DryRun API

Retrieve all accounts that the authenticated API key has access to, including organization information.

Responses

• 200 - accounts listed

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts"

Retrieve all repositories associated with the specified account.

Parameters

Responses

• 200 - repositories listed

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/repositories"

List PR scans for a repository. Supports filtering by PR number, date range, severity, result, and the user who initiated the scan.

Parameters

Response Fields

Responses

• 200 - scans listed

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/repositories/{repository_id}/scans?pr_number=42"

Get detailed results for a specific PR scan, including all findings.

Parameters

Responses

• 200 - scan found

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/repositories/{repository_id}/scans/{id}"

List all PR findings for a repository. Each finding includes a dashboard_url linking to the finding in the DryRun Security dashboard.

Parameters

Responses

• 200 - findings listed

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/repositories/{repository_id}/findings"

List all findings across PR scans, DeepScans, SCA, and code policies for an account. By default, returns only findings from the latest scan. Results are sorted by newest first.

Each finding includes a state field indicating its current status: open (present in the latest scan and not triaged), dismissed (triaged with a category such as false positive or accepted risk), or resolved (no longer present in the latest scan). For triaged findings, the response also includes a triage object with the category (false_positive, wont_fix, accepted_risk, in_progress) and category_name.

Parameters

Responses

• 200 - findings listed

Example response

{
  "data": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "finding_type": "pullrequest",
      "dashboard_url": "https://app.dryrun.security/risk-register/44444444-4444-4444-4444-444444444444",
      "severity": "high",
      "type": "Missing Authorization and IDOR in User Deletion",
      "description": "The DELETE /users/{id} endpoint is registered without authentication or authorization middleware...",
      "filename": "backend/main.go",
      "line_start": 516,
      "line_end": 553,
      "repository_name": "some-demo-repo-name",
      "state": "open",
      "triage": null,
      "created_at": "2026-03-03T00:00:00Z"
    }
  ]
}

Response Fields

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/all_findings?days=30"

Set a triage category for a finding to track its resolution status.

Parameters

Request Body

{
  "triage_category": "false_positive"
}

Valid values for triage_category: false_positive, wont_fix, accepted_risk, in_progress.

Responses

• 200 - triage category set

Example (curl)

curl -X POST \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"triage_category": "false_positive"}' \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/findings/{finding_id}/triage"

Retrieve the current triage status for a specific finding.

Parameters

Responses

• 200 - triage status returned

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/findings/{finding_id}/triage"

Remove the triage category from a finding, resetting its triage status.

Parameters

Responses

• 200 - triage category removed

Example (curl)

curl -X DELETE \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/findings/{finding_id}/triage"

Retrieve all deepscans associated with the specified account.

Parameters

Responses

• 200 - deepscans listed

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/deepscans"

Retrieve all deepscans for a specific repository.

Parameters

Responses

• 200 - deepscans listed

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/repositories/{repository_id}/deepscans"

Trigger a full-repository DeepScan programmatically. Useful for integrating DeepScan into CI/CD pipelines, scheduled automation, or external workflows. All request body fields are optional. Omitting branch and commit_sha scans the repository’s default branch at HEAD.

Parameters

Request body

Responses

• 202 - scan triggered
• 404 - repository not found
• 422 - API key has no associated user
• 429 - scan quota exceeded
• 502 - internal invocation error

Teams running DeepScan through automation should handle 429 quota exceeded errors gracefully, as accounts have a limit on concurrent scans.

Example response

{
  "data": {
    "id": "11111111-1111-1111-1111-111111111111",
    "repository_id": "22222222-2222-2222-2222-222222222222",
    "status": "queued"
  }
}

Example (curl)

curl -X POST \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"branch": "main"}' \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/repositories/{repository_id}/deepscans"

Retrieve all findings from a specific deepscan run.

Parameters

Responses

• 200 - deepscan results listed

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/repositories/{repository_id}/deepscans/{deepscan_id}/results"

List SCA findings for a specific DeepScan run.

Parameters

Response Fields

id, dashboard_url, title, description, severity, package_name, package_version, package_ecosystem, cve_id, cvss_score, fixed_version, remediation, locations, references, created_at

Responses

• 200 - SCA results listed

Example (curl)

curl \
  -H "Authorization: Bearer <your-api-key>" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/repositories/{repository_id}/deepscans/{deepscan_id}/sca_results"

Retrieve SBOM metadata and a time-limited download URL for the CycloneDX SBOM generated during a DeepScan. The download_url is valid until download_url_expires_at and points directly to the SBOM file.

Parameters

Responses

• 200 - SBOM metadata and download URL
• 404 - DeepScan not found

Response fields

Example response

{
  "data": {
    "deepscan_id": "11111111-1111-1111-1111-111111111111",
    "repository_id": "22222222-2222-2222-2222-222222222222",
    "branch": "main",
    "commit_sha": "abc123def456",
    "format": "cyclonedx",
    "component_count": 142,
    "generated_at": "2026-06-01T00:00:00Z",
    "vulnerability_summary": {
      "critical": 1,
      "high": 3,
      "medium": 7,
      "low": 4,
      "total": 15
    },
    "download_url": "https://...",
    "download_url_expires_at": "2026-06-01T01:00:00Z"
  }
}

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/repositories/{repository_id}/deepscans/{deepscan_id}/sbom"

Retrieve all configurations associated with the specified account.

