Codacy

Delete billing subscription for organization via DELETE /billing/{provider}/{remoteOrganizationName}/subscription. Delete billing subscription for organization Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete organization via DELETE /organizations/{provider}/{remoteOrganizationName}. Delete organization Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete a coding standard via DELETE /organizations/{provider}/{remoteOrganizationName}/coding-standards/{codingStandardId}. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete a DAST target via DELETE /organizations/{provider}/{remoteOrganizationName}/dast/targets/{dastTargetId}. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete a gate policy via DELETE /organizations/{provider}/{remoteOrganizationName}/gate-policies/{gatePolicyId}. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete all SBOMs for a given image via DELETE /organizations/{provider}/{remoteOrganizationName}/image-sboms/{imageName}. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete SBOM for a given image/tag combination via DELETE /organizations/{provider}/{remoteOrganizationName}/image-sboms/{imageName}/tags/{tag}. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete the Jira integration of the organization and associated resources via DELETE /organizations/{provider}/{remoteOrganizationName}/integrations/jira. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Unlink a Jira ticket from a repository via DELETE /organizations/{provider}/{remoteOrganizationName}/integrations/jira/tickets/{jiraTicketIdentifier}. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete the Slack integration of the organization and associated resources via DELETE /organizations/{provider}/{remoteOrganizationName}/integrations/slack. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete a webhook endpoint of the organization via DELETE /organizations/{provider}/{remoteOrganizationName}/integrations/webhooks/{webhookId}. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Decline requests to join an organization via DELETE /organizations/{provider}/{remoteOrganizationName}/join. Decline requests to join an organization by specifying the provider, organization name, and the user emails to be rejected. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete a request to join an organization via DELETE /organizations/{provider}/{remoteOrganizationName}/join/{accountIdentifier}. Delete a request to join an organization by provider, name, and user ID DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete the specified repository via DELETE /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Unfollow a repository via DELETE /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/follow. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete a repository API token by ID via DELETE /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tokens/{tokenId}. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Revoke the Security Manager role from an organization member via DELETE /organizations/{provider}/{remoteOrganizationName}/security/managers/{userId}. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete the authenticated user via DELETE /user. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete an Enterprise account token via DELETE /user/enterprise/integrations/{provider}. This endpoint allows the authenticated user to delete a GitHub Enterprise account token. The token will no longer be used to access enterprise-level resources on GitHub. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete an integration for the authenticated user via DELETE /user/integrations/{provider}. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Delete an account API token for the authenticated user by ID via DELETE /user/tokens/{tokenId}. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

List organization pull requests from repositories that the user has access to via GET /analysis/organizations/{provider}/{remoteOrganizationName}/pull-requests. You can sort by last-updated (default), merged

List organization repositories with analysis information for the authenticated user via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories. For Bitbucket, you must URL encode the cursor before using it in subsequent API calls, as the pagination comes directly from the Git provider. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get a repository with analysis information for the authenticated user via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}.

Get the analysis progress of a repository via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/analysis-progress. Note: When applied to public repositories, this operation does not require authentication.

Get latest autoconfig run summary via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/autoconfig/runs.

Get autoconfig run status via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/autoconfig/status. [Experimental] Fetch latest autoconfig run state managed (can be Requested, Running, Done or Failed)

List analysis category overviews for a repository that the user has access to via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/category-overviews. Note: When applied to public repositories, this operation does not require authentication.

List commit analysis statistics for the last n days that have analysis data via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/commit-statistics. Returns the last n days with available data. This means that the returned days may not match the last n calendar days. Note: When applied to public repositories, this operation does not require authentication.

Return analysis results for the commits in a branch via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/commits. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get analysis results for a commit via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/commits/{commitUuid}.

List duplicate code blocks found in a commit via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/commits/{commitUuid}/clones. Use the status parameter to filter by new or removed duplicates Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get analysis statistics of a commit via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/commits/{commitUuid}/deltaStatistics. Returns the quality metric deltas introduced by a commit. The values of the metrics are 0 or null if Codacy didn't analyze the commit yet. To obtain the full analysis statistics for the repository use the endpoint getRepositoryWithAnalysis.

List files of a commit with analysis results via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/commits/{commitUuid}/files. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get analysis logs for a commit via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/commits/{commitUuid}/logs.

List the issues introduced or fixed by a commit via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/commits/{srcCommitUuid}/deltaIssues. Returns a list of issues introduced or fixed given a source commit SHA. By default, Codacy will calculate the issues by creating a delta between the source commit and its parent commit. As an alternative, you can also provide a destination commit to calculate the deltas. To list all issues in the repository, use searchRepositoryIssues. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get information about an open issue in a repository via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/issues/{issueId}.

Check if the repository has quick fix suggestions for a branch via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/issues/hasSuggestions. If branch is not provided, the default branch is used.

Get quickfixes for issues in patch format via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/issues/patch. If branch is not provided, the default branch is used.

List pull requests from a repository that the user has access to via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests. You can search this endpoint for either last-updated (default), merged Note: When applied to public repositories, this operation does not require authentication. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get pull request from a repository via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}. Note: When applied to public repositories, this operation does not require authentication.

List duplicate code blocks found in a pull request via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}/clones. Use the status parameter to filter by new or removed duplicates Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Return analysis results for the commits in a pull request via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}/commits. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

List all coverage reports uploaded for the common ancestor commit and head commit of a pull request branch via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}/coverage/status.

