REST API

CodeRifts REST API

Only a granted change can proceed.

What this gate does. Advisory. The REST endpoint returns an analysis. It issues no grant and no receipt, so nothing here prevents a merge, a deploy or a tool call — something else has to enforce the verdict.

Diff OpenAPI specs programmatically from any CI/CD pipeline, pre-commit hook, or custom application. One endpoint, JSON in, JSON out.

Format coverage, read 2026-10-04, is the table on the documentation page. An incomplete analysis in authorize mode is ANALYSIS_FAILED and STOP, with the gap named.

Get Your API Key — Free

Quick Start

curl -X POST https://app.coderifts.com/api/v1/diff \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "base": "https://petstore.swagger.io/v2/swagger.json",
    "head": "https://your-api.com/openapi.yaml"
  }'

Specs can be URLs or inline JSON/YAML. See the full API reference for all options.

API Reference

POST /api/v1/diff

Compare two OpenAPI specifications and return a detailed analysis report.

Request Body

Field	Type	Required	Description
base	string	Yes	URL or inline spec (base version)
head	string	Yes	URL or inline spec (new version)
format	string	No	"json" (default) or "markdown"

Authentication

Bearer token via Authorization header. Get your key at app.coderifts.com/api/signup.

Rate Limits

Measured in the server on 2026-09-30. A self-serve key is the free tier. There is no Team key, so this table has no unlimited row.

Caller	Limit	What happens
Free key, requests per month during the public beta	1,000 requests	Above it, authorize returns 429 `BETA_LIMIT_REACHED`. Analyze continues.
Any API key	100 requests per minute	Enforced.
Authorization cases per month	1,000 Free / 10,000 Team	The authorization-case counter is a label, and it is not the live 1,000-request cap. The remaining count is the `X-RateLimit-Cases-Remaining` header.
Keyless analyze and other agent-public calls, per IP	60 per minute	Enforced. This bucket has no daily cap.
Other keyless public calls, per IP	30 per minute, and 50 per day	Enforced.

Signup states the same four numbers: 1,000 requests/month, 100 requests/minute, and authorization cases of 1,000 (Free) / 10,000 (Team) per month. During the public beta every organization gets Team features at $0 with a self-serve key, public and private repositories alike, no separate Team key to request, and each key allows 1,000 requests a month: after that, /preflight authorize returns BETA_LIMIT_REACHED while its analysis keeps working; other API routes return 429.

Prices stay on the pricing page. Enterprise is a separate page. No Pro tier is sold.

CI/CD Integration Examples

Use the API in any pipeline. Here are examples for popular CI systems.

GitHub Actions

- name: Check API breaking changes
  run: |
    RESULT=$(curl -s -X POST https://app.coderifts.com/api/v1/diff \
      -H "Authorization: Bearer ${{ secrets.CODERIFTS_API_KEY }}" \
      -H "Content-Type: application/json" \
      -d '{"base": "main:api/openapi.yaml", "head": "api/openapi.yaml"}')
    echo "$RESULT" | jq .summary

GitLab CI

api-contract-check:
  stage: test
  script:
    - |
      curl -sf -X POST https://app.coderifts.com/api/v1/diff \
        -H "Authorization: Bearer $CODERIFTS_API_KEY" \
        -H "Content-Type: application/json" \
        -d "{\"base\": \"$CI_MERGE_REQUEST_TARGET_BRANCH_NAME:api/openapi.yaml\",
             \"head\": \"api/openapi.yaml\"}"

Get your API key — free.

free during beta (1,000 requests a month). No credit card required.

Get API Key Full API Docs

Prefer a GitHub-native experience? Install the GitHub App instead.