Run your first LiveAPISec API security scan

Before you start

• The CLI installed (pipx install liveapisec). See /docs/install.
• An API key (las_dev_...) or a saved login via liveapisec login.
• A reachable base URL and, optionally, credentials for protected endpoints.

1. Push your endpoints

You can list endpoints manually, import an OpenAPI document, or let the CLI discover routes from your source code. The same name + base_url always updates the same project, so push is safe to repeat.

liveapisec push \
  --name my-api \
  --base-url https://api.example.com \
  --endpoint "GET /users" \
  --endpoint "POST /payments"

liveapisec push \
  --name my-api \
  --base-url https://api.example.com \
  --openapi-url https://api.example.com/openapi.json

liveapisec scan-code --dir . \
  --name my-api --base-url https://api.example.com

2. Run the scan

--wait polls until the scan finishes. Add --fail-on high to get exit code 1 when a high or critical finding is found — useful in scripts and CI. For a local or private target, add --tunnel after starting liveapisec connect.

liveapisec scan \
  --project PROJECT_ID \
  --branch main \
  --commit "$GITHUB_SHA" \
  --wait --fail-on high

3. Read the findings

Findings include category, severity, target and evidence. Use --json for scripts and AI agents; the same data is available in the dashboard under scan details.

liveapisec findings --project PROJECT_ID --scan SCAN_ID
liveapisec findings --project PROJECT_ID --scan SCAN_ID --json
liveapisec status   --project PROJECT_ID

4. Turn the result into proof

After a passing scan, publish the live certificate for the project and embed it in your trust page, docs or website. It updates with every scan and gives buyers a checkable link instead of a claim.

liveapisec certificate --project PROJECT_ID
liveapisec report --project PROJECT_ID --scan SCAN_ID --format md -o report.md
liveapisec compliance --project PROJECT_ID --scan SCAN_ID

To run the whole chain (scan → verdict → compliance → report/PDF) in one command, use liveapisec all --project PROJECT_ID.

FAQ

Do I need an API key for the first scan?

An API key unlocks authenticated scans and the dashboard. Without a key, LiveAPISec can only test public endpoints, so protected routes are not covered.

How long does the first scan take?

The first report is typically ready in about two minutes for the baseline suite. The deep suite takes longer because it runs the full set of deterministic tests per endpoint.

Can I scan a localhost API?

Yes. localhost and private IPs are exempt from domain verification. Start `liveapisec connect --project PROJECT_ID` in one terminal and run `liveapisec scan --project PROJECT_ID --tunnel` in another.