List files of a pull request with analysis results via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}/files. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

List issues found in a pull request via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}/issues. Use the status parameter to filter by new or fixed issues Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get quickfixes for pull request issues in patch format via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}/issues/patch. If branch is not provided, the default branch is used.

Get analysis logs for a pull request via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}/logs.

Get quality settings for the specific repository via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/quality-settings. Deprecated: Use getQualitySettingsForRepository instead. Note: When applied to public repositories, this operation does not require authentication.

Get analysis tools settings of a repository via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tools. Note: When applied to public repositories, this operation does not require authentication.

Patterns with Coding Standards conflicts for tool via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tools/{toolUuid}/conflicts.

Patterns configuration for (repository, tool). Uses standard if applied, repository settings otherwise via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tools/{toolUuid}/patterns. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Patterns configuration for (repository, tool, pattern). Uses standard if applied, repository settings otherwise via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tools/{toolUuid}/patterns/{patternId}.

Patterns overview for tool. Uses standard if applied, repository settings otherwise via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tools/{toolUuid}/patterns/overview.

Get tools with conflicts in a repository via GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tools/conflicts.

Get information about a commit via GET /commits/{commitId}.

Get configuration status via GET /configuration/status. Get configuration status PUBLIC ENDPOINT: measured 2026-09-23, Codacy answers this call 200 with a deliberately bogus api-token, so a successful result here proves nothing about whether this connection's credential is valid.

Get pull request coverage information from a repository via GET /coverage/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}. Note: When applied to public repositories, this operation does not require authentication.

Get the human-readable Git diff of a pull request via GET /coverage/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}/diff. Deprecated: Use getDiffBetweenCommits instead.

Get pull request files coverage information from a repository via GET /coverage/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}/files. Note: When applied to public repositories, this operation does not require authentication.

Triggers the reanalysis of the latest coverage report uploaded for the pull request via GET /coverage/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}/reanalyze.

Retrieve the list of duplication tools via GET /duplicationTools. PUBLIC ENDPOINT: measured 2026-09-23, Codacy answers this call 200 with a deliberately bogus api-token, so a successful result here proves nothing about whether this connection's credential is valid.

List user enterprises via GET /enterprises/{provider}. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get an enterprise via GET /enterprises/{provider}/{enterpriseName}.

Retrieve metrics that are ready for each organization in an enterprise via GET /enterprises/{provider}/{enterpriseName}/metrics/ready. Retrieve the list of metrics that have completed data collection for each organization in the enterprise.

Get the organizations of an enterprise via GET /enterprises/{provider}/{enterpriseName}/organizations. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get enterprise seats via GET /enterprises/{provider}/{enterpriseName}/seats. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Health check endpoint via GET /health. Health check endpoint PUBLIC ENDPOINT: measured 2026-09-23, Codacy answers this call 200 with a deliberately bogus api-token, so a successful result here proves nothing about whether this connection's credential is valid.

Retrieve the list of languages supported by available tools via GET /languages/tools. PUBLIC ENDPOINT: measured 2026-09-23, Codacy answers this call 200 with a deliberately bogus api-token, so a successful result here proves nothing about whether this connection's credential is valid.

List configured login providers on Codacy's platform via GET /login/integrations. List configured login providers on Codacy's platform PUBLIC ENDPOINT: measured 2026-09-23, Codacy answers this call 200 with a deliberately bogus api-token, so a successful result here proves nothing about whether this connection's credential is valid. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Retrieve the list of metrics tools via GET /metricsTools. PUBLIC ENDPOINT: measured 2026-09-23, Codacy answers this call 200 with a deliberately bogus api-token, so a successful result here proves nothing about whether this connection's credential is valid.

Retrieve the onboarding progress of an organization via GET /onboarding/organizations/{provider}/{remoteOrganizationName}/progress.

Get organization via GET /organizations/{provider}/{remoteOrganizationName}.

Get AI Risk Checklist for an organization via GET /organizations/{provider}/{remoteOrganizationName}/ai-risk-checklist.

Retrieve the audit logs for the organization via GET /organizations/{provider}/{remoteOrganizationName}/audit. Only available on Business plan. Requires organization admin or organization manager role.

Get detailed information about organization billing via GET /organizations/{provider}/{remoteOrganizationName}/billing. Get detailed information about organization billing

Get card information about organization billing via GET /organizations/{provider}/{remoteOrganizationName}/billing/card. Get card information about organization billing

Get a billing estimation via GET /organizations/{provider}/{remoteOrganizationName}/billing/estimation.

List the coding standards for an organization, including draft coding standards via GET /organizations/{provider}/{remoteOrganizationName}/coding-standards.

Get a coding standard via GET /organizations/{provider}/{remoteOrganizationName}/coding-standards/{codingStandardId}.

List the repositories that are using a coding standard via GET /organizations/{provider}/{remoteOrganizationName}/coding-standards/{codingStandardId}/repositories. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

List tools in a coding standard via GET /organizations/{provider}/{remoteOrganizationName}/coding-standards/{codingStandardId}/tools.

List the code patterns configured for a tool in a coding standard via GET /organizations/{provider}/{remoteOrganizationName}/coding-standards/{codingStandardId}/tools/{toolUuid}/patterns. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get patterns overview for a coding standard tool via GET /organizations/{provider}/{remoteOrganizationName}/coding-standards/{codingStandardId}/tools/{toolUuid}/patterns/overview.

