API Reference: api.sofe.dev

Main evaluation API — handles scanning, history, connections, billing webhooks, and notifications.

Base URL

https://api.sofe.dev

Authentication

API Key: X-API-Key: sk_sofe_xxx (from platform.sofe.dev/keys)
Bearer Token: Authorization: Bearer <firebase_id_token> (from platform login)

Rate Limits

Only POST /evaluate is rate-limited. All GET endpoints are unlimited.

TierPOST /evaluate per day
Free10
Pro1,000
EnterpriseUnlimited

Endpoints (18)

POST/evaluate

Run policies against connected AWS account

Auth: API key or Bearer

POST/validate

Validate policy YAML syntax

Auth: API key or Bearer

GET/evaluations

List evaluation history (paginated)

Auth: API key or Bearer

GET/evaluations/:id

Full evaluation detail with findings + resources_by_type + insights + remediation_commands

Auth: API key or Bearer

GET/evaluations/:id/byaml

Generate BYaML v0.3 architecture file from evaluation (YAML or JSON)

Auth: API key or Bearer

GET/evaluations/:id/insights

Architecture insights: relationships, SPOFs, blast radius, team costs

Auth: API key or Bearer

GET/evaluations/schedule

Get current schedule config

Auth: API key or Bearer

POST/evaluations/schedule

Update schedule (off/6h/daily/weekly)

Auth: API key or Bearer

GET/collectors

List all 17 collectors with metrics

Auth: API key or Bearer

GET/policies

List all policies with severity + scope

Auth: API key or Bearer

GET/policies/catalog

Full catalog for platform display

Auth: API key or Bearer

GET/components/catalog

58 BYaML component types with category, layer, hasCollector

Auth: None (public)

POST/connect/aws

Connect AWS account (verify role ARN)

Auth: Bearer only

GET/connect/accounts

List connected AWS accounts

Auth: Bearer only

POST/test-notify

Send test notification (Slack/email)

Auth: Bearer only

POST/webhooks/lemonsqueezy

Billing webhook (subscription events)

Auth: HMAC signature

POST/webhooks/taypi

Payment webhook (Yape QR)

Auth: HMAC signature

GET/health

Status check

Auth: None (public)