rorixrorix
sign in →

Scan API

Submit .NET or Node.js dependency manifests for vulnerability analysis and license compliance checks.

POST /api/audit

Authenticated endpoint for scanning dependencies. Returns detailed vulnerability and license data.

Request

curl -X POST https://rorix.io/api/audit \
  -H "Authorization: Bearer rxk_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "content": "<Project Sdk=\"Microsoft.NET.Sdk\">\n  <ItemGroup>\n    <PackageReference Include=\"Newtonsoft.Json\" Version=\"12.0.3\" />\n    <PackageReference Include=\"Microsoft.Data.SqlClient\" Version=\"4.1.0\" />\n  </ItemGroup>\n</Project>",
    "filename": "MyApp.csproj",
    "targetFramework": "net8.0",
    "licensePolicy": {
      "mode": "blocklist",
      "licenses": ["GPL-2.0", "GPL-3.0"]
    }
  }'

Parameters

| Parameter | Required | Type | Description | | --- | --- | --- | --- | | content | Yes | string | Contents of the project file | | filename | Yes | string | Name of the file (used to determine parser) | | targetFramework | No | string | Target framework moniker (e.g., net8.0) | | licensePolicy | No | object | { mode: "allowlist" | "blocklist", licenses: string[] } |

Supported npm filenames are package.json, package-lock.json, and npm-shrinkwrap.json. Prefer a lockfile so Rorix can scan exact resolved versions; a bare package.json contributes only dependencies already pinned to exact semantic versions.

curl -X POST https://rorix.io/api/audit \
  -H "Authorization: Bearer rxk_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "content": "{\"lockfileVersion\":3,\"packages\":{\"\":{\"dependencies\":{\"react\":\"^19.0.0\"}},\"node_modules/react\":{\"version\":\"19.2.0\"}}}",
    "filename": "package-lock.json"
  }'

Response

{
  "reports": [
    {
      "id": "Newtonsoft.Json",
      "installedVersion": "12.0.3",
      "latestVersion": "13.0.3",
      "license": "MIT",
      "enrichedVulnerabilities": [
        {
          "id": "GHSA-5crp-9r3c-p9vr",
          "severity": "High",
          "summary": "Improper Handling of Exceptional Conditions",
          "fixedVersion": "13.0.1"
        }
      ]
    }
  ],
  "packageCount": 1,
  "vulnerabilityCount": 1,
  "criticalCount": 0,
  "highCount": 1,
  "moderateCount": 0,
  "lowCount": 0,
  "typosquatWarnings": [],
  "licenseIssues": [],
  "grade": "C",
  "score": 62
}

POST /api/scan

Rate-limited public endpoint. No authentication required but limited to 10 requests per minute. Accepts the same parameters and returns the same response format as /api/audit.

curl -X POST https://rorix.io/api/scan \
  -H "Content-Type: application/json" \
  -d '{
    "content": "...",
    "filename": "MyApp.csproj"
  }'

POST /api/projects/:id/scan

Trigger a scan for a specific project. The project must already exist and have a linked repository or uploaded manifest.

curl -X POST https://rorix.io/api/projects/9f48a4ce-45d4-48ac-b65b-6ffae839cd62/scan \
  -H "Authorization: Bearer rxk_your_api_key_here"

Returns { scan, result, policy }, where result uses the /api/audit response shape and policy is present when the repository contains .rorix.yml.

AuthenticationSBOM