REST API

curl -s -X POST https://api.patchlabs.dev/checks -H 'Content-Type: application/json' \
  -d '{"repo": "you/your-app", "email": "you@company.com"}'

{"id": "7c1e2f0a-…", "status": "awaiting_verification", "repo": "you/your-app",
 "link": "https://patchlabs.dev/check.html?id=7c1e2f0a-…"}

curl -s https://api.patchlabs.dev/checks/$CHECK_ID

{"id": "7c1e…", "repo": "you/your-app", "status": "done",
 "created_at": "…", "verified_at": "…", "finished_at": "…",
 "summary": {"tables_leaking": ["profiles"], "readable_by_anyone": ["profiles"],
             "readable_by_signed_in": [], "lab_proof_passed": true, "break_risk": "low",
             "questions_for_owner": [], "models": [{"model": "haiku", "passed": true, "seconds": 36}]},
 "report_md": "# Leak check: you/your-app …", "fix_sql": "DROP POLICY …",
 "events": [{"at": "…", "kind": "requested"}, {"at": "…", "kind": "verified"}, …],
 "decisions": [], "answers": []}

curl -s -X POST https://api.patchlabs.dev/checks/$CHECK_ID/verify

{"status": "queued"}

curl -s -X POST https://api.patchlabs.dev/checks/$CHECK_ID/decision -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' \
  -d '{"action": "reject", "tables": ["shops"], "reason": "Public by design"}'

{"decisions": [{"action": "reject", "tables": ["shops"], "reason": "Public by design", "by": "Priya", "at": "…"}]}

curl -s -X POST https://api.patchlabs.dev/checks/$CHECK_ID/answers -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' \
  -d '{"answers": [{"question": "Should sellers’ emails be public?", "answer": "No"}]}'

{"answers": [{"question": "Should sellers’ emails be public?", "answer": "No", "by": "Priya", "at": "…"}]}

curl -s https://api.patchlabs.dev/receipts/$CHECK_ID

{"receipt": {"check_id": "…", "repo": "…", "status": "done", "tables_leaking": ["profiles"],
             "lab_proof_passed": true, "fix_sha256": "…", "finished_at": "…",
             "decisions": [], "answers": []},
 "signature": "base64…", "key_id": "ed25519:…", "algorithm": "Ed25519"}

curl -s https://api.patchlabs.dev/.well-known/patchlabs-receipt-key

{"key_id": "ed25519:…", "algorithm": "Ed25519", "public_key": "base64 raw 32 bytes",
 "pem": "-----BEGIN PUBLIC KEY-----\n…", "signed_bytes": "JSON of `receipt` with sorted keys and separators (',', ':')"}

curl -s -X POST https://api.patchlabs.dev/auth/start -H 'Content-Type: application/json' -d '{"email": "you@company.com"}'

{"ok": true, "detail": "If that address can sign in, a link is on its way. It expires in 20 minutes."}

curl -s -X POST https://api.patchlabs.dev/auth/finish -H 'Content-Type: application/json' -d '{"token": "…"}'

{"session": "…", "user": {"id": "…", "email": "you@company.com", "name": null, "created_at": "…"},
 "next": "/app/", "invite": null}

curl -s -X POST https://api.patchlabs.dev/auth/logout -H "Authorization: Bearer $PL_SESSION"

{"ok": true}

curl -s -X POST https://api.patchlabs.dev/invites/accept -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' -d '{"invite": "…"}'

{"accepted": true, "workspace_id": "…", "workspace_name": "Acme"}

curl -s https://api.patchlabs.dev/me -H "Authorization: Bearer $PL_SESSION"

{"user": {"id": "…", "email": "you@company.com", "name": "Priya", "created_at": "…"},
 "workspaces": [{"id": "…", "name": "you's workspace", "role": "owner", "plan": "free"}]}

curl -s -X PATCH https://api.patchlabs.dev/me -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' -d '{"name": "Priya"}'

{"user": {…}, "workspaces": […]}

curl -s https://api.patchlabs.dev/me/checks -H "Authorization: Bearer $PL_SESSION"

{"checks": [{"id": "…", "repo": "you/your-app", "status": "done", "created_at": "…"}]}

curl -s -OJ https://api.patchlabs.dev/me/export -H "Authorization: Bearer $PL_SESSION"

curl -s -X DELETE https://api.patchlabs.dev/me -H "Authorization: Bearer $PL_SESSION"

{"ok": true, "deleted_workspaces": 1}

curl -s https://api.patchlabs.dev/workspaces/$WORKSPACE_ID -H "Authorization: Bearer $PL_SESSION"

