Run MindFort in CI/CD pipelines

Integrate MindFort into your CI/CD pipelines to automatically trigger security assessments on every push, pull request, or deployment. This ensures your applications are continuously tested for vulnerabilities as part of your development workflow.

Prerequisites

Before configuring your pipeline, you’ll need:

API Key — Generate one from the MindFort Dashboard under Settings > API Keys.
Target ID — Find this in Target Inventory by clicking on the target you want to assess.

Store your API key as a secret in your CI/CD platform — never commit it to your repository.

GitHub Actions Examples

Trigger an Assessment

Runs a security assessment against your target on every push or PR to main. Configure the assessment method with the MINDFORT_ASSESSMENT_METHOD variable (balanced, deep, or ultra). These map to the dashboard labels Balanced, Deep, and Ultra. Optionally set assessment_type to black-box (default) or white-box.

name: MindFort Security Assessment

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  mindfort-assessment:
    name: Trigger MindFort Assessment
    runs-on: ubuntu-latest
    steps:
      - name: Trigger Assessment
        id: trigger
        run: |
          RESPONSE=$(curl -s -w "\n%{http_code}" \
            -X POST "https://api.mindfort.app/v1/assessments/run" \
            -H "Authorization: Bearer ${{ secrets.MINDFORT_API_KEY }}" \
            -H "Content-Type: application/json" \
            -d '{
              "target_id": "${{ vars.MINDFORT_TARGET_ID }}",
              "assessment_method": "${{ vars.MINDFORT_ASSESSMENT_METHOD || 'balanced' }}"
            }')

          HTTP_CODE=$(echo "$RESPONSE" | tail -1)
          BODY=$(echo "$RESPONSE" | sed '$d')

          echo "status_code=$HTTP_CODE" >> "$GITHUB_OUTPUT"
          echo "response=$BODY" >> "$GITHUB_OUTPUT"

          if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
            echo "::error::MindFort API returned HTTP $HTTP_CODE: $BODY"
            exit 1
          fi

          ASSESSMENT_ID=$(echo "$BODY" | jq -r '.assessment_id')
          echo "assessment_id=$ASSESSMENT_ID" >> "$GITHUB_OUTPUT"
          echo "Assessment triggered: $ASSESSMENT_ID"

      - name: Summary
        if: always()
        run: |
          echo "### MindFort Assessment" >> "$GITHUB_STEP_SUMMARY"
          if [ "${{ steps.trigger.outputs.assessment_id }}" != "" ]; then
            echo "- **Assessment ID:** \`${{ steps.trigger.outputs.assessment_id }}\`" >> "$GITHUB_STEP_SUMMARY"
            echo "- **Status:** Triggered" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "- **Status:** Failed (HTTP ${{ steps.trigger.outputs.status_code }})" >> "$GITHUB_STEP_SUMMARY"
          fi

Required secrets and variables

Type	Name	Description
Secret	`MINDFORT_API_KEY`	Your MindFort API key
Variable	`MINDFORT_TARGET_ID`	UUID of the target to assess
Variable	`MINDFORT_ASSESSMENT_METHOD`	Optional — `balanced` (default), `deep`, or `ultra`

List Targets and Findings

Use the organization-wide endpoints when you want to discover targets first, then list findings across all targets or within one target. These endpoints use limit and offset pagination and include a total count.

curl -G "https://api.mindfort.app/v1/targets" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}" \
  --data-urlencode "limit=25"

curl -G "https://api.mindfort.app/v1/findings" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}" \
  --data-urlencode "target_id=${MINDFORT_TARGET_ID}" \
  --data-urlencode "status=ACTIVE" \
  --data-urlencode "exclude_secured=true" \
  --data-urlencode "severity=critical" \
  --data-urlencode "sort_by=severity" \
  --data-urlencode "limit=25"

GET /v1/findings returns finding summaries with identifiers, target metadata, severity and any override, lifecycle status, timestamps, and retest state. The response includes total, limit, offset, and next_cursor pagination metadata. Defaults to status=ACTIVE; set exclude_secured=true to match the dashboard Open tab (vulnerabilities only). Use assessment_id to scope to one assessment run. See Findings API for all filters. Use GET /v1/findings/{finding_id} to fetch full details, including description, impact, evidence, approach, and remediation_advice.

Cancel an Assessment

Use the assessment_id returned by POST /v1/assessments/run or copied from the Assessments page.

curl -X POST "https://api.mindfort.app/v1/assessments/${MINDFORT_ASSESSMENT_ID}/cancel" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}"

The endpoint accepts no request body.

Poll Assessment Progress

Use the assessment detail endpoint when a pipeline needs stage-level progress or a terminal failure reason:

curl "https://api.mindfort.app/v1/assessments/${MINDFORT_ASSESSMENT_ID}" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}"

The canonical stage_progress roster merges the expected plan with all recorded stages. NOT_STARTED means no state has been recorded; RUNNING or ACTIVE indicates current work. Failed assessments may include a bounded failure_reason. Internal workflow identifiers, prompts, and raw exceptions are not exposed. If assessment creation fails, inspect the stable public error code. For example, assessment_credits_insufficient distinguishes billing capacity from authorization, while assessment_queue_loading is retryable and includes Retry-After.

Update Finding Status

Use status updates to keep triage state in sync from automation. When resolving, you can include resolve_reason (FIX or WONT_FIX) and optional resolve_context.

curl -X POST "https://api.mindfort.app/v1/findings/${MINDFORT_FINDING_ID}/status" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"status":"RESOLVED","resolve_reason":"FIX"}'

Valid status values are ACTIVE, RESOLVED, and ARCHIVED.

Generate a Report

Create a report for a target, then poll status and download when ready.

curl -X POST "https://api.mindfort.app/v1/reports" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "target_id": "'"${MINDFORT_TARGET_ID}"'",
    "include_secured_findings": true,
    "include_resolved_findings": false,
    "report_detail_level": "full"
  }'

curl "https://api.mindfort.app/v1/reports/${MINDFORT_REPORT_ID}" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}"

curl "https://api.mindfort.app/v1/reports/${MINDFORT_REPORT_ID}/download" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}"

Overview

Endpoints

Prerequisites

GitHub Actions Examples

Trigger an Assessment

List Targets and Findings

Cancel an Assessment

Poll Assessment Progress

Update Finding Status

Generate a Report

​Prerequisites

​GitHub Actions Examples

​Trigger an Assessment

​List Targets and Findings

​Cancel an Assessment

​Poll Assessment Progress

​Update Finding Status

​Generate a Report

Prerequisites

GitHub Actions Examples

Trigger an Assessment

List Targets and Findings

Cancel an Assessment

Poll Assessment Progress

Update Finding Status

Generate a Report