API keys and API reviews
Last updated .
Can I start a MergeSafe review from CI or a script?
Yes: an organization Admin creates an API key in the app, and a POST to https://app.mergesafe.ai/api/v1/reviews with that key starts a review of a pull request, charged to the organization’s balance like any other review.
Creating a key
- In the app, under Settings → API keys. Only organization Admins can create them.
- Up to 10 active keys per organization. Keys start with
ms_live_. - The full key is shown once, when you create it. Store it as a secret in your CI.
- A key can only start reviews.
Starting a review
curl -X POST https://app.mergesafe.ai/api/v1/reviews \
-H "Authorization: Bearer $MERGESAFE_API_KEY" \
-H "Content-Type: application/json" \
-d '{"repo": "owner/name", "pr_number": 123}'- The review covers the pull request’s latest commit and everything not yet reviewed.
- Leave out the level and the repository’s own level is used. Add
"tier"(budget,strongorultra) and"addons"(expert_security,expert_logic) to use them for this one review only, for example a single Ultra review of a risky change. - A pull request too large for the normal budget waits for consent. Add
"large": true, with a"tier", to consent for this one review: it costs its level’s price plus half the tier’s base price (Strong: $0.675 instead of $0.45; add-ons as usual). The key consents on behalf of the person who created it, so that person must be on the repository’s review list or a repository admin; otherwise the review keeps waiting. - A
202answer means the review is queued, and says which level will run. - A commit that was already reviewed is refused and not charged.
- Up to 30 requests a minute per key.
The full reference, with every field and error code, is in the app under API docs.
Works with manual-only
With manual-only mode, nothing is reviewed until your tooling asks, for example a CI step that runs once tests pass.