Validate a rule against example code
curl --request POST \
--url https://semgrep.dev/api/run \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"pattern": "<string>",
"target": "<string>",
"language": "<string>",
"isDeep": true,
"isDebug": true
}
'import requests
url = "https://semgrep.dev/api/run"
payload = {
"pattern": "<string>",
"target": "<string>",
"language": "<string>",
"isDeep": True,
"isDebug": True
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
pattern: '<string>',
target: '<string>',
language: '<string>',
isDeep: true,
isDebug: true
})
};
fetch('https://semgrep.dev/api/run', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://semgrep.dev/api/run",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'pattern' => '<string>',
'target' => '<string>',
'language' => '<string>',
'isDeep' => true,
'isDebug' => true
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://semgrep.dev/api/run"
payload := strings.NewReader("{\n \"pattern\": \"<string>\",\n \"target\": \"<string>\",\n \"language\": \"<string>\",\n \"isDeep\": true,\n \"isDebug\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://semgrep.dev/api/run")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"pattern\": \"<string>\",\n \"target\": \"<string>\",\n \"language\": \"<string>\",\n \"isDeep\": true,\n \"isDebug\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://semgrep.dev/api/run")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"pattern\": \"<string>\",\n \"target\": \"<string>\",\n \"language\": \"<string>\",\n \"isDeep\": true,\n \"isDebug\": true\n}"
response = http.request(request)
puts response.read_body{
"semgrep_result": {
"status_code": 123,
"output": {},
"run_error": {
"message": "<string>",
"type": "<string>",
"extra": {},
"uid": "<string>"
},
"run_time": 123,
"environment": "<string>"
},
"test_result": [
{
"must_match": true,
"line_no": 123,
"rule_id": "<string>",
"status": "<string>",
"message": "<string>"
}
],
"ai_autofixes": [
"<string>"
]
}Editor
Validate a rule against example code
Execute a Semgrep pattern or YAML rule against supplied target code. Include positive ruleid and negative ok test annotations to validate examples. Inspect semgrep_result for execution errors and test_result for individual test outcomes; HTTP success alone does not mean the rule or examples passed. This runs on the hosted playground, not in the caller’s local repository.
POST
/
api
/
run
Validate a rule against example code
curl --request POST \
--url https://semgrep.dev/api/run \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"pattern": "<string>",
"target": "<string>",
"language": "<string>",
"isDeep": true,
"isDebug": true
}
'import requests
url = "https://semgrep.dev/api/run"
payload = {
"pattern": "<string>",
"target": "<string>",
"language": "<string>",
"isDeep": True,
"isDebug": True
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
pattern: '<string>',
target: '<string>',
language: '<string>',
isDeep: true,
isDebug: true
})
};
fetch('https://semgrep.dev/api/run', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://semgrep.dev/api/run",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'pattern' => '<string>',
'target' => '<string>',
'language' => '<string>',
'isDeep' => true,
'isDebug' => true
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://semgrep.dev/api/run"
payload := strings.NewReader("{\n \"pattern\": \"<string>\",\n \"target\": \"<string>\",\n \"language\": \"<string>\",\n \"isDeep\": true,\n \"isDebug\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://semgrep.dev/api/run")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"pattern\": \"<string>\",\n \"target\": \"<string>\",\n \"language\": \"<string>\",\n \"isDeep\": true,\n \"isDebug\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://semgrep.dev/api/run")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"pattern\": \"<string>\",\n \"target\": \"<string>\",\n \"language\": \"<string>\",\n \"isDeep\": true,\n \"isDebug\": true\n}"
response = http.request(request)
puts response.read_body{
"semgrep_result": {
"status_code": 123,
"output": {},
"run_error": {
"message": "<string>",
"type": "<string>",
"extra": {},
"uid": "<string>"
},
"run_time": 123,
"environment": "<string>"
},
"test_result": [
{
"must_match": true,
"line_no": 123,
"rule_id": "<string>",
"status": "<string>",
"message": "<string>"
}
],
"ai_autofixes": [
"<string>"
]
}This endpoint is experimental. It may change or be removed without notice and is not covered by API stability guarantees.
Authorizations
Get access to data with your user's JSON Web Token.
Was this page helpful?