LGTM API specification

Name: LGTM API specification API
Brand: LGTM API specification
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityVulnerability Managementbearer29 EndpointsREST

For Agents

Run CodeQL analyses, trigger code reviews on patches, submit query jobs, and manage projects and snapshots on the LGTM code-analysis platform.

Install Jentic One Beta

Connect the LGTM API specification to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the LGTM API specification, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with LGTM API specification API.

Add and remove analysed projects via POST /projects and DELETE /projects/{project-id}

Trigger analysis of a specific commit through POST /analyses/{project-id} and inspect alerts via GET /analyses/{analysis-id}/alerts

Run code review on a patch with POST /codereviews/{project-id} and retrieve results from GET /codereviews/{review-id}

GET STARTED

Start building with LGTM API specification API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI specification for LGTM API specification, keeping it validated and agent-ready. LGTM is the code-analysis platform from Semmle that runs CodeQL queries to find security vulnerabilities and code-quality issues across open-source and enterprise projects. The 29-endpoint REST API lets developers add and configure projects, trigger and inspect analyses, run code reviews on patches, submit CodeQL query jobs, manage CodeQL database snapshots, and check long-running operation status. It is the programmatic surface for integrating LGTM analysis into custom CI flows and enterprise governance.

Use Cases

Patterns agents use LGTM API specification API for, with concrete tasks.

★ CI-gated security analysis on commits

Engineering teams plug LGTM into their CI pipeline to run CodeQL on every meaningful commit. The CI step calls POST /analyses/{project-id} with the commit id, polls GET /analyses/{analysis-id}, then pulls /analyses/{analysis-id}/alerts to surface new vulnerabilities directly in the PR. This catches taint-flow and injection bugs before merge rather than at quarterly review.

Trigger POST /analyses/{project-id} with commit_id 'a1b2c3d', poll GET /analyses/{analysis-id} until complete, and post any alerts as PR comments.

Pre-merge code review on patches

Reviewers want a second machine opinion before approving a patch. POST /codereviews/{project-id} runs CodeQL against the patch and GET /codereviews/{review-id} returns the diff-scoped alerts. Reviewers see only issues introduced or affected by this change, focusing the conversation on what the patch actually does.

Submit a patch via POST /codereviews/{project-id}, then GET /codereviews/{review-id} once complete and return only the alerts introduced by the patch.

Cross-project CodeQL queries for security research

Security researchers run a single CodeQL query across many projects to study the prevalence of a vulnerability pattern. POST /queryjobs submits the query, GET /queryjobs/{queryjob-id}/results returns a summary, and per-project results come from GET /queryjobs/{queryjob-id}/results/{project-id}. This is the programmatic equivalent of variant analysis at scale.

POST /queryjobs with a CodeQL query and a list of project-ids, then walk GET /queryjobs/{queryjob-id}/results to enumerate findings per project.

AI agent vulnerability triage via Jentic

An AI security agent triages new alerts every morning. Through Jentic the agent searches for 'list new code analysis alerts' or 'trigger an analysis', loads the matching LGTM operation, and executes with the access token held in the Jentic vault. Findings are summarised and routed to the owning team without raw bearer tokens ever entering agent context.

Use Jentic to search 'get analysis alerts for a project', load GET /analyses/{analysis-id}/alerts, and summarise the new high-severity alerts since yesterday.

Key Endpoints

29 endpoints — jentic publishes the only available openapi specification for lgtm api specification, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/analyses/{project-id}

Run analysis of a specific commit.

GET

/analyses/{analysis-id}/alerts

Get detailed alerts for an analysis.

POST

/codereviews/{project-id}

Run code review for a patch.

POST

/queryjobs

Submit a CodeQL query job.

GET

/queryjobs/{queryjob-id}/results

Get summary of query job results.

POST

/projects

Add a project to LGTM.

GET

/projects

List projects.

GET

/operations/{operation-id}

Get operation status.

POST

/analyses/{project-id}

Run analysis of a specific commit.

GET

/analyses/{analysis-id}/alerts

Get detailed alerts for an analysis.

POST

/codereviews/{project-id}

Run code review for a patch.

POST

/queryjobs

Submit a CodeQL query job.

GET

/queryjobs/{queryjob-id}/results

Get summary of query job results.

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

LGTM bearer access tokens are stored encrypted in the Jentic MAXsystem vault. Agents call /analyses, /codereviews, and /queryjobs under scoped access — raw bearer tokens never enter the agent's context or appear in logs.

Intent-based discovery

Agents search Jentic with phrases like 'analyse a commit for vulnerabilities' or 'run a CodeQL query across projects' and the platform returns the matching LGTM operation across the 29 endpoints with its full input schema.

Time to first call

Direct integration: 2-3 days handling token issuance, async operation polling on /operations, and snapshot upload/download flows. Through Jentic: under an hour to search, load, and execute the first analysis call.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

Snyk API

Developer-focused vulnerability scanner with a strong dependency-and-container story alongside SAST.

Choose Snyk when the priority is open-source dependency and container scanning; choose LGTM/CodeQL when the priority is deep dataflow SAST queries.

Alternative

SonarCloud API

Code-quality and security platform with rule-based static analysis across many languages.

Choose SonarCloud for broad code-quality coverage and quality gates; choose LGTM when you specifically need CodeQL's variant-analysis power.

Complementary

GitHub API

Source control and CI hub that hosts the projects LGTM analyses and where alerts are surfaced.

Use GitHub to drive PR comments and checks; use LGTM to produce the CodeQL findings that feed those checks.

FAQs

Specific to using LGTM API specification API through Jentic.

Why is there no official OpenAPI spec for LGTM API specification?

LGTM does not currently publish a maintained OpenAPI specification on its own domain. Jentic generates and maintains this spec so that AI agents and developers can call LGTM via structured tooling. It is validated against the API surface and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the LGTM API specification use?

Calls are authenticated with an HTTP Bearer access token created in Account settings under 'Create token'. Enterprise users always need a token; LGTM.com users need one to submit CodeQL queries, request analyses, or check long-running operations. Through Jentic the access token is stored in the MAXsystem vault.

Can I trigger an analysis on a specific commit through this API?

Yes. POST /analyses/{project-id} accepts a commit id and queues a CodeQL analysis run. The response includes an analysis-id you can poll at GET /analyses/{analysis-id} and pull alerts from at GET /analyses/{analysis-id}/alerts when complete.

What are the rate limits for the LGTM API?

LGTM applies token-scoped rate limits but does not publish exact figures in the OpenAPI spec. Long-running work (analyses, query jobs) returns operation ids you can poll at GET /operations/{operation-id} rather than blocking, which is the recommended pattern for high-volume integrations.

How do I run a CodeQL query across multiple projects through Jentic?

Install with 'pip install jentic', search for 'run a CodeQL query against multiple projects', and Jentic returns POST /queryjobs. Load the schema, supply your CodeQL query and target project ids, and execute. Then poll GET /queryjobs/{queryjob-id} until results are ready.

Can I download CodeQL database snapshots with this API?

Yes. GET /snapshots/{project-id}/{language} downloads a snapshot for a specific language, and the /snapshots/uploads/{session-id} endpoints support uploading a database back to LGTM. This is how teams move CodeQL databases between LGTM and local CodeQL CLI workflows.