Documentation
VibeProd API Reference
Integrate production-readiness scanning into your CI/CD pipeline, dashboard, or toolchain.
Getting started
1
Install the GitHub App
Connect VibeProd to your repositories at vibeprod.ai/onboarding. Grant access only to repos you want scanned — you stay in control.
Install GitHub App →2
Trigger your first scan
Once connected, VibeProd scans automatically on push. You can also trigger scans manually via the dashboard or the REST API.
3
Review findings and fix PRs
Each scan produces a score (0–100), a letter grade, and findings per dimension. For actionable issues, you can open a reviewable fix PR — VibeProd never merges without your approval.
Authentication
The VibeProd API uses session-based authentication via NextAuth. To make authenticated requests, include your session cookie. The easiest way is to use the dashboard UI, which handles sessions automatically.
Public endpoints (/api/health and /api/stats) require no authentication. All other endpoints require an active session. API key support is on the roadmap.
API reference
Base URL: https://www.vibeprod.ai
Health & Stats
GET/api/health
Health check — returns service status.
Response
Returns `ok` when the service is running normally.
{ "status": "ok" }GET/api/stats
Public platform statistics — total users, completed scans, fix PRs raised.
Response
Cached for 60 seconds at the edge.
{
"userCount": 142,
"scanCount": 891,
"fixRunCount": 67
}Scans
POST/api/scansauth required
Trigger a new production-readiness scan on a GitHub repository.
Request
Pass the GitHub repository URL. The repo must be accessible by the VibeProd GitHub App.
curl -X POST https://www.vibeprod.ai/api/scans \
-H "Content-Type: application/json" \
-H "Cookie: next-auth.session-token=<session>" \
-d '{ "repoUrl": "https://github.com/your-org/your-repo" }'Response
Returns the scan object with a unique `id`. Poll `GET /api/scans/:id` or stream `GET /api/scans/:id/stream` for progress.
{
"id": "clu7x9k2f0001abc123xyz",
"status": "PENDING",
"repoUrl": "https://github.com/your-org/your-repo",
"startedAt": "2026-06-16T10:00:00.000Z"
}GET/api/scans/:idauth required
Get the result of a scan by ID.
Request
Replace `:id` with the scan ID returned from `POST /api/scans`.
curl https://www.vibeprod.ai/api/scans/clu7x9k2f0001abc123xyz \
-H "Cookie: next-auth.session-token=<session>"
Response
`status` is one of `PENDING`, `RUNNING`, `COMPLETE`, `FAILED`. `dimensions` is populated when complete.
{
"id": "clu7x9k2f0001abc123xyz",
"status": "COMPLETE",
"score": 74,
"grade": "B",
"repoUrl": "https://github.com/your-org/your-repo",
"dimensions": [
{
"name": "secrets",
"label": "Launch Blockers",
"score": 0.5,
"weight": 0.25,
"findings": [
{
"severity": "CRITICAL",
"title": "Hardcoded API key detected",
"file": "src/config.ts",
"line": 12,
"fix": "Move to environment variable"
}
]
}
]
}GET/api/scans/:id/streamauth required
Stream real-time scan progress via Server-Sent Events (SSE).
Request
Connect as an SSE client. The stream closes when the scan reaches `COMPLETE` or `FAILED`.
curl -N https://www.vibeprod.ai/api/scans/clu7x9k2f0001abc123xyz/stream \
-H "Cookie: next-auth.session-token=<session>" \
-H "Accept: text/event-stream"
Response
Emits `data:` events with JSON payloads as each dimension completes.
data: {"type":"progress","dimension":"secrets","score":0.5}
data: {"type":"progress","dimension":"auth","score":0.8}
data: {"type":"complete","scanId":"clu7x9k2f0001abc123xyz","score":74}Fix Runs
POST/api/fix-runsauth required
Trigger a fix PR run for a specific skill on a completed scan.
Request
`scanId` must reference a `COMPLETE` scan. `skillSlug` is the identifier of the fix skill to apply.
curl -X POST https://www.vibeprod.ai/api/fix-runs \
-H "Content-Type: application/json" \
-H "Cookie: next-auth.session-token=<session>" \
-d '{
"scanId": "clu7x9k2f0001abc123xyz",
"skillSlug": "add-env-example"
}'Response
Returns the fix run object. Poll `GET /api/fix-runs/:id` for status. A PR is opened on completion.
{
"id": "fix_run_abc123",
"status": "PENDING",
"skillSlug": "add-env-example",
"scanId": "clu7x9k2f0001abc123xyz"
}Security
No code storage
VibeProd runs static analysis and discards the code snapshot immediately after the scan. We never persist your source code.
Never auto-merges
Every fix PR opened by VibeProd requires your explicit approval in GitHub. We open the PR — you decide if and when it merges.
Minimal permissions
The GitHub App requests only the permissions it needs: read access to code and metadata, write access to pull requests. It does not request write access to code.
Webhook verification
All inbound GitHub webhooks are verified using HMAC-SHA256 signatures before processing.
Rate limits
Free3 scans / day1 fix PR / month
Builder50 scans / day10 fix PRs / month
TeamUnlimited50 fix PRs / month
EnterpriseUnlimitedUnlimited
Paid plans are coming soon. See Pricing for details.