API Reference

Overview #

SaaSClaw exposes a REST API at /api/v1/ for programmatic access. All endpoints return JSON and require authentication.

Authentication #

Two authentication methods are supported depending on your use case:

curl -X POST https://saasclaw.ai/api/v1/auth/exchange-session-token/ \
  -H "Cookie: sessionid=..."  # or use the browser cookie

Java SDK #

Spring Boot Starter for the SaaSClaw API. Provides auto-configured client beans, automatic token refresh, and type-safe DTOs.

Maven

<dependency>
  <groupId>com.saasclaw</groupId>
  <artifactId>saasclaw-spring-boot-starter</artifactId>
  <version>0.1.0-SNAPSHOT</version>
</dependency>

Gradle

implementation 'com.saasclaw:saasclaw-spring-boot-starter:0.1.0-SNAPSHOT'

Configuration

saasclaw:
  base-url: https://saasclaw.ai
  # Option 1: API key (recommended for servers)
  api-key: sk_...
  # Option 2: Email/password (auto-login + refresh)
  email: [email protected]
  password: secret

Quick start

@Autowired
private SaaSClawClient client;

// List projects
List<ProjectDto> projects = client.listProjects();

// Create a project
client.createProject(new ProjectCreateRequest("My App", "desc", "spring-boot"));

// Deploy
DeployStatus status = client.deploy("my-app");

// Send agent message
MessageDto msg = client.sendMessage("my-app", sessionId, "Add a login page");

Projects #

Manage projects — list, create, check status, and inspect infrastructure.

Sessions #

Interactive agent sessions within a project. Send messages to the AI wizard and receive responses.

Files #

Read and write files within a project workspace. All paths are validated to stay within the project root.

Environment Variables #

Manage environment variables for deployed projects. These are injected into the project's runtime environment on deploy.

Deploy #

Trigger and monitor deployments. Each deploy creates a new commit and provisions the project at the preview or production URL.

Git #

Inspect and commit changes to the project's Git repository without leaving the API.

Infrastructure #

Inspect the infrastructure state of a deployed project — running services, Nginx config, systemd status, and resource usage.

Security Scans #

Run attacker-first vulnerability analysis on your project's source code. The wizard uses a VulnHunter-inspired phased methodology — Recon (map attack surface), Hunt (trace inputs to sinks), Disprove (falsify weak candidates), Report (confirmed findings with fixes).

Scan Types

• Quick — Fast grep-based check for 6 common vulnerability patterns (SQL injection, XSS, hardcoded secrets, CORS, path traversal, command injection)
• Full — VulnHunter 4-phase audit: map attack surface, trace all input-to-sink data flows, adversarial falsification, detailed report
• Recent Changes — Scan only files changed since the last commit

PII Redaction (Presidio) #

Microsoft Presidio integration detects and redacts 13 types of Personally Identifiable Information before it reaches the LLM. Detected values are replaced with synthetic placeholders (, , etc.).

Prompt Injection Defense (Sunglasses) #

Every agent input is scanned using the Sunglasses library — 1,094 attack patterns across 65 categories in 23 languages. Dual-layer defense scans at both the wizard endpoint and the agent runner.

Errors #

The API uses standard HTTP status codes. Error responses include a detail field with a human-readable message.