Get information about a commit via GET /organizations/{provider}/{remoteOrganizationName}/commit/{commitId}. Use /commits/{commitId} instead.

List configured DAST targets via GET /organizations/{provider}/{remoteOrganizationName}/dast/targets. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

List the gate policies for an organization via GET /organizations/{provider}/{remoteOrganizationName}/gate-policies. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get a gate policy via GET /organizations/{provider}/{remoteOrganizationName}/gate-policies/{gatePolicyId}.

List all repositories following a gate policy via GET /organizations/{provider}/{remoteOrganizationName}/gate-policies/{gatePolicyId}/repositories. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get the status of Codacy Git provider app permissions for an organization via GET /organizations/{provider}/{remoteOrganizationName}/gitProviderAppPermissions.

List Docker images for an organization via GET /organizations/{provider}/{remoteOrganizationName}/images. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

List Docker image tags for an organization via GET /organizations/{provider}/{remoteOrganizationName}/images/{imageName}/tags. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get the Jira integration of the organization via GET /organizations/{provider}/{remoteOrganizationName}/integrations/jira.

Get available Jira projects for the organization via GET /organizations/{provider}/{remoteOrganizationName}/integrations/jira/projects. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get available issue types for a Jira project via GET /organizations/{provider}/{remoteOrganizationName}/integrations/jira/projects/{jiraProjectId}/issueTypes. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get available fields by issue type for a Jira project via GET /organizations/{provider}/{remoteOrganizationName}/integrations/jira/projects/{jiraProjectId}/issueTypes/{jiraIssueTypeId}/fields. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get Jira tickets for a Codacy element via GET /organizations/{provider}/{remoteOrganizationName}/integrations/jira/tickets.

Get Git provider settings via GET /organizations/{provider}/{remoteOrganizationName}/integrations/providerSettings.

Get the Slack integration of the organization via GET /organizations/{provider}/{remoteOrganizationName}/integrations/slack.

List webhook endpoints of the organization via GET /organizations/{provider}/{remoteOrganizationName}/integrations/webhooks.

List requests to join an organization via GET /organizations/{provider}/{remoteOrganizationName}/join. Endpoint to list requests to join an organization by provider and organization name Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Retrieve metrics that are ready for an organization via GET /organizations/{provider}/{remoteOrganizationName}/metrics/ready. Retrieve the list of metrics that have completed data collection for an organization.

List people of an organization via GET /organizations/{provider}/{remoteOrganizationName}/people. List people of an organization Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Check if the user can leave the organization via GET /organizations/{provider}/{remoteOrganizationName}/people/leave/check. Check if the user can leave the organization or returns the reasons why they can not.

List people suggestions for an organization via GET /organizations/{provider}/{remoteOrganizationName}/people/suggestions. List people suggestions for an organization Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Generate a CSV file listing the people of an organization via GET /organizations/{provider}/{remoteOrganizationName}/peopleCsv. Generate a CSV file containing the name, email, lastLogin, and lastAnalysis of each person of the organization

Get a presigned URL for the latest SBOM of the repository via GET /organizations/{provider}/{remoteOrganizationName}/projects/{repositoryName}/sbom.

List organization repositories for the authenticated user via GET /organizations/{provider}/{remoteOrganizationName}/repositories. For Bitbucket you must URL encode the cursor before using it in subsequent API calls, as the pagination comes directly from the Git provider. This endpoint may return more results than those specified in the limit parameter. Note: When applied to public repositories, this operation does not require authentication. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Fetch the specified repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}. Note: When applied to public repositories, this operation does not require authentication.

Get the human-readable Git diff between a head commit and a base commit via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/base/{baseCommitUuid}/head/{headCommitUuid}/diff.

List repository branches via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/branches. Note: When applied to public repositories, this operation does not require authentication. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get branch required status checks via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/branches/{branchName}/required-checks. Get branch required status checks

List coverage reports for a commit via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/commits/{commitUuid}/coverage/reports. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get a coverage report with its contents via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/commits/{commitUuid}/coverage/reports/{reportUuid}.

Get the human-readable Git diff of a commit via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/commits/{commitUuid}/diff.

List the most recent coverage reports and their status via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/coverage/status.

List folders in a repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/directories. Returns the most recent analysis information for the folders directly inside a path of a repository, with metrics aggregated over every file in each folder's subtree. Use the path parameter to list the folders inside a folder; when absent or empty, the folders at the repository root are returned. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

List files in a repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/files. Returns the most recent analysis information for the files in a repository as available on the Files page. Files that are ignored on Codacy aren't returned. Note: When applied to public repositories, this operation does not require authentication. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get analysis information and coverage metrics for a file in a repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/files/{fileId}.

Get coverage information for a file in the head commit of a repository branch via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/files/{fileId}/coverage.

Get the list of duplicated code blocks for a file in a repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/files/{fileId}/duplication. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get the issue list for a file in a repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/files/{fileId}/issues. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Returns the content of the given file for a given commit reference. If the requested file is over 1MB, a 'PayloadTooLarge' error is returned via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/files/{filePath}/content.