{"id": "…", "name": "Acme", "plan": "maker", "role": "owner", "created_at": "…",
 "limits": {"apps": 3, "runs_per_month": 30, "seats": 2, "schedules": ["off", "weekly", "monthly"]},
 "usage": {"apps": 2, "runs_this_month": 5, "members": 2},
 "webhook_url": "https://hooks.slack.com/services/…", "webhook_format": "auto", "webhook_kind": "slack",
 "permissions": ["decide", "manage", "owner", "run", "view", "view_team"],
 "members": [{"user_id": "…", "email": "…", "name": "…", "role": "owner", "joined_at": "…", "app_ids": null}],
 "invites": [{"id": "…", "email": "…", "role": "client", "app_ids": ["…"], "created_at": "…", "expires_at": "…"}]}

curl -s -X PATCH https://api.patchlabs.dev/workspaces/$WORKSPACE_ID -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' \
  -d '{"webhook_url": "https://hooks.slack.com/services/T000/B000/XXXX"}'

{…the workspace…}

curl -s -X POST https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/webhook/test -H "Authorization: Bearer $PL_SESSION"

{"ok": true, "status_code": 200, "format": "slack"}
# or {"ok": false, "status_code": null, "format": "json", "detail": "…why it failed…"}

curl -s -X POST https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/invites -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' \
  -d '{"email": "dev@client.com", "role": "member"}'

{"id": "…", "email": "dev@client.com", "role": "member", "created_at": "…", "expires_at": "…"}

curl -s -X DELETE https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/invites/$INVITE_ID -H "Authorization: Bearer $PL_SESSION"

{"ok": true}

curl -s -X PATCH https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/members/$USER_ID -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' -d '{"role": "approver"}'

{…the workspace…}

curl -s -X PUT https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/members/$USER_ID/apps -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' -d '{"app_ids": ["…"]}'

{…the workspace…}

curl -s -X DELETE https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/members/$USER_ID -H "Authorization: Bearer $PL_SESSION"

{"ok": true}

curl -s https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/api-keys -H "Authorization: Bearer $PL_SESSION"

{"api_keys": [{"id": "…", "name": "GitHub Actions", "prefix": "pl_live_Xy3k", "created_at": "…", "last_used_at": "…"}]}

curl -s -X POST https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/api-keys -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' -d '{"name": "GitHub Actions"}'

{"id": "…", "name": "GitHub Actions", "prefix": "pl_live_Xy3k", "created_at": "…",
 "last_used_at": null, "key": "pl_live_Xy3k…32 characters…"}

curl -s -X DELETE https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/api-keys/$KEY_ID -H "Authorization: Bearer $PL_SESSION"

{"ok": true}

curl -s -X POST https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/upgrade-request -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' -d '{"plan": "agency"}'

{"id": "…", "plan": "agency", "note": null, "created_at": "…", "detail": "Thanks. We'll reply within a day."}

curl -s 'https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/audit?action=member&limit=50' -H "Authorization: Bearer $PL_SESSION"

{"events": [{"id": 812, "at": "…", "action": "member.role_changed",
             "actor": {"kind": "user", "id": "…", "label": "Priya", "email": "priya@agency.com"},
             "target": {"type": "member", "id": "…", "label": null, "email": "dev@client.com"},
             "detail": {"from": "member", "to": "approver"}}],
 "next_before": 811, "actions": ["auth.sign_in", "auth.sign_out", "member.invited", …]}

curl -s -OJ 'https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/audit/export?since=2026-11-01' -H "Authorization: Bearer $PL_SESSION"

id,at,action,actor_kind,actor,actor_email,target_type,target_id,target,target_email,detail

curl -s https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/apps -H "Authorization: Bearer $PL_SESSION"

{"apps": [{"id": "…", "workspace_id": "…", "repo": "you/your-app", "branch": "main",
           "client_label": "Acme", "schedule": "weekly", "next_check_at": "…",
           "badge_public": false, "created_at": "…", "verified_at": "…", "verified": true,
           "last_check": {"id": "…", "status": "no_leaks", "finished_at": "…", "tables_leaking": []},
           "open_check_id": null, "suppressed_tables": [],
           "freshness": {"stale": false, "days_since_check": 3, "stale_after_days": 14}}]}

curl -s -X POST https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/apps -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' \
  -d '{"repo": "you/your-app", "client_label": "Acme"}'

{"id": "…", "repo": "you/your-app", "verified": false, …,
 "verify": {"file": "patchlabs-verify.txt", "code": "patchlabs-…", "add_url": "https://github.com/…"}}

curl -s -X POST https://api.patchlabs.dev/apps/$APP_ID/verify -H "Authorization: Bearer $PL_SESSION"

{"verified": true, "check_id": "…"}

curl -s https://api.patchlabs.dev/apps/$APP_ID -H "Authorization: Bearer $PL_SESSION"

