Getting Started

Bastyn is an AI agent certification platform. Use the public API to submit an agent’s repository for analysis and receive a signed certification report.

Onboarding your first agent? Start in the web console

Connect your repository from the web console rather than the API. That flow does things the API can’t do on its own:

• Installs the Bastyn GitHub App when your repository is private, so the platform can clone and analyse it without you pasting credentials. Public repos need no install at registration; drift monitoring installs it later.
• Unlocks drift monitoring once your first attestation completes. Activate it from the attestation page to watch for code changes between releases. Watching your agent’s live traces additionally requires instrumenting it for telemetry.
• Runs the attestation: you pick the scan scope (SAST for static analysis of the codebase, DAST for a live adversarial red-team session against a reachable agent endpoint you provide, or both), then Bastyn assigns a Trust score and issues the certificate.
• Handles billing for you, no quote_token to obtain first.

The API below is recommended for advanced users already familiar with the web console, chiefly polling attestation results from a CI/CD pipeline for agents you’ve already onboarded there. Note that starting or re-running an attestation over the API still needs a quote_token (see the caution in Step 3), so kick runs off from the console unless your organization is exempt from billing. You can still create an API key any time in Settings → Environments; it’s just not where a first-time onboarding should start.

You're viewing the production docs

This page targets the production host, https://api.bastyn.ai/v1. API keys are environment-scoped, so a staging key won’t work here.

Quick Start

1. Create an API key in Settings → Environments.

2. Submit your repository:

   curl -X POST https://api.bastyn.ai/v1/attestation/projects \
     -H "Authorization: Bearer bastyn_sk_your_key" \
     -H "Content-Type: application/json" \
     -d '{"name": "my-agent", "repo_url": "https://github.com/your-org/your-agent"}'

   Save the project_id from the response.

3. Start the certification workflow:

   curl -X POST https://api.bastyn.ai/v1/attestation/projects/{project_id}/start \
     -H "Authorization: Bearer bastyn_sk_your_key"

   Save the run_id from the response.

   Billed runs require a quote_token

   Non-VIP organizations must pass a quote_token in this request body, obtained from POST /billing/quote. That endpoint is only available to authenticated dashboard sessions, not to public API key requests, so a pure API key integration can’t self-serve a quote today. Start your first run from the web console instead, then use the API for subsequent steps.

4. Poll for completion:

   curl https://api.bastyn.ai/v1/attestation/runs/{run_id} \
     -H "Authorization: Bearer bastyn_sk_your_key"

   When status is completed, your attestation report is ready.

Base URL

https://api.bastyn.ai/v1

All requests require an Authorization: Bearer <api_key> header. See Authentication for details.

Next steps

Explore every endpoint in the API Reference.