List ignored files in a repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/ignored-files. Returns the most recent ignored files information. Note: When the repository has a Codacy configuration file 'hasCodacyConfigurationFile', this list of files are read-only, as they were ignored during the most recent analysis based on the configuration file Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Create a post-commit hook for a repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/integrations/postCommitHook.

Get Git provider integration settings for a repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/integrations/providerSettings.

List people suggestions for a repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/people/suggestions. List people suggestions for a repository Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get the human-readable Git diff of a pull request via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}/diff.

Get the status of the repository setting Run analysis on your build server via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/analysis.

Get the list of supported file extensions associated with each language in a repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/file-extensions.

Get the list of all languages with their extensions and enabled status via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/languages.

Get quality settings for the commits of a repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/quality/commits. diffCoverageThreshold is never returned because this threshold isn't currently supported for commits.

Get quality settings for the pull requests of a repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/quality/pull-requests.

Get quality settings for the specific repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/quality/repository.

Get the public SSH key for the repository via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/stored-ssh-key. The returned key is the most recently generated and can be either a user or repository SSH key.

List the repository API tokens via GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tokens. Each token reports its name, expiration and creation date. Tokens created before creation dates were recorded have no createdAt CREDENTIAL REDACTED: this listing returns live Codacy API tokens, one of which is the credential this connection itself authenticates with, so Agentic Fabriq replaces each `token` value in the result. The `id` and `expiresAt` fields are returned intact and are what rotating or deleting a token needs.

List security subcategories that have security issues via GET /organizations/{provider}/{remoteOrganizationName}/security/categories. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get metrics for the security and risk management dashboard via GET /organizations/{provider}/{remoteOrganizationName}/security/dashboard. Deprecated: Use searchSecurityDashboard instead. Repository filtering is limited to 100 names.

List uploaded DAST scan reports and their state via GET /organizations/{provider}/{remoteOrganizationName}/security/dast/reports. Results are sorted by submission date, from latest to earliest. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

List security and risk management items for an organization via GET /organizations/{provider}/{remoteOrganizationName}/security/items. Deprecated: Use searchSecurityItems instead. Repository filtering is limited to 100 names. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get a single security and risk management finding via GET /organizations/{provider}/{remoteOrganizationName}/security/items/{srmItemId}.

List organization admins and security managers via GET /organizations/{provider}/{remoteOrganizationName}/security/managers. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

List organization repositories that have security issues via GET /organizations/{provider}/{remoteOrganizationName}/security/repositories. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get the SLA configuration for an organization via GET /organizations/{provider}/{remoteOrganizationName}/security/sla.

Get the segment values for the organization by segment key via GET /organizations/{provider}/{remoteOrganizationName}/segments/{segmentKey}/values. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get the segment keys for the organization via GET /organizations/{provider}/{remoteOrganizationName}/segments/keys. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get the segment keys with IDs for the organization via GET /organizations/{provider}/{remoteOrganizationName}/segments/keys/ids. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get the status of the segments synchronization via GET /organizations/{provider}/{remoteOrganizationName}/segments/sync.

Get segment values for a segment key via GET /organizations/{provider}/{remoteOrganizationName}/segments/values/{segmentKey}. Deprecated: Use getSegments instead. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Check if the submodules option is enabled for the organization via GET /organizations/{provider}/{remoteOrganizationName}/settings/submodules/check.

Get organization by provider installation id via GET /organizations/{provider}/installation/{installationId}. Note Currently supports only gh as the provider parameter.

List available plans in Codacy via GET /plans.

List provider integrations existing on Codacy's platform via GET /provider/integrations. List provider integrations existing on Codacy's platform PUBLIC ENDPOINT: measured 2026-09-23, Codacy answers this call 200 with a deliberately bogus api-token, so a successful result here proves nothing about whether this connection's credential is valid. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get enterprise seats as a CSV file via GET /reports/enterprises/{provider}/{enterpriseName}/seats-csv.

Generate a CSV file listing all security and risk management items for an organization via GET /reports/organizations/{provider}/{remoteOrganizationName}/security/items.

Retrieve the list of tools via GET /tools. PUBLIC ENDPOINT: measured 2026-09-23, Codacy answers this call 200 with a deliberately bogus api-token, so a successful result here proves nothing about whether this connection's credential is valid. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Retrieve the list of tool patterns via GET /tools/{toolUuid}/patterns. Codacy documents this operation as requiring no authentication, so a successful result may not depend on this connection's credential. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Retrieve a tool pattern via GET /tools/{toolUuid}/patterns/{patternId}. Get the definition of a specific pattern Codacy documents this operation as requiring no authentication, so a successful result may not depend on this connection's credential.

Get the authenticated user via GET /user.

List emails for the authenticated user via GET /user/emails.

Retrieve email notification settings via GET /user/emails/settings. Returns the current email notification preferences, including per-commit notifications, pull request notifications, and activity.

List user configured enterprise provider account tokens on Codacy's platform via GET /user/enterprise/integrations.

List integrations for the authenticated user via GET /user/integrations. List integrations for the authenticated user Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

List organizations for the authenticated user via GET /user/organizations. List organizations for the authenticated user Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

List organizations for the authenticated user via GET /user/organizations/{provider}. List organizations for the authenticated user Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it.