{"id": "…", "repo": "you/your-app", …,
 "checks": [{"id": "…", "status": "done", "trigger": "scheduled", "created_at": "…",
             "finished_at": "…", "tables_leaking": ["orders"], "lab_proof_passed": true}],
 "diff": {"new_leaks": ["orders"], "fixed": [], "still_leaking": [], "suppressed": [],
          "to_check_id": "…", "from_check_id": "…"},
 "findings": {"open": [{"id": "PL-001", "object": "public.orders", "severity": "critical", "title": "…",
                        "cwe": ["CWE-359", "CWE-863"], "owasp": "A01:2021", "owasp_name": "Broken Access Control",
                        "first_seen": "…", "first_check_id": "…", "days_open": 12, "fixed_at": null, "regressed": false}],
              "fixed": [{"id": "PL-023", "object": "package.json", "days_open": 7, "fixed_at": "…", "fixed_in_check_id": "…", …}]}}

curl -s -X PATCH https://api.patchlabs.dev/apps/$APP_ID -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' -d '{"schedule": "weekly", "badge_public": true}'

{…the app…}

curl -s -X DELETE https://api.patchlabs.dev/apps/$APP_ID -H "Authorization: Bearer $PL_SESSION"

{"ok": true}

curl -s -X POST https://api.patchlabs.dev/apps/$APP_ID/checks -H "Authorization: Bearer $PL_SESSION"

{"check_id": "…", "status": "queued", "url": "https://patchlabs.dev/check?id=…"}

curl -s -X PUT https://api.patchlabs.dev/apps/$APP_ID/live -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' -d '{"url": "https://app.example.com"}'

{"url": "https://app.example.com", "verified": false, "verified_at": null, "next_check_at": null,
 "verify": {"file": "patchlabs-verify.txt", "file_url": "https://app.example.com/patchlabs-verify.txt",
            "code": "patchlabs-live-3f9c2a17d04be6a1",
            "meta": "<meta name="patchlabs-verify" content="patchlabs-live-3f9c2a17d04be6a1">"},
 "last": null}
# url is null when no domain is set (then verify and last are null); verify is present only while unverified

curl -s -X DELETE https://api.patchlabs.dev/apps/$APP_ID/live -H "Authorization: Bearer $PL_SESSION"

{"ok": true}

curl -s -X POST https://api.patchlabs.dev/apps/$APP_ID/live/verify -H "Authorization: Bearer $PL_SESSION"

{"verified": true, "posture": {…posture result, trigger "verify"…}}

curl -s -X POST https://api.patchlabs.dev/apps/$APP_ID/live/checks -H "Authorization: Bearer $PL_SESSION"

{"id": "…", "url": "https://app.example.com", "final_url": "https://app.example.com/",
 "grade": "C", "score": 65, "checked_at": "…", "trigger": "manual",
 "counts": {"critical": 0, "high": 0, "medium": 2, "low": 1, "info": 0},
 "findings": [{"id": "PL-030", "line": "live", "severity": "medium", "title": "No Content-Security-Policy",
               "object": "https://app.example.com", "evidence": "The page sends no Content-Security-Policy header or meta tag.",
               "fix": "Send a Content-Security-Policy that lists where scripts may load from (start with default-src 'self').",
               "cwe": ["CWE-693"], "owasp": "A05:2021", "owasp_name": "Security Misconfiguration"}],
 "passed": [{"id": "PL-027", "title": "HTTPS is forced"}, …],
 "facts": {"status": 200, "redirects": ["https://app.example.com/"], "https_redirect": true, "https_preloaded_tld": false,
           "tls": {"version": "TLSv1.3", "issuer": "Let's Encrypt", "expires": "2027-01-05", "days_left": 56},
           "headers": {"strict-transport-security": "max-age=63072000", "content-security-policy": null, …},
           "cookies": [{"name": "sb-session", "secure": true, "httponly": true, "samesite": "Lax"}],
           "server": "cloudflare"}}

curl -s https://api.patchlabs.dev/apps/$APP_ID/live/checks -H "Authorization: Bearer $PL_SESSION"

{"checks": [{"id": "…", "grade": "C", "score": 65, "counts": {"critical": 0, "high": 0, "medium": 2, "low": 1, "info": 0},
             "trigger": "scheduled", "checked_at": "…"}]}
# trigger: verify | scheduled | manual

curl -s https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/support/tickets -H "Authorization: Bearer $PL_SESSION"

