Run MindFort in CI/CD pipelines

Integrate MindFort into your CI/CD pipelines to request security assessments on configured push, pull request, or deployment events. This helps make security testing a regular part of your development workflow.

Prerequisites

Before configuring your pipeline, you’ll need:

API Key — Generate one from the MindFort Dashboard under Settings > API Keys.
Target ID — Find this in Target Inventory by clicking on the target you want to assess.

Store your API key as a secret in your CI/CD platform — never commit it to your repository.

GitHub Actions Examples

Trigger an Assessment

This example requests a security assessment against your target on pushes or PRs to main. Starting a run depends on target readiness, available credits, and whether another assessment is already running. Configure the assessment method with the MINDFORT_ASSESSMENT_METHOD variable (balanced, deep, or ultra). These map to the dashboard labels Balanced, Deep, and Ultra. Optionally set assessment_type to black-box (default) or white-box.

name: MindFort Security Assessment

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  mindfort-assessment:
    name: Trigger MindFort Assessment
    runs-on: ubuntu-latest
    steps:
      - name: Trigger Assessment
        id: trigger
        run: |
          RESPONSE=$(curl -s -w "\n%{http_code}" \
            -X POST "https://api.mindfort.app/v1/assessments/run" \
            -H "Authorization: Bearer ${{ secrets.MINDFORT_API_KEY }}" \
            -H "Content-Type: application/json" \
            -d '{
              "target_id": "${{ vars.MINDFORT_TARGET_ID }}",
              "assessment_method": "${{ vars.MINDFORT_ASSESSMENT_METHOD || 'balanced' }}"
            }')

          HTTP_CODE=$(echo "$RESPONSE" | tail -1)
          BODY=$(echo "$RESPONSE" | sed '$d')

          echo "status_code=$HTTP_CODE" >> "$GITHUB_OUTPUT"
          echo "response=$BODY" >> "$GITHUB_OUTPUT"

          if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
            echo "::error::MindFort API returned HTTP $HTTP_CODE: $BODY"
            exit 1
          fi

          ASSESSMENT_ID=$(echo "$BODY" | jq -r '.assessment_id')
          echo "assessment_id=$ASSESSMENT_ID" >> "$GITHUB_OUTPUT"
          echo "Assessment triggered: $ASSESSMENT_ID"

      - name: Summary
        if: always()
        run: |
          echo "### MindFort Assessment" >> "$GITHUB_STEP_SUMMARY"
          if [ "${{ steps.trigger.outputs.assessment_id }}" != "" ]; then
            echo "- **Assessment ID:** \`${{ steps.trigger.outputs.assessment_id }}\`" >> "$GITHUB_STEP_SUMMARY"
            echo "- **Status:** Triggered" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "- **Status:** Failed (HTTP ${{ steps.trigger.outputs.status_code }})" >> "$GITHUB_STEP_SUMMARY"
          fi

Required secrets and variables

Type	Name	Description
Secret	`MINDFORT_API_KEY`	Your MindFort API key
Variable	`MINDFORT_TARGET_ID`	UUID of the target to assess
Variable	`MINDFORT_ASSESSMENT_METHOD`	Optional — `balanced` (default), `deep`, or `ultra`

List Targets and Findings

Use the organization-wide endpoints when you want to discover targets first, then list findings across all targets or within one target. These endpoints use limit and offset pagination and include a total count.

curl -G "https://api.mindfort.app/v1/targets" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}" \
  --data-urlencode "limit=25"

curl -G "https://api.mindfort.app/v1/findings" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}" \
  --data-urlencode "target_id=${MINDFORT_TARGET_ID}" \
  --data-urlencode "status=ACTIVE" \
  --data-urlencode "exclude_secured=true" \
  --data-urlencode "severity=critical" \
  --data-urlencode "sort_by=severity" \
  --data-urlencode "limit=25"

GET /v1/findings returns finding summaries with identifiers, target metadata, severity and any override, lifecycle status, timestamps, and retest state. The response includes total, limit, offset, and next_cursor pagination metadata. Defaults to status=ACTIVE; set exclude_secured=true to match the dashboard Open tab (vulnerabilities only). Use assessment_id to scope to one assessment run. See Findings API for all filters. Use GET /v1/findings/{finding_id} to fetch full details, including description, impact, evidence, approach, and remediation_advice.

Cancel an Assessment

Use the assessment_id returned by POST /v1/assessments/run or copied from the Assessments page.

curl -X POST "https://api.mindfort.app/v1/assessments/${MINDFORT_ASSESSMENT_ID}/cancel" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}"

The endpoint accepts no request body.

Poll Assessment Progress

Use the assessment detail endpoint when a pipeline needs stage-level progress or a terminal failure reason:

curl "https://api.mindfort.app/v1/assessments/${MINDFORT_ASSESSMENT_ID}" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}"

Use stage_progress to track each assessment stage. NOT_STARTED means no state has been recorded; RUNNING or ACTIVE indicates current work. Failed assessments may include a failure_reason explaining the problem. If assessment creation fails, inspect the stable public error code. For example, assessment_credits_insufficient distinguishes billing capacity from authorization, while assessment_queue_loading is retryable and includes Retry-After.

Update Finding Status

Use status updates to keep triage state in sync from automation. When resolving, you can include resolve_reason (FIX or WONT_FIX) and optional resolve_context.

curl -X POST "https://api.mindfort.app/v1/findings/${MINDFORT_FINDING_ID}/status" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"status":"RESOLVED","resolve_reason":"FIX"}'

Valid status values are ACTIVE, RESOLVED, and ARCHIVED.

Generate a Report

Create a report for a target, then poll status and download when ready.

curl -X POST "https://api.mindfort.app/v1/reports" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "target_id": "'"${MINDFORT_TARGET_ID}"'",
    "include_secured_findings": true,
    "include_resolved_findings": false,
    "report_detail_level": "full"
  }'

curl "https://api.mindfort.app/v1/reports/${MINDFORT_REPORT_ID}" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}"

curl "https://api.mindfort.app/v1/reports/${MINDFORT_REPORT_ID}/download" \
  -H "Authorization: Bearer ${MINDFORT_API_KEY}"

Overview

Endpoints

Prerequisites

GitHub Actions Examples

Trigger an Assessment

List Targets and Findings

Cancel an Assessment

Poll Assessment Progress

Update Finding Status

Generate a Report

​Prerequisites

​GitHub Actions Examples

​Trigger an Assessment

​List Targets and Findings

​Cancel an Assessment

​Poll Assessment Progress

​Update Finding Status

​Generate a Report

Prerequisites

GitHub Actions Examples

Trigger an Assessment

List Targets and Findings

Cancel an Assessment

Poll Assessment Progress

Update Finding Status

Generate a Report