Programmatic access to QorTrace for CI pipelines and automation.
Status: scaffold. Full SDK ships in v0.3 alongside the Aptos / Sui Move detector pack.
The QorTrace REST API is fully usable today; the SDKs below are thin wrappers that handle auth, retries, polling, and webhook signature verification for you.
Authentication
All API calls require a per-account API key (issuable from /account/settings/api-keys once shipped). Include it as Authorization: Bearer <key> on every request.
Python (qortrace — coming v0.3)
PYTHON
from qortrace import Client
qt = Client(api_key="qt_live_…")
# Submit an audit
audit = qt.audits.submit(
project_name="Pulse DEX v2",
chain="ethereum",
source_url="https://github.com/example/pulse-dex-v2",
tier="standard",
)
print(audit.id, audit.status)
# Poll until delivered
audit = qt.audits.wait(audit.id, timeout=600)
print(audit.security_score, audit.trust_score)
# Pull report
qt.audits.download_report(audit.id, path="./pulse-dex-v2.pdf")
TypeScript / JavaScript (@qortrace/sdk — coming v0.3)
TS
import { QorTrace } from "@qortrace/sdk";
const qt = new QorTrace({ apiKey: process.env.QT_API_KEY });
const audit = await qt.audits.submit({
projectName: "Pulse DEX v2",
chain: "ethereum",
sourceUrl: "https://github.com/example/pulse-dex-v2",
tier: "deep_dive",
});
const final = await qt.audits.wait(audit.id);
console.log(final.securityScore, final.trustScore);
CI integration (today, no SDK needed)
YAML
# .github/workflows/audit.yml
- name: QorTrace audit
run: |
curl -X POST https://qortrace.com/api/audit/submit \
-H "Authorization: Bearer $QT_API_KEY" \
-H "Content-Type: application/json" \
-d "{\"project_name\": \"${{ github.event.repository.name }}\", \
\"source_url\": \"${{ github.event.repository.clone_url }}\", \
\"chain\": \"ethereum\", \"tier\": \"standard\"}"
Webhooks
Configure delivery webhooks from /account/webhooks. Every event is HMAC-SHA256 signed; verify the X-QorTrace-Signature header against your endpoint secret.
Event types:
audit.delivered— final report ready.audit.dispute_opened— a finding is being contested.payment.succeeded/payment.failed— Stripe webhook mirror.