Get organization for the authenticated user via GET /user/organizations/{provider}/{remoteOrganizationName}. Get organization for the authenticated user

List the account API tokens of the authenticated user via GET /user/tokens. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it. CREDENTIAL REDACTED: this listing returns live Codacy API tokens, one of which is the credential this connection itself authenticates with, so Agentic Fabriq replaces each `token` value in the result. The `id` and `expiresAt` fields are returned intact and are what rotating or deleting a token needs.

Return the version of the Codacy installation via GET /version. PUBLIC ENDPOINT: measured 2026-09-23, Codacy answers this call 200 with a deliberately bogus api-token, so a successful result here proves nothing about whether this connection's credential is valid.

Ignore or unignore an issue via PATCH /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/issues/{issueId}. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Ignore the false positive result in an issue via PATCH /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/issues/{issueId}/false-positive/ignore.

Configure an analysis tool by enabling and disabling its patterns for a repository. This endpoint will apply the changes without verifying if the repository belongs to a coding standard via PATCH /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tools/{toolUuid}. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Bulk updates the code patterns of a tool in a repository. Use filters to specify the code patterns to update, or omit the filters to update all code patterns via PATCH /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tools/{toolUuid}/patterns. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Configure what your organization members can do across the Codacy platform via PATCH /organizations/{provider}/{remoteOrganizationName}/analysisConfigurationMinimumPermission. Define the lowest permission level that can configure patterns, configure which file extensions and branches are analyzed, and ignore issues and files Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Apply a coding standard to a list of repositories via PATCH /organizations/{provider}/{remoteOrganizationName}/coding-standards/{codingStandardId}/repositories. Link or unlink a coding standard to a list of repositories. If the coding standard is a draft, the changes will only be effective when promoting the draft coding standard. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Configure a tool in a draft coding standard via PATCH /organizations/{provider}/{remoteOrganizationName}/coding-standards/{codingStandardId}/tools/{toolUuid}. Toggle a tool and configure its code patterns in a draft coding standard. Only the code patterns included in the body are updated, and if there are none only the enabled status of the tool is set. You can only update draft coding standards and configure a maximum of 1000 code patterns per call. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Update a gate policy via PATCH /organizations/{provider}/{remoteOrganizationName}/gate-policies/{gatePolicyId}. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Create or update Git provider settings via PATCH /organizations/{provider}/{remoteOrganizationName}/integrations/providerSettings. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Update the settings for a repository branch via PATCH /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/branches/{branchName}. Toggle analysis for a branch. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Ignore or unignore a file via PATCH /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/file. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Update Git provider integration settings for a repository via PATCH /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/integrations/providerSettings. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Update the status of the repository setting Run analysis on your build server via PATCH /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/analysis. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Update the custom file extensions for a repository via PATCH /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/file-extensions. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Configure language settings for this repo via PATCH /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/languages. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Update the authenticated user via PATCH /user. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Update email notification preferences via PATCH /user/emails/settings. Modifies the user's email notification settings. Settings can be updated individually without affecting other settings. This endpoint allows users to control which events trigger email notifications. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Add repository autoconfiguration run via POST /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/autoconfig. [Experimental] Autoconfig enqueuing endpoint

List ignored issues in a repository via POST /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/ignoredIssues/search. Ignored issues are issues that Codacy found but were marked as ignored on the Codacy UI. Use SearchRepositoryIssuesBody to filter results. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Bulk ignore issues in a repository via POST /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/issues/bulk-ignore. Receives a list of issue ids and ignores them in the specified repository. Limited to 100 issues at once Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Get an overview of the issues in a repository via POST /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/issues/overview. Returns information about the number of issues that Codacy found in a repository as available on the Issues page. Use SearchRepositoryIssuesBody to filter the returned issues. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

List issues in a repository via POST /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/issues/search. Returns information about the issues that Codacy found in a repository as available on the Issues page. Use SearchRepositoryIssuesBody to filter the returned issues. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Triggers an AI review for a pull request via POST /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}/ai-reviewer/trigger.

Bypass analysis status in a pull request via POST /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}/bypass.

Recover a stuck repository via POST /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/recover. Triggers a recovery action when the repository is stuck on its first analysis. The exact action taken depends on the stuck state. Returns 422 Unprocessable Entity when the repository is not stuck.

Reanalyze the coverage for a commit via POST /coverage/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/commits/{commitUuid}/reanalyze. Triggers the reanalysis of the latest coverage report uploaded for the commit. Has no effect if the commit does not have any coverage report.

Retrieve latest metric values for all organizations in an enterprise via POST /enterprises/{provider}/{enterpriseName}/metrics/{metricName}/latest. Retrieve the latest value for each organization in an enterprise for an aggregating metric (e.g., open issues). Note: It does not work for accumulating metrics, such as fixed issues Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Retrieve latest metric values grouped by dimension for all organizations in an enterprise via POST /enterprises/{provider}/{enterpriseName}/metrics/{metricName}/latest-grouped. Retrieve an array of the latest values for an aggregating metric for each organization in an enterprise, based on the groupBy options. The groupBy can be organization or a valid dimension for the requested metric. Note: Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Retrieve metric values for a specific period for all organizations in an enterprise via POST /enterprises/{provider}/{enterpriseName}/metrics/{metricName}/period. Retrieve the value for a metric for each organization in an enterprise, for a specific period, identified by its start date. Notes: Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Retrieve metric values grouped by dimension for a specific period for all organizations in an enterprise via POST /enterprises/{provider}/{enterpriseName}/metrics/{metricName}/period-grouped. Retrieve an array of values for a metric for each organization in an enterprise, for a specific period, identified by its start date, grouped according to the groupBy field. The groupBy can be organization or a valid dimension for the requested metric. Notes: Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Retrieve metric values for a time range for all organizations in an enterprise via POST /enterprises/{provider}/{enterpriseName}/metrics/{metricName}/timerange. Retrieve a specific metric's values for each organization in an enterprise, for a given time range. The response includes values grouped by period date and optionally by an additional groupBy parameter. The groupBy can be organization or a valid dimension for the requested metric. Notes: Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Add an organization to Codacy via POST /organizations. Add an organization from a Git provider to Codacy Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

