API reference

Code & fixes

Generate AI fixes for located findings and apply them — by committing directly to the default branch, or by opening a pull request.

Preview a fix

POST/api/projects/{projectId}/code/fix

Generates the fix without changing anything. Returns the original and proposed code.

Field	Type	Description
`file`required	string	Path to the file containing the finding.
`rule`required	string	The rule / detector that produced the finding.
`title`required	string	Short title of the finding.
`repo`	string	Repository; resolved server-side from the project if omitted.
`line`	number	Line number of the finding.
`description`	string	Optional longer description to steer the fix.

{
  "original": "const KEY = \"abc\";",
  "fixed": "const KEY = process.env.KEY;",
  "explanation": "Move the secret to an environment variable.",
  "aiEnabled": true
}

aiEnabled

When the server has no AI key, aiEnabled is false and fixed is null — fall back to the recommended manual fix.

Apply a fix (direct commit)

POST/api/projects/{projectId}/code/fix/commit

Commits the corrected file straight to the default branch and returns the commit URL.

curl -X POST \
  https://api.riscly.com/api/projects/PROJECT_ID/code/fix/commit \
  -H "Authorization: Bearer $RISCLY_TOKEN" \
  -H "x-org-id: $RISCLY_ORG_ID" \
  -H "Content-Type: application/json" \
  -d '{"file":"src/auth.ts","line":42,"rule":"no-hardcoded-secret","title":"Hardcoded credential"}'

Apply a fix (pull request)

POST/api/projects/{projectId}/code/fix/pr

Opens a branch and pull request with the corrected file instead of committing directly. Here repo is required.

Deep-scan source

POST/api/projects/{projectId}/code/deep-scan

Runs a deeper AI pass over the repo's source; new findings are merged into the scan. See the scanning guide.

PreviousScans Next Connections