API REFERENCE

REST API

Base URL: https://api.brigs.ai. All requests require a Bearer token.

Pagination

List endpoints accept limit and offset query parameters. Responses include a total field for calculating pages.

Async Operations

Scans and remediations are asynchronous. POST returns a resource with status: "QUEUED". Poll the resource GET endpoint until status is COMPLETED or FAILED. The CLI's brigs scan watch handles polling automatically.

Content Type

All request and response bodies are JSON. Set Content-Type: application/json on POST/PATCH requests.

Endpoints

Repositories

GET/repos
POST/repos
GET/repos/:id
GET/repos/agent-map
DELETE/repos/:id

Scans

POST/scans
{ "scan": { "id": "scn_...", "status": "QUEUED", "repoId": "..." } }
GET/scans
GET/scans/:id

Findings

GET/findings
Query params: status, severity, repoId, controlKey, limit, offset, sortBy, sortOrder
{ "findings": [{ "id": "...", "severity": "CRITICAL", "controlKey": "...", "summary": "..." }], "total": 42 }
GET/findings/:id
PATCH/findings/:id
{ "finding": { "id": "...", "status": "RESOLVED", "notes": "..." } }
POST/findings/:id/dismiss

Posture

GET/posture/summary
{ "score": 72, "passRate": 0.85, "coverage": 0.85, "controlsEvaluated": 13 }
GET/posture/:framework

Controls

GET/controls
GET/controls/:key

Evidence

GET/evidence/finding/:id
GET/evidence/control/:key
GET/evidence/snapshot

Remediation

POST/findings/:id/remediate
GET/remediation/sessions/:id

API Keys

POST/api-keys
GET/api-keys
DELETE/api-keys/:id

Rate Limits

Rate limits apply per API key. CLI commands that call the API count toward your limits. Headers X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset are included in every response.

PlanPer MinutePer Day
Free1001,000
Team50010,000
Business2,000100,000
Enterprise10,000Unlimited

See pricing for plan details and upgrade options.

Errors

All errors return a consistent JSON body with error and message fields.

400 Bad Request
{ "error": "Bad Request", "message": "repoId is required" }

401 Unauthorized
{ "error": "Unauthorized", "message": "Invalid API key" }

403 Forbidden
{ "error": "Forbidden", "message": "Insufficient permissions for this resource" }

404 Not Found
{ "error": "Not Found", "message": "Finding not found" }

429 Too Many Requests
{ "error": "Too Many Requests", "message": "Rate limit exceeded.", "retryAfter": 42 }

Retry Guidance

  • 429 — back off for retryAfter seconds, then retry
  • 5xx — retry with exponential backoff (max 3 attempts)
  • 4xx (except 429) — do not retry; fix the request