Riscly docs

API reference

Connections

Connections attach providers (source, cloud, services) to a project. Secrets are masked before storage. See the guide for the full flow.

List connections

GET/api/projects/{projectId}/connections
[
  {
    "id": "con_1",
    "provider": "github",
    "status": "active",
    "metadata": { "repos": ["acme/web"] },
    "createdAt": "2026-06-29T10:00:00.000Z"
  }
]

Create a connection (token)

POST/api/projects/{projectId}/connections
FieldTypeDescription
providerrequiredstringe.g. vercel, supabase, aws, gitlab.
tokenstringAPI token / key for token-based providers (masked before storage).
metadataobjectNon-secret config, e.g. which repos/projects to scan.

OAuth authorize URL

GET/api/oauth/{provider}/authorize?projectId={projectId}

Returns a url to redirect the user through the provider's consent screen. Used for GitHub and GitLab. See Connect a repository.

Update connection metadata

PATCH/api/projects/{projectId}/connections/{connectionId}

Merge non-secret config — for example, scoping a Vercel org token to selected projects.

Disconnect

DELETE/api/projects/{projectId}/connections/{connectionId}

Revokes the connection; access stops immediately.

curl -X DELETE \
  https://api.riscly.com/api/projects/PROJECT_ID/connections/CONNECTION_ID \
  -H "Authorization: Bearer $RISCLY_TOKEN" \
  -H "x-org-id: $RISCLY_ORG_ID"
PreviousCode & fixesNext Analysis