Overview

# 1. Get a token — exchange your Perfai email + password
TOKEN=$(curl -s -X POST https://api.perfai.ai/api/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"username":"you@example.com","password":"<your-password>"}' | jq -r .id_token)

# 2. Register your app by URL — Perfai onboards it for you (returns appId)
APP_ID=$(curl -s -X POST https://api.perfai.ai/v1/apps \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"appUrl":"https://api.example.com"}' | jq -r .appId)

# 3. Poll until registrationStatus is COMPLETED (repeat — first onboarding is app-dependent and can take a while)
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.perfai.ai/v1/apps/$APP_ID" | jq -r .registrationStatus

# 4. Start a security test (returns taskId)
TASK_ID=$(curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  "https://api.perfai.ai/v1/apps/$APP_ID/security-agent" | jq -r .taskId)

# 5. Poll until state is COMPLETED (repeat)
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.perfai.ai/v1/tasks/$TASK_ID" | jq -r .state

# 6. Read the findings
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.perfai.ai/v1/apps/$APP_ID/vulnerabilities" | jq

https://api.perfai.ai/v1

Authorization: Bearer <token>

POST /security-agent
        │
        ▼
     QUEUED ──── engine picks up ──► RUNNING
        │                               │
        │                    ┌──────────┼──────────┐
        │                    ▼          ▼           ▼
        └──── timeout ──► FAILED   COMPLETED   CANCELLED   INTERRUPTED

   RUNNING ⇄ AWAITING_INPUT   (registration only — you supply credentials)

interval = 5s
max_wait  = 30m

while elapsed < max_wait:
    response = GET /tasks/{taskId}
    if response.state in [COMPLETED, FAILED, CANCELLED]:
        break
    sleep(interval)
    interval = min(interval * 1.5, 60s)

{
  "type": "https://perfai.ai/errors/<error-slug>",
  "title": "Human-readable summary",
  "<context-field>": "<optional additional detail>"
}

#!/usr/bin/env bash
set -euo pipefail

HOST="https://api.perfai.ai"       # Perfai cloud — replace with your own host on-premise
TOKEN="$PERFAI_API_TOKEN"          # a Perfai token — see Authentication for how to get one
APP_LABEL="Payments API"

# 1. Resolve appId by label
APP_ID=$(curl -sf \
  -H "Authorization: Bearer $TOKEN" \
  "$HOST/v1/apps?search=$(python3 -c \
    'import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1]))' "$APP_LABEL")" \
  | jq -r '.data[0].appId')

[ -z "$APP_ID" ] && { echo "App not found: $APP_LABEL"; exit 1; }
echo "App ID: $APP_ID"

# 2. Trigger test
RUN=$(curl -sf -X POST \
  -H "Authorization: Bearer $TOKEN" \
  "$HOST/v1/apps/$APP_ID/security-agent")

TASK_ID=$(echo "$RUN" | jq -r '.taskId')
echo "Security test: $TASK_ID"

# 3. Poll until terminal state
INTERVAL=10
ELAPSED=0
MAX=1800   # 30 min timeout

while true; do
  STATE=$(curl -sf \
    -H "Authorization: Bearer $TOKEN" \
    "$HOST/v1/tasks/$TASK_ID" \
    | jq -r '.state')
  echo "[$ELAPSED s] state=$STATE"

  case "$STATE" in
    COMPLETED|FAILED|CANCELLED) break ;;
  esac

  sleep "$INTERVAL"
  ELAPSED=$((ELAPSED + INTERVAL))
  INTERVAL=$(( INTERVAL < 60 ? INTERVAL + 5 : 60 ))

  if [ "$ELAPSED" -ge "$MAX" ]; then
    echo "Timed out waiting for test"; exit 1
  fi
done

[ "$STATE" != "COMPLETED" ] && { echo "Test did not complete: $STATE"; exit 1; }

# 4. Fetch vulnerabilities and fail on unfixed Critical findings
CRITICAL=$(curl -sf \
  -H "Authorization: Bearer $TOKEN" \
  "$HOST/v1/apps/$APP_ID/vulnerabilities?pageSize=100" \
  | jq '[.data[] | select(.severity == "Critical" and .isFixed == false and .isDismissed == false)] | length')

echo "Critical findings: $CRITICAL"
[ "$CRITICAL" -gt 0 ] && {
  echo "Build blocked: $CRITICAL unfixed critical vulnerability/ies"
  exit 1
}

echo "Security gate passed."