List AI inventory categories grouped by category group via POST /organizations/{provider}/{remoteOrganizationName}/ai-inventory/categories/search. Returns the available inventory categories grouped by their category group. Used to populate the Categories filter drawer Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

List AI inventory location summaries for an organization via POST /organizations/{provider}/{remoteOrganizationName}/ai-inventory/locations/summaries/search. Returns a paginated list of location summaries for an organization. Each summary represents a distinct location with an array of regions. Location is a URI with a couple custom protocols like repo-file and repo-sha. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

List AI inventory marker summaries for an organization via POST /organizations/{provider}/{remoteOrganizationName}/ai-inventory/markers/summaries/search. Returns a paginated list of marker summaries for an organization. Each summary represents a distinct inventory resource — a (categoryGroup, category, marker) grouping — with reference and repository counts. Typically called after picking a provider on the provider summaries view; scope the result by passing aiProviders (and/or categoryGroups for the tab filter) in the request body Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

List AI inventory provider summaries for an organization via POST /organizations/{provider}/{remoteOrganizationName}/ai-inventory/providers/summaries/search. Returns a paginated list of provider summaries for an organization. Each summary aggregates resources, references, and repositories for one AI provider, with a per-category-group repository breakdown Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Get AI inventory summary for a specific provider via POST /organizations/{provider}/{remoteOrganizationName}/ai-inventory/providers/summary. Returns the summary for a specific AI provider (resource, reference, and repository counts plus a per-category-group repository breakdown). The provider name is given in the request body since it may contain spaces or special characters (e.g. GPT Engineer) Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

List repositories that have AI inventory items via POST /organizations/{provider}/{remoteOrganizationName}/ai-inventory/repositories/search. Returns a paginated list of repositories that have AI inventory items for an organization. Used to populate the Repositories filter dropdown Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

List AI inventory repository summaries for an organization via POST /organizations/{provider}/{remoteOrganizationName}/ai-inventory/repositories/summaries/search. Returns a paginated list of repository summaries for an organization. Each summary aggregates resources, references, and AI provider counts for one repository, with a per-category-group reference breakdown Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Update the information about organization billing via POST /organizations/{provider}/{remoteOrganizationName}/billing. Update the information about organization billing Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Add a card to the organization via POST /organizations/{provider}/{remoteOrganizationName}/billing/card. Add a card to the organization relying on the token provided by Stripe /v1/tokens Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection. THE `cardToken` ARGUMENT IS A STRIPE CREDENTIAL, NOT A CODACY ONE: it is a single-use card token minted by Stripe's own /v1/tokens endpoint and passed through to Codacy. Do not invent or guess one -- only Stripe can produce a valid value, and anything else is refused. It is a payment credential: it will appear in this call's arguments.

Change the plan of an organization via POST /organizations/{provider}/{remoteOrganizationName}/billing/change-plan. Available plan codes can be retrieved using listPaymentPlans Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Sync the information about organization billing via POST /organizations/{provider}/{remoteOrganizationName}/billing/sync.

Create a draft coding standard for an organization via POST /organizations/{provider}/{remoteOrganizationName}/coding-standards. To promote the draft coding standard to an effective coding standard, see promoteDraftCodingStandard. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Duplicate a coding standard via POST /organizations/{provider}/{remoteOrganizationName}/coding-standards/{codingStandardId}/duplicate.

Promote a draft coding standard to an effective coding standard via POST /organizations/{provider}/{remoteOrganizationName}/coding-standards/{codingStandardId}/promote. If the draft coding standard is marked as default, it becomes the new default coding standard. The response includes the result of applying the coding standard to the repositories.

Set the default coding standard for an organization via POST /organizations/{provider}/{remoteOrganizationName}/coding-standards/{codingStandardId}/setDefault. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Bulk update the code patterns of a tool in a coding standard via POST /organizations/{provider}/{remoteOrganizationName}/coding-standards/{codingStandardId}/tools/{toolUuid}/patterns/update. Use filters to specify the code patterns to update, or omit the filters to update all code patterns. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Create a compliance standard for an organization via POST /organizations/{provider}/{remoteOrganizationName}/compliance-standards. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Create a DAST target via POST /organizations/{provider}/{remoteOrganizationName}/dast/targets. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection. THE `apiAuthHeaders` ARGUMENT IS A CREDENTIAL FOR THE TARGET BEING SCANNED, not for Codacy: it is a free-form map of HTTP headers that CODACY will send to the `url` you give it, so anything placed there (an Authorization header, an API key) is handed to that address on every scan. Set it only for a target you control.

Enqueue a DAST analysis for the given target via POST /organizations/{provider}/{remoteOrganizationName}/dast/targets/{dastTargetId}/analyze.

