Foo Guard API

Authentication

Include your API key in the Authorization header:

Authorization: Bearer agt_live_...

Create API keys in Account settings. Keys are shown once at creation and stored as secure hashes.

POST /api/v1/analyze

Submit a JSON or YAML agent configuration and receive a deterministic AnalysisResult.

Request body

{
  "content": "<JSON or YAML configuration>",
  "format": "json",
  "name": "optional label",
  "sourceFilename": "optional filename"
}

Example (JSON)

curl -X POST https://your-domain.com/api/v1/analyze \
  -H "Authorization: Bearer agt_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "content": "{\"name\":\"my-agent\",\"tools\":[]}",
    "format": "json"
  }'

Example (YAML)

curl -X POST https://your-domain.com/api/v1/analyze \
  -H "Authorization: Bearer agt_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "content": "name: my-agent\ntools: []",
    "format": "yaml"
  }'

Response

Returns the same safe analysis payload as the web analyzer: score, grade, risk level, findings (with rule IDs AG-001 through AG-023), and sanitized configuration. Raw secrets are never returned.

Rate limits

60 requests per minute per API key. Exceeding the limit returns 429 Too Many Requests with a Retry-After header.

HTTP status codes

• 200 — Analysis succeeded
• 400 — Invalid request or malformed configuration
• 401 — Missing, invalid, or revoked API key
• 403 — API access requires Pro plan
• 413 — Configuration exceeds 1 MB limit
• 429 — Rate limit exceeded

Secret handling

Configurations are scanned for secrets before analysis. Detected credentials are redacted in responses. Never submit production secrets; use test values in CI pipelines.

Finding IDs

Findings reference deterministic rule IDs (AG-001 through AG-023). Severity, score, and pass/fail status are computed server-side and cannot be supplied by the client.