> For the complete documentation index, see [llms.txt](https://docs.devarmor.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devarmor.com/getting-started/api-access.md).

# API Access

Authenticate and make your first request to the DevArmor API.

## Overview

DevArmor exposes a REST API covering the same functionality as the web app — projects, threat models, design reviews, policies, and more. All endpoints accept and return `application/json`.

* **Base URL:** `https://secrev.api.devarmor.com`
* **Interactive reference:** <https://secrev.api.devarmor.com/docs> (Swagger UI, generated from the live OpenAPI spec — the source of truth for request/response schemas and every available endpoint)

## Authentication

The API authenticates requests with a bearer token. Send it on every request as:

```
Authorization: Bearer <your-api-token>
```

Requests without a valid token receive a `401 Unauthorized` response.

### Creating an API token

1. Sign in to the DevArmor web app.
2. Go to **Settings → API Tokens**.
3. Click **Create token**, give it a title, and set an expiration date.
4. Copy the token when it's shown — it's only ever returned once, at creation time.

Once you hold one token, you can also manage tokens through the API itself:

| Method   | Path                     | Purpose                                                     |
| -------- | ------------------------ | ----------------------------------------------------------- |
| `GET`    | `/api-tokens`            | List your tokens (titles/expiry only — not the token value) |
| `POST`   | `/api-tokens`            | Create a new token                                          |
| `DELETE` | `/api-tokens/{token_id}` | Revoke a token                                              |

Tokens are scoped to the user that created them and inherit that user's permissions.

## Making your first request

A couple of endpoints don't require authentication and are useful for confirming connectivity:

```sh
curl https://secrev.api.devarmor.com/status
# {"status":"ok","api_version":"1.9.0"}
```

Once you have a token, confirm it works by fetching your own user record:

```sh
curl https://secrev.api.devarmor.com/users/current \
  -H "Authorization: Bearer <your-api-token>"
```

From there, most work happens under `/projects`:

```sh
curl https://secrev.api.devarmor.com/projects \
  -H "Authorization: Bearer <your-api-token>"
```

## Errors

* **`401 Unauthorized`** — missing, invalid, or expired bearer token.
* **`422 Unprocessable Entity`** — request body or parameters failed validation. The response body lists each failing field:

  ```json
  {
    "detail": [
      { "loc": ["body", "expires_at"], "msg": "Field required", "type": "missing" }
    ]
  }
  ```

## Next steps

Browse the full set of endpoints — projects, threat models, design reviews, policies, rules, integrations, and more — in the [interactive API reference](https://secrev.api.devarmor.com/docs).