Quickstart

Install

npm install --save-dev @patchlight/sdk

Create an API key

In the dashboard, open App → API Keys and create one. Copy the secret — it is shown only once.

export PATCHLIGHT_API_KEY=pl_sk_...

Submit a review

review.ts

import { createClient } from "@patchlight/sdk";

const client = createClient({ apiKey: process.env.PATCHLIGHT_API_KEY! });

const { id } = await client.createReview({
  repo: "acme/checkout-service",   // any name — groups reviews in the dashboard
  diff: myUnifiedDiff,             // unified diff text, from git or anywhere else
});

// Polls until the review settles; throws on failure or timeout.
const review = await client.waitForReview(id);
console.log(review.summary);

const { findings } = await client.getReviewFindings(id);
for (const f of findings) {
  console.log(`[${f.severity}] ${f.title} — ${f.filePath}:${f.line}`);
}

Three lines of that are the whole API. Everything else is optional context that makes the review better:

await client.createReview({
  repo: "acme/checkout-service",
  diff: myUnifiedDiff,
  files: {                          // contents of the changed files — worth passing
    "src/payment.ts": paymentSource,
  },
  ref: "9f2c1ab",                   // the reviewed commit
  baseRef: "main",                  // what the diff is against
  title: "Add 3DS fallback",
});

Or skip the code entirely

From any git checkout, the bundled CLI does all of the above for you — it works out the base branch, runs git diff, uploads the changed files as context, and prints the findings:

npx @patchlight/sdk review --wait

Add --fail-on high to exit non-zero when something severe turns up, which is how you gate a merge. See the CLI reference for every flag and CI/CD integration for ready-made pipeline jobs.

Scan a whole repository

Reviews read a diff. To scan an entire connected GitHub repository for vulnerabilities:

const repos = await client.listRepos();
const repo = repos.find((r) => r.fullName === "acme/checkout-service")!;

const { id } = await client.startScan(repo.id);
await client.waitForScan(id);

const { findings } = await client.getScanFindings(id);

Or, in one line:

patchlight scan acme/checkout-service --wait --fail-on high

Triage without opening the dashboard

const findings = await client.listFindings();

for (const f of findings.filter((f) => f.category === "style")) {
  await client.updateFinding(f.id, "dismissed");
}

updateFinding takes review and scan finding ids alike, so you never have to check which kind you are holding.

Full method list, option shapes, and error codes: Client reference.