REST API
POST /api/v1/analyze for deterministic agent configuration analysis.
Page text and source link for your AI assistant. Nothing is sent automatically.
Overview
| Item | Value |
|---|---|
| Base URL | Your Foo Guard deployment URL |
| Analysis endpoint | POST /api/v1/analyze |
| Authentication | Bearer API key |
| Plan requirement | Pro (personal) or Team entitlement (service keys) |
| Max payload | 1 MB |
Request body
{
"content": "<JSON or YAML configuration>",
"format": "json",
"name": "optional label",
"sourceFilename": "optional filename"
}Only documented fields are accepted. Unknown fields return 400.
Example
curl -X POST https://your-domain.com/api/v1/analyze \
-H "Authorization: Bearer agt_live_..." \
-H "Content-Type: application/json" \
-d '{
"content": "{\"name\":\"my-agent\",\"tools\":[]}",
"format": "json"
}'For a YAML configuration, send it as a string with "format": "yaml":
curl -X POST https://your-domain.com/api/v1/analyze \
-H "Authorization: Bearer agt_live_..." \
-H "Content-Type: application/json" \
-d '{
"content": "name: my-agent\ntools: []",
"format": "yaml"
}'Response
Returns an AnalysisResult with score.value, score.scale, score.grade, findings, and sanitizedConfig. The security-v2 scale starts at 100 (no scored findings) and falls toward 0 as severity-weighted findings accumulate. Grades and policy decisions are unchanged. Finding rule IDs follow AG-001 through AG-030. Raw secrets are never included.
Severity, score, and pass/fail status are computed server-side and cannot be supplied by the client.
Secret handling
Configurations are scanned for secrets before analysis, and detected credentials are redacted in responses. Never submit production secrets; use test values in CI pipelines.