API Access

Authenticate and make your first request to the DevArmor API.

Overview

DevArmor exposes a REST API covering the same functionality as the web app — projects, threat models, design reviews, policies, and more. All endpoints accept and return application/json.

• Base URL: https://secrev.api.devarmor.com

• Interactive reference: https://secrev.api.devarmor.com/docs (Swagger UI, generated from the live OpenAPI spec — the source of truth for request/response schemas and every available endpoint)

Authentication

The API authenticates requests with a bearer token. Send it on every request as:

Authorization: Bearer <your-api-token>

Requests without a valid token receive a 401 Unauthorized response.

Creating an API token

1. Sign in to the DevArmor web app.

2. Go to Settings → API Tokens.

3. Click Create token, give it a title, and set an expiration date.

4. Copy the token when it's shown — it's only ever returned once, at creation time.

Once you hold one token, you can also manage tokens through the API itself:

Method	Path	Purpose
GET	/api-tokens	List your tokens (titles/expiry only — not the token value)
POST	/api-tokens	Create a new token
DELETE	/api-tokens/{token_id}	Revoke a token

Tokens are scoped to the user that created them and inherit that user's permissions.

Making your first request

A couple of endpoints don't require authentication and are useful for confirming connectivity:

curl https://secrev.api.devarmor.com/status
# {"status":"ok","api_version":"1.9.0"}

Once you have a token, confirm it works by fetching your own user record:

curl https://secrev.api.devarmor.com/users/current \
  -H "Authorization: Bearer <your-api-token>"

From there, most work happens under /projects:

curl https://secrev.api.devarmor.com/projects \
  -H "Authorization: Bearer <your-api-token>"

Errors

• 401 Unauthorized — missing, invalid, or expired bearer token.

• 422 Unprocessable Entity — request body or parameters failed validation. The response body lists each failing field:

  {
    "detail": [
      { "loc": ["body", "expires_at"], "msg": "Field required", "type": "missing" }
    ]
  }

Next steps

Browse the full set of endpoints — projects, threat models, design reviews, policies, rules, integrations, and more — in the interactive API reference.