What APIs does Bachao.AI expose for automated security scanning?

Bachao.AI exposes REST APIs for VAPT scan initiation, vulnerability report retrieval, DPDP compliance checks, and webhook delivery of findings. Authenticated via API keys, the API follows OpenAPI 3.1 specification and supports JSON responses. SDK clients are available for Python and Node.js, with rate limits documented in the reference.

How do I authenticate with the Bachao.AI API?

Bachao.AI API uses Bearer token authentication. Generate an API key from the dashboard under Settings → API Keys. Pass the key in the Authorization header as Bearer {token}. Keys are scoped per workspace and can be rotated without downtime. Sandbox keys are available for testing without triggering live scans.

Does Bachao.AI API support CI/CD pipeline integration?

Bachao.AI API integrates with CI/CD pipelines via GitHub Actions, GitLab CI, and Bitbucket Pipelines. Trigger VAPT scans on pull request creation or deployment events and block merges if critical CVEs are detected. The API returns CVSS v3.1 severity scores compatible with DevSecOps gating workflows.

What webhook events does Bachao.AI API emit?

Bachao.AI emits webhook events for scan.started, scan.completed, vulnerability.detected, compliance.passed, and compliance.failed. Payloads are signed with HMAC-SHA256 using your registered webhook secret. Retries follow exponential backoff for up to 72 hours on 5xx responses. Endpoint verification requires a challenge-response handshake completed on first registration before events are delivered.

What rate limits apply to the Bachao.AI Developer API?

Bachao.AI API enforces 1,000 requests per minute per API key on the Growth plan and 5,000 on Enterprise. Scan initiation calls are additionally throttled to 10 concurrent scans per workspace. Rate limit headers X-RateLimit-Remaining, X-RateLimit-Limit, and X-RateLimit-Reset are returned on every API response to support programmatic backoff.

Does Bachao.AI have a public API?

Yes. Bachao.AI exposes a REST API for triggering scans, fetching findings, downloading CERT-In aligned reports, and managing webhooks. Authentication uses bearer tokens scoped per project. The API is documented with OpenAPI specs, request/response examples, and rate limits aligned to your subscription tier.

What SDKs does Bachao.AI provide?

Official SDKs are available for Node.js, Python, and Go, with TypeScript types included. Each SDK wraps scan triggering, finding retrieval, and webhook signature verification. Community-maintained Ruby and PHP libraries exist; contributions are welcome via the GitHub organization linked in the developer documentation.

How do webhooks work in Bachao.AI?

Webhooks fire on scan completion, new critical findings, and compliance status changes. Each payload is HMAC-signed using your project secret for verification. Retries follow exponential backoff for up to 24 hours on non-2xx responses, with a delivery log surfaced in the developer dashboard.

Are there API rate limits in Bachao.AI?

Yes. Free tier allows 60 requests per minute and 5 scans per day. Paid tiers scale to 600 requests per minute and unlimited scans subject to fair use. Rate limit headers (X-RateLimit-Remaining, Retry-After) are returned on every response for client-side backoff handling.

What APIs does Bachao.AI expose for automated security scanning?

Bachao.AI exposes REST endpoints for booking VAPT scans, listing scans, fetching reports, RASP agent registration and event ingestion, and rule management. The Node.js RASP SDK ships as @bachao/rasp-node; all other operations are available via the REST API documented on this page.

How do I authenticate with the Bachao.AI API?

Dashboard-side calls use a session cookie from OTP login. RASP agents register with a setup token issued by the dashboard, then receive a permanent API key passed via the x-rasp-key header. Generate a setup token via POST /api/rasp/setup/generate-key.

Does Bachao.AI integrate with CI/CD pipelines?

Yes. Use the documented GitHub Actions workflow (also adaptable to GitLab CI and Bitbucket Pipelines) to call POST /api/scans/book on push or pull-request events. Reports are accessible via GET /api/reports/{id} once the scan completes, with severity scoring suitable for DevSecOps merge gates.

What webhook events does Bachao.AI emit?

Bachao.AI emits scan.completed events with scan ID, target URL, risk score, finding counts, and severity breakdown. Payloads are documented on this page. Delivery is retried with exponential backoff for transient 5xx responses.

What rate limits apply to the Bachao.AI API?

Scan booking is limited to 6 requests per hour per account. RASP event ingestion is limited to 60 batched requests per minute per agent, with heartbeats at 12 per minute. Dashboard reads are limited to 600 per minute per session. Throttled responses include a Retry-After header.

Bachao.AI API & SDK — Trigger VAPT Scans, Stream Findings, Automate DPDP Evidence

REST endpoints, runtime-protection SDKs, and CI/CD integrations for shipping faster without trading away security. Built for Indian SaaS startups, SMBs, and platform teams.

RASP SDK Quickstart

Install the Node.js SDK in 2 minutes

API Authentication

API keys, setup tokens, and auth flows

Webhook Reference

Event payloads and delivery

CI/CD Integration

GitHub Actions, GitLab CI, Bitbucket Pipelines

Quickstart: Trigger Your First VAPT Scan (cURL)

One curl call kicks off a full automated VAPT against a target you control.

