> ## Documentation Index
> Fetch the complete documentation index at: https://veridical-dev.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# API and SDK usage

> REST patterns for TypeScript and Python

All product API routes use bearer authentication and workspace-scoped
authorization. Mutations that support replay protection accept a stable
`Idempotency-Key`; propagate `X-Correlation-ID` through your own logs.

```typescript theme={null}
const response = await fetch(`${baseUrl}/api/v1/scans`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${token}`,
    "Content-Type": "application/json",
    "Idempotency-Key": crypto.randomUUID(),
  },
  body: JSON.stringify({
    workspace_id: "ws_123",
    repository_id: "repo_456",
    scan_type: "security",
  }),
});
if (!response.ok) throw new Error(await response.text());
const scan = await response.json();
```

```python theme={null}
import uuid
import httpx

response = httpx.post(
    f"{base_url}/api/v1/scans",
    headers={
        "Authorization": f"Bearer {token}",
        "Idempotency-Key": str(uuid.uuid4()),
    },
    json={
        "workspace_id": "ws_123",
        "repository_id": "repo_456",
        "scan_type": "security",
    },
    timeout=30,
)
response.raise_for_status()
scan = response.json()
```

These examples use standard HTTP clients and match the generated OpenAPI 3.1
contract. Generated SDK packages should pin the committed `openapi.json` digest
and expose the same errors and idempotency behavior.