Documentation
Riscly documentation
Riscly maps your system's architecture, finds security and reliability risk across your code and cloud, and ships fixes directly to your repository. These docs cover the product and the full REST API.
Quickstart
From sign-up to your first risk map in five minutes.
Authentication
How API requests are authenticated with tokens.
Connect a repository
Wire up GitHub, GitLab and cloud providers.
Scanning & the map
How Riscly builds your architecture and finds risk.
Risks & fixes
Understand a finding, then push a fix in one click.
API reference
Every endpoint, with curl and JavaScript examples.
How Riscly works
You connect the systems that make up your product — source repositories and, optionally, cloud and service providers. Riscly reads them (read-only wherever possible), infers an architecture graph, and runs security, dependency and reliability analysis against it. Each finding carries a confidence level and, where it is located in code, a one-click fix.
- Connect — GitHub or GitLab for code; Vercel, Supabase, AWS and more for infrastructure.
- Scan — static analysis (SAST), dependency/SBOM (SCA), secret detection and architecture inference.
- Understand — an architecture map, a prioritized risk list and an overall posture score.
- Fix — apply an AI-generated fix that is committed straight to your repository.
Talk to the API
Everything in the dashboard is backed by a REST API. Requests are authenticated with a bearer token and scoped to an organization. Here is a complete request that starts a scan:
curl -X POST https://api.riscly.com/api/projects/PROJECT_ID/scans \
-H "Authorization: Bearer $RISCLY_TOKEN" \
-H "x-org-id: $RISCLY_ORG_ID" \
-H "Content-Type: application/json" \
-d '{}'Not sure where to start?
Follow the Quickstart to connect a repo and run your first scan, then jump into the API reference.