Book a scan

curl -X POST https://www.bachao.ai/api/scans/book \
  -H "Cookie: bachao-session=YOUR_SESSION" \
  -H "Content-Type: application/json" \
  -d '{"scanUrl":"https://staging.example.com","scanType":"pentest"}'

# Response:
# { "success": true, "scanId": "clx...", "status": "queued" }

Your session cookie comes from the dashboard login. For unattended pipelines, generate a setup token (see API Authentication) and use it instead. The scan ID returned here is what you poll onGET /api/scansor receive via webhook when complete.

RASP SDK Quickstart

Add runtime protection to your Node.js app in under 2 minutes.

Install

npm install @bachao/rasp-node

Express

import express from "express";
import { bachaoRasp } from "@bachao/rasp-node";

const app = express();

app.use(bachaoRasp({
  apiKey: process.env.BACHAO_RASP_KEY!,
  appName: "my-api",
  mode: "monitor", // start in monitor mode, switch to "block" from dashboard
}));

app.listen(3000);

Fastify

import Fastify from "fastify";
import { bachaoRaspFastify } from "@bachao/rasp-node/fastify";

const app = Fastify();
app.register(bachaoRaspFastify, {
  apiKey: process.env.BACHAO_RASP_KEY!,
  appName: "my-api",
});

NestJS

import { Module } from "@nestjs/common";
import { BachaoRaspModule } from "@bachao/rasp-node/nestjs";

@Module({
  imports: [BachaoRaspModule.forRoot({
    apiKey: process.env.BACHAO_RASP_KEY!,
    appName: "my-api",
  })],
})
export class AppModule {}

API Authentication

How authentication works between the dashboard, SDK, and API.

Auth Flow

Dashboard generates a setup token via POST /api/rasp/setup/generate-key
SDK uses the setup token during agent registration
Agent receives a permanent API key (sent via x-rasp-key header)
All subsequent SDK → API calls use the x-rasp-key header
Dashboard calls use a session cookie (from OTP login)

Generate setup token from dashboard

# Generate setup token from dashboard
curl -X POST https://www.bachao.ai/api/rasp/setup/generate-key \
  -H "Cookie: bachao-session=YOUR_SESSION" \
  -H "Content-Type: application/json"

# Response:
# { "success": true, "setupToken": "eyJ..." }

API Endpoints Reference

All public API endpoints available for integration.

Method	Endpoint	Auth	Description
POST	/api/rasp/register	Setup token	Register new RASP agent
POST	/api/rasp/heartbeat	API key	Agent health check + rule sync
POST	/api/rasp/events	API key	Report security events (batch)
GET	/api/rasp/rules	API key	Fetch protection rules
POST	/api/rasp/rules	Session	Create protection rule
GET	/api/rasp/agents	Session	List registered agents
GET	/api/rasp/stats	Session	Dashboard statistics
POST	/api/scans/book	Session	Book a VAPT scan
GET	/api/scans	Session	List your scans
GET	/api/reports/{id}	Session	Fetch scan report

Webhook Reference

Receive real-time notifications when events occur in your account.

scan.completed event payload

{
  "event": "scan.completed",
  "scanId": "clx...",
  "scanUrl": "https://example.com",
  "scanType": "pentest",
  "riskScore": 72,
  "findingsCount": 23,
  "criticalCount": 2,
  "timestamp": "2026-03-23T10:00:00Z"
}

CI/CD Integration

Trigger security scans automatically from your deployment pipeline.

.github/workflows/security-scan.yml

# .github/workflows/security-scan.yml
name: Bachao.AI Security Scan
on: [push]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Trigger VAPT Scan
        run: |
          curl -X POST https://www.bachao.ai/api/scans/book \
            -H "Cookie: bachao-session=${{secrets.BACHAO_SESSION}}" \
            -H "Content-Type: application/json" \
            -d '{"scanUrl":"https://staging.example.com","scanType":"pentest"}'

SDKs & Libraries

Official client libraries and platform support.

@bachao/rasp-node

Node.js RASP SDK

npm

Java, Python, PHP

Server-side RASP agents

Coming Soon

REST API

Available for all products

Available

Rate Limits, Errors & Status Codes

What our APIs return, how we throttle, and what to do when something breaks.

Rate limits

/api/scans/book — 6 / hour / account
/api/rasp/events — 60 / minute / agent (batched)
/api/rasp/heartbeat — 12 / minute / agent
Dashboard reads — 600 / minute / session

When throttled you'll get a 429 with aRetry-After header in seconds.

Error shape

{
  "success": false,
  "error": "validation_failed",
  "message": "scanUrl must be a valid URL",
  "field": "scanUrl"
}

Status	Meaning	Action
200	OK	Success — response body is your data.
201	Created	Resource created (scan, agent, rule).
400	Bad request	Inspect error.field — fix payload, retry.
401	Unauthorized	Missing or expired session / API key.
403	Forbidden	Auth OK but role lacks permission.
404	Not found	Resource doesn't exist or isn't yours.
409	Conflict	Duplicate (e.g., agent already registered).
429	Rate limited	Honour Retry-After, back off, then retry.
5xx	Server error	Retry with exponential backoff. Page us if persistent.

Need help integrating?

Talk to our engineering team. We'll help you get set up in under 30 minutes.

Talk to Engineering