# Start a scan
curl -X POST https://app.apiscan.ai/api/scan \
  -H "X-API-Key: sf_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://api.yourapp.com"}'

# Poll for results
curl https://app.apiscan.ai/api/scan/{scan_id} \
  -H "X-API-Key: sf_live_your_key"

import requests, time

API_KEY = "sf_live_your_key"
HEADERS = {"X-API-Key": API_KEY}

r = requests.post("https://app.apiscan.ai/api/scan",
    headers=HEADERS, json={"url": "https://api.yourapp.com"})
scan_id = r.json()["id"]

while True:
    result = requests.get(f"https://app.apiscan.ai/api/scan/{scan_id}",
        headers=HEADERS).json()
    if result["status"] == "completed": break
    time.sleep(3)

findings = result["findings"]
critical = [f for f in findings if f["severity"] == "CRITICAL"]
if critical:
    raise SystemExit(f"🚨 {len(critical)} CRITICAL finding(s) — failing build")

# .github/workflows/apiscan.yml
name: API Security Scan
on: [pull_request]
jobs:
  apiscan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write  # SARIF → GitHub Security tab
      pull-requests: write   # PR comment
    steps:
      - uses: actions/checkout@v4
      - uses: Apiscan/secforge-action@v1
        with:
          url: https://api.example.com
          fail-on: CRITICAL
          api-key: ${{ secrets.APISCAN_API_KEY }}

import hmac, hashlib

def verify_signature(body: bytes, secret: str, sig_header: str) -> bool:
    expected = "sha256=" + hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, sig_header)