CodeScan API

Name: CodeScan API
Brand: CodeScan API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentDeveloper ToolsTesting Qabasic2 EndpointsREST

For Agents

Submit and check the status of CodeScan code-quality and security scan jobs for Salesforce projects.

Install Jentic One Beta

Connect the CodeScan API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the CodeScan API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with CodeScan API.

Submit a CodeScan scan job for a Salesforce codebase from an external CI or pipeline

Check the status and result of a previously submitted scan job

Drive scan execution from a non-UI workflow such as a custom DevOps pipeline

GET STARTED

Start building with CodeScan API

Explore with Jentic

View OpenAPI Document

Use Cases

Patterns agents use CodeScan API for, with concrete tasks.

★ Salesforce CI Quality Gate

DevOps teams running Salesforce projects use the CodeScan API to drive scans from their own CI system rather than the CodeScan UI. The CI submits a scan via POST /job and polls the job endpoint for completion, failing the build if the scan returns new violations. This keeps the quality gate in the team's primary pipeline without forcing engineers to switch tools.

Submit a new CodeScan job for the project, poll the job endpoint until the scan completes, and report the result to the CI runner.

Pull Request Code Review Automation

Engineering teams trigger a CodeScan run on every Salesforce pull request to surface new code-quality and security issues before merge. The /job endpoint accepts the scan submission and exposes status retrieval so the PR check can wait for results and post a summary back to the developer.

Trigger a CodeScan job for the PR branch, wait for completion, and summarise the result for the PR comment.

Scheduled Codebase Health Reports

Platform teams schedule a nightly CodeScan run to track Salesforce codebase health over time. The API submission and status endpoints let an automation kick off the scan and store the outcome in a metrics dashboard so the team sees trends in violations, complexity, and security findings.

Run a CodeScan job nightly at 02:00 and persist the job outcome to the engineering metrics dashboard.

AI Agent Code Review Assistant

AI agents helping Salesforce developers use the CodeScan API through Jentic to fetch fresh scan results before reviewing code. The agent searches Jentic for 'submit a CodeScan job', loads the operation, runs the scan, and waits for the result. Jentic stores the CodeScan basic-auth credentials in its vault so the subscription ID and API key never enter the agent's context.

Search Jentic for 'codescan job', load the POST /job operation, submit a scan, then check status until complete.

Key Endpoints

2 endpoints — codescan is a hosted salesforce code-quality and security scanning service.

METHOD

PATH

DESCRIPTION

POST

/job

Submit a new CodeScan scan job

GET

/job

Read the status and outcome of an existing job

POST

/job

Submit a new CodeScan scan job

GET

/job

Read the status and outcome of an existing job

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

CodeScan's Basic auth Subscription ID and API key are stored encrypted in the Jentic vault. Agents receive a scoped execution token; Jentic builds the Authorization header at execution time so the credentials never enter the agent runtime.

Intent-based discovery

Agents search Jentic by intent (e.g. 'submit a Salesforce code scan') and Jentic returns the matching CodeScan operation with its input schema.

Time to first call

Direct CodeScan integration: a few hours for auth and polling. Through Jentic: under 30 minutes — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

GitHub REST API

Hosts the Salesforce repository that CodeScan scans and exposes PR check APIs

Use GitHub when the agent needs to read repository or pull request data; use CodeScan when the agent needs to run a Salesforce-specific scan.

Alternative

SonarCloud

General-purpose hosted code quality and security scanning

Choose SonarCloud for multi-language quality scanning; choose CodeScan for Salesforce-specific scanning with PMD and Apex rules.

Alternative

Snyk API

Security-focused vulnerability scanning across many ecosystems

Use Snyk when the agent needs dependency or vulnerability scanning; use CodeScan when the focus is Salesforce code quality and security.

FAQs

Specific to using CodeScan API through Jentic.

What authentication does the CodeScan API use?

The API uses HTTP Basic authentication. The username is your CodeScan Subscription ID and the password is the API key from your subscription page. The single security scheme in the spec is named codescan_auth. Through Jentic, both values are stored encrypted in the vault and the Authorization header is constructed at execution time.

Can I trigger a CodeScan scan from CI with the CodeScan API?

Yes. POST /job submits a new scan job and GET /job retrieves status, so a CI runner can trigger a scan and poll until completion. This is the supported integration path for teams that want CodeScan to run inside their own pipeline rather than the CodeScan UI.

What are the rate limits for the CodeScan API?

The OpenAPI spec does not declare a fixed rate limit. CodeScan's job concurrency is governed by your subscription tier; if you submit more concurrent scans than the subscription allows the API returns an error indicating the limit. Check your CodeScan subscription page for the current concurrency.

How do I submit a scan job through Jentic?

Search Jentic for 'codescan submit job', load the POST /job operation, and execute it with the required job inputs. Install with pip install jentic and use the standard async search, load, and execute flow.

Does the CodeScan API expose individual violation details?

The public OpenAPI spec exposes only the /job resource with submit and status operations. Detailed violation listings are surfaced through the CodeScan web UI and reports rather than this API surface, so use /job for orchestration and the UI or downloadable reports for per-violation review.