{"tickets": [{"id": "…", "number": 12, "subject": "Report says profiles leak", "category": "finding",
              "priority": "normal", "status": "waiting_on_customer", "app": {"id": "…", "repo": "you/your-app"},
              "created_by": "Olive", "message_count": 2, "last_from": "support", "updated_at": "…"}],
 "counts": {"open": 0, "waiting_on_customer": 1, "resolved": 3, "closed": 1}}

curl -s -X POST https://api.patchlabs.dev/workspaces/$WORKSPACE_ID/support/tickets -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' \
  -d '{"subject": "Report says profiles leak", "category": "finding", "message": "Is this real?"}'

{"id": "…", "number": 12, "status": "open", "priority": "normal", "subject": "Report says profiles leak", …,
 "messages": [{"author": "customer", "kind": "message", "by": "Olive", "body": "Is this real?", "created_at": "…"}]}

curl -s https://api.patchlabs.dev/support/tickets/$TICKET_ID -H "Authorization: Bearer $PL_SESSION"

curl -s -X POST https://api.patchlabs.dev/support/tickets/$TICKET_ID/messages -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' -d '{"body": "Applied the fix, thanks."}'

{"id": "…", "status": "open", "messages": […]}

curl -s -X POST https://api.patchlabs.dev/support/tickets/$TICKET_ID/close -H "Authorization: Bearer $PL_SESSION"

{"id": "…", "status": "closed", "closed_at": "…", "messages": […]}

curl -s -X POST https://api.patchlabs.dev/v1/apps/$APP_ID/checks -H "X-API-Key: $PATCHLABS_API_KEY"

{"check_id": "…", "status": "queued", "url": "https://patchlabs.dev/check?id=…"}

curl -s https://api.patchlabs.dev/v1/checks/$CHECK_ID -H "X-API-Key: $PATCHLABS_API_KEY"

{"id": "…", "app_id": "…", "repo": "you/your-app", "status": "done", "trigger": "api",
 "created_at": "…", "finished_at": "…", "finished": true, "leaks_found": true,
 "tables_leaking": ["profiles"], "lab_proof_passed": true,
 "summary": {…}, "url": "https://patchlabs.dev/check?id=…"}

curl -s https://api.patchlabs.dev/badge/$APP_ID.svg -o badge.svg

curl -s https://api.patchlabs.dev/badge/$APP_ID/live.svg -o live.svg

curl -s https://api.patchlabs.dev/public/apps/$APP_ID

{"repo": "you/your-app", "status": "no_known_leaks", "last_checked": "…",
 "stale": false, "days_since_check": 3, "stale_after_days": 60,
 "live": {"grade": "B", "checked_at": "…"}}
# status: no_known_leaks | fix_in_progress | not_checked_yet | stale

curl -s https://api.patchlabs.dev/taxonomy/findings

{"findings": {"PL-001": {"cwe": ["CWE-359", "CWE-863"], "owasp": "A01:2021", "owasp_name": "Broken Access Control"}, …},
 "cwe": {"CWE-359": "Exposure of Private Personal Information to an Unauthorized Actor", …},
 "owasp": {"A01:2021": "Broken Access Control", …}}

curl -s https://api.patchlabs.dev/stats

{"checks_completed": <int>, "apps_monitored": <int>, "leaks_found": <int>, "fixes_proven": <int>}

curl -s https://api.patchlabs.dev/health

{"ok": true, "db": "ok", "worker_last_seen": "…", "queued": <int>}

curl -s -X POST https://api.patchlabs.dev/tools/rls-check -H 'Content-Type: application/json' -d '{"repo": "manra399/patchlabs-demo-app"}'

{"repo": "manra399/patchlabs-demo-app", "branch": "main", "commit": "…",
 "files_scanned": 1, "truncated": false, "cached": false,
 "tables": [{"name": "profiles", "rls_enabled": true, "policies": […],
             "personal_columns": ["email", "phone"], "file": "supabase/migrations/…", "line": 3}],
 "findings": [{"id": "PL-001", "title": "Anyone with the public key can read personal data",
               "table": "profiles", "file": "…", "line": 12, "severity": "critical", "snippet": "…"}],
 "limits": "static analysis only; the full check proves it in the lab"}

curl -s -X POST https://api.patchlabs.dev/tools/headers-check -H 'Content-Type: application/json' -d '{"url": "https://patchlabs.dev"}'

{"url": "https://patchlabs.dev", "final_url": "https://patchlabs.dev/", "grade": "B", "score": 75, "checked_at": "…",
 "counts": {"critical": 0, "high": 0, "medium": 1, "low": 2, "info": 1},
 "findings": [{"id": "PL-030", "severity": "medium", "title": "No Content-Security-Policy", …}, …],
 "passed": [{"id": "PL-027", "title": "HTTPS is forced"}, …], "facts": {…}}

curl -s -X POST https://api.patchlabs.dev/mcp -H 'Content-Type: application/json' -d '{"jsonrpc": "2.0", "id": 1, "method": "tools/list"}'