta — base URL https://api.agentic.forwardlane.com · metered, no charges during beta.
Security findings per repository — hardcoded secrets, unsafe deserialization, injection patterns — with severity filters. Findings come from the static security extractor over the indexed estate; the LLM triage layer (reachability-aware severity re-rating) is rolling out during the beta.

​
Authentication

All product endpoints require a tenant member API key sent as a bearer token. Both a missing and an invalid key return 401 with a docs_url field pointing at the authentication guide.

​
Quickstart

The second call reads your usage meters — every product call is metered against your organization.

​
Endpoints

​
GET /api/security

List security findings. Returns: items (findings) and total.

​
Data provenance

security_config_extractor.py static findings (DuckDB security_patterns, 361 findings incl. 75 critical) + LLM triage layer that re-rates severity using call-graph reachability (call_graph_hops), CWE/OWASP ontology grounding, writing justification + confidence; validated 90% false-positive kill rate on triaged set. What the data is: Static findings enriched with reachability-aware LLM verdicts: llm_severity, justification, confidence, recommendation, call_graph_hops.

​
Beta notes

  • This API is in public beta. Credits run in shadow mode: usage is metered and visible at GET /v1/billing/usage, but no charges are made during the beta.
  • Authentication is tenant member API keys only; per-call x402 payments are coming soon and not yet accepted.
  • Machine discovery: GET /v1/catalog (public, no auth) lists all products with live/coming-soon status and docs links.
  • Response shapes may still change during the beta; breaking changes will be announced in the changelog before they land.