Variant Work

← Partners

Scan API

Start an App Health Scan of a GitHub repository or a live app from your own product, and read the free report as JSON: the score, what is wrong and why it matters, the written summary, and our fixed prices for the app. Sign up as a partner to get a key.

Authentication

Every request carries a key from your partner dashboard:

Authorization: Bearer vw_live_…

Keys are for your server only. The API sends no CORS headers, so browsers can’t call it, and a leaked key is revoked from the dashboard in one click.

Start a scan

curl -X POST https://www.variantwork.com/api/v1/scans \
  -H "Authorization: Bearer $VARIANT_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: your-request-id" \
  -d '{"target":"https://github.com/owner/repo","email":"owner@example.com","reference":"app-123"}'
  • target: a public GitHub repository, or the app’s live https:// address. A live address alone gets the checks that need no code (TLS, headers, uptime, Lighthouse).
  • email (optional): the app owner’s. Someone new to us gets the report by email and can buy a fix from it, credited to you. Someone who already has an account with us isn’t emailed or credited: send them the report link. Without it, only you and the report link reach the scan.
  • reference (optional): your own id, up to 100 characters, sent back as is.
  • Idempotency-Key (optional header): the same key twice starts one scan, and returns it.

The answer, 202 Accepted:

{ "id": "6f1c…", "status": "running", "url": "https://www.variantwork.com/api/v1/scans/6f1c…" }

Read a scan

curl https://www.variantwork.com/api/v1/scans/6f1c… -H "Authorization: Bearer $VARIANT_KEY"

Ask every 10–20 seconds until status is done or failed; a code scan takes a few minutes. Then:

  • score: 0–100, and counts of findings by severity.
  • findings: severity, pass (static, build or live), title and means, what it means for the owner. Where a problem is, and how to fix it, is for paying customers, as in our free report.
  • report: the written summary (headline, summary, issues, strengths, the service we recommend, what the scan couldn’t see). reportPending is true while it is being written; it follows a minute or two after the scan.
  • prices: App Rescue, App Independence and Production Ready for this app, in euro cents before VAT: fixed, or assessment when it needs a paid assessment first.
  • reportUrl: the private report page, to send the owner.
  • needsAccess: the repository is private. The owner connects it from the report page, or uploads a zip.

List scans and usage

GET https://www.variantwork.com/api/v1/scans?limit=20&before=<id>
GET https://www.variantwork.com/api/v1/usage

Limits and billing

  • 60 scans an hour and 500 a day per partner; 1200 other requests an hour. Over a limit the answer is 429 with Retry-After.
  • The first 25 scans each month are free, then €3 a scan + VAT, invoiced after the month ends. Past the free scans without billing set up, the answer is 402.

Errors

{ "error": { "code": "invalid_target", "message": "…" } }

Codes: unauthorized (401), invalid_body, invalid_target, invalid_email, invalid_reference (400), billing_required (402), not_found (404), rate_limited (429).

Use of the API is covered by the partner terms. Only scan apps you, or your customer, own or are allowed to test.