Skip to main content
Create API keys to access CodeThreat programmatically via REST API.

​
Create API Key

1

Navigate to API Keys

Organization Settings → API Keys
2

Create New Key

Click Create API Key
3

Configure Key

Set key properties:
  • Name: Descriptive name (e.g., “CI/CD Pipeline”)
  • Scopes: Permissions (read:scans, write:scans, etc.)
  • Expiration: Optional expiration date
4

Generate

Click Generate Key
5

Copy Key

Copy API key immediately
You won’t see the key again. Store securely.

​
API Key Scopes

API keys use a scope-based permission system with the format {resource}:{action}: Organization:
  • organization:read - View organization details
  • organization:write - Modify organization settings
  • organization:manage - Full organization management
Repositories:
  • repository:read - View repositories
  • repository:write - Modify repository settings
  • repository:manage - Full repository management
Scans:
  • scan:read - View scan results
  • scan:write - Trigger and manage scans
  • scan:manage - Full scan management
Violations:
  • violation:read - View violations
  • violation:write - Update violation status
  • violation:manage - Full violation management
Users:
  • user:read - View user information
  • user:write - Modify user settings
  • user:manage - Full user management
Integrations:
  • integration:read - View integrations
  • integration:write - Manage integrations
API Keys:
  • api-key:read - View API keys
  • api-key:write - Create/revoke API keys
Webhooks:
  • webhook:read - View webhook configurations
  • webhook:write - Manage webhooks
Use principle of least privilege—grant only required scopes.

​
Using API Keys

Include API key in X-API-Key header: 
curl -X GET "https://app.codethreat.com/api/v1/scans" \
  -H "X-API-Key: YOUR_API_KEY"
View full API documentation →

​
Rotate API Keys

Regularly rotate API keys for security:
  1. Create new API key
  2. Update services to use new key
  3. Test new key
  4. Delete old key

​
Best Practices

Rotate keys regularly: Every 90 days Use key per service: Separate keys for each integration Set expiration dates: Automatic key expiration Monitor usage: Review API key activity logs Store securely: Use secret management tools Revoke immediately: Delete compromised keys

​
What’s Next?

API Reference

View API documentation

CI/CD Integration

Integrate with CI/CD