Create a gate policy via POST /organizations/{provider}/{remoteOrganizationName}/gate-policies. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Set the gate policy as the default for an organization via POST /organizations/{provider}/{remoteOrganizationName}/gate-policies/{gatePolicyId}/setDefault.

Set the built-in Codacy gate policy as the default for an organization via POST /organizations/{provider}/{remoteOrganizationName}/gate-policies/setCodacyDefault.

Create a Jira ticket via POST /organizations/{provider}/{remoteOrganizationName}/integrations/jira/tickets. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Apply default settings to all repositories via POST /organizations/{provider}/{remoteOrganizationName}/integrations/providerSettings/apply.

Add a webhook endpoint to the organization via POST /organizations/{provider}/{remoteOrganizationName}/integrations/webhooks. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection. RETURNS A LIVE SECRET IN THE RESULT: the value below is a real credential and is shown once. It will appear in this tool's output and in the conversation, it outlives this connection, and disconnecting Agentic Fabriq does not revoke it.

Join an organization via POST /organizations/{provider}/{remoteOrganizationName}/join. Endpoint to join an organization by provider and name

Update the join mode of an organization via POST /organizations/{provider}/{remoteOrganizationName}/joinMode. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Retrieve the latest value of a metric via POST /organizations/{provider}/{remoteOrganizationName}/metrics/{metricName}/latest. Retrieve the latest value for an aggregating metric (e.g., open issues). Note: It does not work for accumulating metrics, such as fixed issues Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Retrieve the latest metric values grouped by dimension via POST /organizations/{provider}/{remoteOrganizationName}/metrics/{metricName}/latest-grouped. Retrieve an array of the latest values for an aggregating metric, based on the groupBy options. The groupBy can be organization, repository, or a valid dimension for the requested metric. Note: Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Retrieve metric value for a specific period via POST /organizations/{provider}/{remoteOrganizationName}/metrics/{metricName}/period. Retrieve the value for a metric for a specific period, identified by its start date. Notes: Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Retrieve metric values for a specific period grouped by dimension via POST /organizations/{provider}/{remoteOrganizationName}/metrics/{metricName}/period-grouped. Retrieve an array of values for a metric for a specific period, identified by its start date, grouped according to the groupBy field. The groupBy can be organization, repository, or a valid dimension for the requested metric. Notes: Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Retrieve metric values for a time range via POST /organizations/{provider}/{remoteOrganizationName}/metrics/{metricName}/timerange. Retrieve a specific metric's values for a given time range. The response includes values grouped by period date and optionally by an additional groupBy parameter. The groupBy can be organization, repository, or a valid dimension for the requested metric. Notes: Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Start collecting metrics for an organization via POST /organizations/{provider}/{remoteOrganizationName}/metrics/start. Start data collection for missing metrics. The organization must have metrics support enabled. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Add people to organization via POST /organizations/{provider}/{remoteOrganizationName}/people. Add people to organization as members or committers (depending if they have a pending request already) Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Remove people from an organization via POST /organizations/{provider}/{remoteOrganizationName}/people/remove. Remove people from an organization Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Create a coding standard for an organization choosing from a series of presets via POST /organizations/{provider}/{remoteOrganizationName}/presets-standards. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Set branch as default via POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/branches/{branchName}/setDefault. Sets the default branch for a repository. The new default branch must already be enabled on Codacy.

Follow a repository that was already added to Codacy via POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/follow.

Create a Jira ticket via POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/integrations/jira/tickets. Deprecated: Use createJiraTicket instead. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Refresh the Git provider integration for a repository (GitLab and Bitbucket only) via POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/integrations/refreshProvider. Codacy will use the authenticated user to create comments on new pull requests

Reanalyze a specific commit in a repository via POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/reanalyzeCommit. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Reset quality settings for the commits of a repository to Codacy’s default values via POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/quality/commits/reset. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Reset quality settings for the pull requests of a repository to Codacy’s default values via POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/quality/pull-requests/reset. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Reset quality settings for the repository to Codacy’s default values via POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/quality/repository/reset. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Regenerate the SSH key that Codacy uses to clone the repository via POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/ssh-repository-key. Codacy automatically adds the new public SSH key to the repository on the Git provider.

Regenerate the user SSH key that Codacy uses to clone the repository via POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/ssh-user-key. Codacy automatically adds the new public user SSH key to the user account on the Git provider. Using a user SSH key is recommended if your repository includes submodules.

Synchronize repository name and visibility with Git provider via POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/sync.

Create a new repository API token via POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tokens. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection. RETURNS A LIVE SECRET IN THE RESULT: the value below is a real credential and is shown once. It will appear in this tool's output and in the conversation, it outlives this connection, and disconnecting Agentic Fabriq does not revoke it.

