API Overview

The Inkog API allows you to programmatically scan code for AI agent logic flaws and security risks.

Base URL


https://api.inkog.io

For self-hosted deployments, use your server’s URL.

Authentication

All API requests require an API key passed in the Authorization header:


Authorization: Bearer YOUR_API_KEY

Get your API key in 30 seconds:

Create a free account at app.inkog.io
Go to Dashboard → API Keys
Click Generate New Key and copy it

Rate Limits

Plan	Requests per minute	Burst
Free	10	5
Pro	60	20
Enterprise	Unlimited	-

When rate limited, you’ll receive a 429 response with a Retry-After header.

Response Format

All responses are JSON with the following structure:


{
  "success": true,
  "data": { ... }
}

Error responses include an error code and message:


{
  "success": false,
  "error": {
    "code": "RATE_LIMITED",
    "message": "Rate limit exceeded. Please retry later."
  }
}

Quick Start

Scan a file in seconds. File contents go in the JSON body; the API does not read your disk:


# Scan one file. The API never reads your disk: send file contents in the JSON body.
curl -X POST https://api.inkog.io/v1/scan \
  -H "Authorization: Bearer $INKOG_API_KEY" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile code ./src/agent.py \
        '{files: [{path: "src/agent.py", content: $code}], policy: "balanced", output: "detailed"}')"

Response (trimmed to one finding):


{
  "success": true,
  "scan_id": "0ed02144-783e-4edb-9303-a64e2823aa84",
  "risk_score": 83,
  "summary": {
    "critical": 4,
    "high": 11,
    "low": 0,
    "medium": 1,
    "total": 16
  },
  "files_scanned": 8,
  "findings": [
    {
      "id": "IR-70",
      "pattern_id": "system_prompt_leak",
      "pattern": "System Prompt Leakage (OWASP LLM07)",
      "severity": "HIGH",
      "confidence": 0.85,
      "file": "src/assistants.py",
      "line": 70,
      "column": 15,
      "message": "System prompt contains material that should not leak (credentials, PII, internal instructions reflected from user input) or is being logged \u2026",
      "cwe": "CWE-209, CWE-532",
      "cvss": 5.5,
      "owasp_category": "LLM07",
      "category": "data_exposure",
      "risk_tier": "risk_pattern",
      "finding_type": "vulnerability",
      "remediation_hint": "No credentials in system prompts. No user-input echo. No plaintext logging of the prompt.",
      "compliance_mapping": {
        "eu_ai_act_articles": [
          "Article 15.4"
        ],
        "nist_categories": [
          "GOVERN 4.2",
          "MEASURE 2.7"
        ],
        "iso_42001_clauses": [
          "9.2"
        ],
        "owasp_items": [
          "LLM07"
        ],
        "cwe_ids": [
          "CWE-209",
          "CWE-532"
        ]
      }
    }
  ],
  "quick_wins": [
    {
      "priority": 85,
      "action": "Remove dangerous eval/exec - use safe parsing",
      "pattern_id": "exec_eval",
      "severity": "CRITICAL",
      "file": "src/dev_agent.py",
      "line": 69
    }
  ]
}

Endpoints

Method	Endpoint	Description
`POST`	`/v1/scan`	Scan code for logic flaws and security risks (JSON body)
`GET`	`/v1/scans/{id}/diff`	Compare a scan with the previous scan of the same agent
`POST`	`/v1/feedback`	Submit feedback on findings
`GET`	`/v1/feedback`	Get calibration data

SDKs

Use the CLI or REST API directly with any HTTP client:


npx -y @inkog-io/cli scan .