Parameters

Responses

• 200 - configurations listed

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/configurations"

Create a new configuration for the specified account.

Parameters

Request Body

{
  "configuration": {
    "name": "string",
    "configuration": {
      "comment": "disabled",
      "show_scan_confirmation": false,
      "risk_threshold": 0,
      "analyzers": {},
      "code_policies": [
        {
          "id": null,
          "enabled": null,
          "silent": null,
          "blocking": null
        }
      ],
      "notifications": {
        "enabled": false,
        "deduplicate": false,
        "integrationNames": [null]
      }
    }
  },
  "repositories": [
    "00000000-0000-0000-0000-000000000000"
  ]
}

Responses

• 201 - configuration created

Example (curl)

curl -X POST \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"configuration": {"name": "My Config", "configuration": {"comment": "disabled", "risk_threshold": 0, "analyzers": {}}}, "repositories": []}' \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/configurations"

Assign a configuration to one or more repositories by ID, name, or pattern.

Parameters

Request Body

{
  "configuration_id": "00000000-0000-0000-0000-000000000000",
  "repository_ids": [
    "00000000-0000-0000-0000-000000000000"
  ],
  "repository_names": [
    "string"
  ],
  "repository_pattern": "string"
}

Responses

• 200 - repositories assigned

Example (curl)

curl -X POST \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"configuration_id": "CONFIG_ID", "repository_ids": ["REPO_ID"]}' \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/configurations/assign_repositories"

Apply the same updates to multiple configurations at once.

Parameters

Request Body

{
  "configuration_ids": [
    "00000000-0000-0000-0000-000000000000"
  ],
  "updates": {
    "comment": "disabled",
    "show_scan_confirmation": false,
    "risk_threshold": 0,
    "analyzers": {},
    "code_policies": [
      {
        "id": "00000000-0000-0000-0000-000000000000",
        "enabled": false,
        "silent": false,
        "blocking": false
      }
    ],
    "notifications": {
      "enabled": false,
      "deduplicate": false,
      "integrationNames": ["string"]
    }
  }
}

Responses

• 200 - configurations updated

Example (curl)

curl -X POST \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"configuration_ids": ["CONFIG_ID_1", "CONFIG_ID_2"], "updates": {"risk_threshold": 5}}' \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/configurations/bulk_update"

Retrieve details for a specific configuration.

Parameters

Responses

• 200 - configuration found

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/configurations/{id}"

Update an existing configuration.

Parameters

Request Body

{
  "configuration": {
    "name": "string",
    "configuration": {
      "comment": "disabled",
      "show_scan_confirmation": false,
      "risk_threshold": 0,
      "analyzers": {},
      "code_policies": [
        {
          "id": null,
          "enabled": null,
          "silent": null,
          "blocking": null
        }
      ],
      "notifications": {
        "enabled": false,
        "deduplicate": false,
        "integrationNames": [null]
      }
    }
  }
}

Responses

• 200 - configuration updated

Example (curl)

curl -X PUT \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"configuration": {"name": "Updated Config", "configuration": {"risk_threshold": 5}}}' \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/configurations/{id}"

Apply a partial update to an existing configuration. Only the fields provided in the request body are updated.

Parameters

Request Body

{
  "configuration": {
    "name": "string",
    "configuration": {
      "comment": "disabled",
      "show_scan_confirmation": false,
      "risk_threshold": 0,
      "analyzers": {},
      "code_policies": [
        {
          "id": null,
          "enabled": null,
          "silent": null,
          "blocking": null
        }
      ],
      "notifications": {
        "enabled": false,
        "deduplicate": false,
        "integrationNames": [null]
      }
    }
  }
}

Responses

• 200 - configuration updated

Example (curl)

curl -X PATCH \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"configuration": {"configuration": {"risk_threshold": 5}}}' \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/configurations/{id}"

Permanently delete a configuration. This action cannot be undone.

Parameters

Responses

• 200 - configuration deleted

Example (curl)

curl -X DELETE \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/configurations/{id}"

Retrieve all enabled and visible analyzers. Use the slug field as the key in configuration analyzer settings.

Parameters

Responses

• 200 - analyzers listed

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/analyzers"

Retrieve all Custom Code Policies associated with the specified account.

Parameters

Responses

• 200 - custom policies listed

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/custom_policies"

Retrieve the daily insights digest for an account. Supports an optional date query parameter in YYYY-MM-DD format.

Parameters

Responses

• 200 - insights returned

Example (curl)

curl \
  -H "Authorization: Bearer $DRYRUN_API_KEY" \
  "https://simple-api.dryrun.security/v1/accounts/{account_id}/insights?date=2026-01-15"