Scanning from CI
Trigger a scan from your pipeline and read the result as JSON.
Get a scan token
Each site can issue its own token, scoped to that site and nothing else. Keep it in your CI provider's secret store — anyone holding it can start scans on that site.
Trigger, poll, read
Three endpoints, all authenticated with Authorization: Bearer <scan token>:
POST /v1/scan → { "scanId": "..." }
GET /v1/scan/:scanId/progress → how far along it is
GET /v1/scan/:scanId/result → the findings, as JSON
The scan is asynchronous: the POST returns as soon as it is queued, so poll progress before asking for the result.
Failing a build
PixyScan does not post a status back to your pull request and does not decide what should block a merge. Your script reads the result and makes that call — for example, failing when the critical count rises above the previous scan's.
Being explicit about this: there is no GitHub or GitLab app to install. It is an HTTP API and your pipeline drives it.