Delete multiple repository API tokens by id via POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tokens/delete. Deletes the repository API tokens with the given ids Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Return a paginated list of repositories where a version of the specified SBOM dependency is used via POST /organizations/{provider}/{remoteOrganizationName}/sbom/dependencies/repositories/search. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Return a list of SBOM dependencies, used across the organization via POST /organizations/{provider}/{remoteOrganizationName}/sbom/dependencies/search. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

List repositories with SBOM dependency information via POST /organizations/{provider}/{remoteOrganizationName}/sbom/repositories/search. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Get metrics for the security and risk management dashboard via POST /organizations/{provider}/{remoteOrganizationName}/security/dashboard. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

List security categories with findings via POST /organizations/{provider}/{remoteOrganizationName}/security/dashboard/categories/search. If no filter is specified, only the 10 categories with the most findings are returned. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Get the evolution of security findings over time via POST /organizations/{provider}/{remoteOrganizationName}/security/dashboard/history/search. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

List repositories with security findings via POST /organizations/{provider}/{remoteOrganizationName}/security/dashboard/repositories/search. If no filter is specified, only the 10 repositories with the most findings are returned. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Ignore a single item with an optional comment via POST /organizations/{provider}/{remoteOrganizationName}/security/items/{srmItemId}/ignore. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Unignore a single item (only previously ignored items can be unignored) via POST /organizations/{provider}/{remoteOrganizationName}/security/items/{srmItemId}/unignore.

List security and risk management items for an organization via POST /organizations/{provider}/{remoteOrganizationName}/security/items/search. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Assign the Security Manager role to an organization member via POST /organizations/{provider}/{remoteOrganizationName}/security/managers. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Synchronize the segments of the organization with the Git provider via POST /organizations/{provider}/{remoteOrganizationName}/segments/sync. For GitHub, segments are the repository custom properties

Synchronize Codacy organization name with the Git provider via POST /organizations/{provider}/{remoteOrganizationName}/settings/sync.

Create a pull request adding the Codacy analysis badge to the repository via POST /organizations/gh/{remoteOrganizationName}/repositories/{repositoryName}/badge. Creates a pull request adding the Codacy static code analysis badge to the README of the GitHub repository if the repository is public and doesn't already have a badge. Note: The pull request is created asynchronously and may fail even if this endpoint responds successfully.

Search SBOM dependencies for the organization in CSV format via POST /reports/organizations/{provider}/{remoteOrganizationName}/sbom/dependencies/search. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Generate a filtered CSV export of security and risk management items via POST /reports/organizations/{provider}/{remoteOrganizationName}/security/items/search. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Add a repository to Codacy via POST /repositories. Add a new repository to an existing organization on Codacy Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Search organization repositories with analysis information for the authenticated user via POST /search/analysis/organizations/{provider}/{remoteOrganizationName}/repositories. For Bitbucket, you must URL encode the cursor before using it in subsequent API calls, as the pagination comes directly from the Git provider. Paginated: pass `cursor` from the previous response's pagination block to read the next batch, and `limit` to size it. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Get the OSSF Scorecard for a repository via POST /security/dependencies/ossf/scorecard. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Send a heartbeat to keep the session alive via POST /session/heartbeat. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection. NOT REACHABLE WITH AN API TOKEN, measured 2026-09-24: this endpoint keeps a BROWSER session alive and answers 400 'Session is not cookie-based.' to any request authenticated with an account API token, which is the only credential this integration holds. It is shipped because Codacy documents it, not because it can succeed here.

Add feedback relating to the tool pattern via POST /tools/{toolUuid}/patterns/{patternId}/organizations/{provider}/{remoteOrganizationName}/feedback. Add feedback relating to the tool pattern. Codacy documents this operation as requiring no authentication, so a successful result may not depend on this connection's credential. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Sync the information about user's organization billing via POST /user/billing/sync.

Remove an email from user account via POST /user/emails/remove. Removes the specified email address from the authenticated user's account. The primary/default email cannot be removed. A user must always have at least one email address associated with their account. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection. DESTRUCTIVE and not undoable through this API: Codacy publishes no restore endpoint for what this removes.

Set an email as default via POST /user/emails/set-default. Designates the specified email as the default email for the authenticated user. This operation will automatically remove the default status from any previously default email. Only one email can be default at any time. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Create a new account API token for the authenticated user via POST /user/tokens. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection. RETURNS A LIVE SECRET IN THE RESULT: the value below is a real credential and is shown once. It will appear in this tool's output and in the conversation, it outlives this connection, and disconnecting Agentic Fabriq does not revoke it.

Apply a gate policy to a list of repositories via PUT /organizations/{provider}/{remoteOrganizationName}/gate-policies/{gatePolicyId}/repositories. Link or unlink a gate policy to a list of repositories. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Create or update the Jira integration of the organization via PUT /organizations/{provider}/{remoteOrganizationName}/integrations/jira. THE `oauthCode` ARGUMENT IS ATLASSIAN'S, NOT CODACY'S: it is a single-use OAuth authorization code obtained by the customer while installing Codacy's Jira App, and it authenticates them to Atlassian. It cannot be invented, and it is the only 'oauth' anywhere in Codacy's API -- Codacy itself publishes no OAuth flow.

Create or update the Slack integration of the organization via PUT /organizations/{provider}/{remoteOrganizationName}/integrations/slack. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Update quality settings for the commits of a repository via PUT /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/quality/commits. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Update quality settings for the pull requests of a repository via PUT /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/quality/pull-requests. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Update quality goals settings for the specific repository via PUT /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/settings/quality/repository. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.

Update the SLA configuration for an organization via PUT /organizations/{provider}/{remoteOrganizationName}/security/sla. Codacy parses the request body BEFORE it checks the credential on many operations, so a 400 'DecodingFailure' from this tool is a complaint about the body and says nothing about the connection.