Platform API

Overview

The Axiomatic platform exposes an API for syncing test results, querying run history, and managing repositories. The API is used internally by the CLI's axm sync command and the GitHub Action's optional dashboard sync.

Authentication

All API requests require a Bearer token. Authenticate via axm login to obtain a token, which is stored at ~/.axiomatic/credentials.

curl -H "Authorization: Bearer $TOKEN" \
  https://axiomatic.sh/api/results

Endpoints

List Runs

GET /v1/runs

Returns a paginated list of test runs for repositories accessible to the authenticated user.

Get Run

GET /v1/runs/:id

Returns details for a specific run, including per-test results, violations, and agent reasoning.

Sync Results

POST /v1/runs

Upload test results from a local or CI run. This is what axm sync and the GitHub Action call internally. Any authenticated user can upload results for a repository -- the first upload creates the repository record on the platform.

List Repositories

GET /v1/repos

Returns all repositories with test results on the platform. When the GitHub App is installed, access is determined by GitHub collaborator permissions -- you see repos you have access to on GitHub.

List Library Packs

GET /api/library

Returns a list of all available test packs in the Axiomatic library. No authentication required.

Response:

{
  "success": true,
  "data": [
    {
      "name": "owasp-security",
      "title": "OWASP Security",
      "description": "Security tests based on the OWASP Top 10",
      "tags": ["security"],
      "testCount": 5
    }
  ]
}

Get Library Pack

GET /api/library/:packName

Returns a specific pack including all test definitions. No authentication required. Used by axm install to fetch pack contents.

Response (200):

{
  "success": true,
  "data": {
    "name": "owasp-security",
    "title": "OWASP Security",
    "description": "Security tests based on the OWASP Top 10",
    "tags": ["security"],
    "tests": [
      {
        "name": "no-sql-injection",
        "condition": "No raw SQL queries with string concatenation...",
        "on": ["**/*.ts"],
        "severity": "error",
        "tags": ["security"]
      }
    ]
  }
}

Response (404):

{
  "success": false,
  "error": { "code": "NOT_FOUND", "message": "Pack \"foo\" not found" }
}

Check LLM Credits

GET /api/lm/credits

Returns the authenticated user's LLM credit balance, usage, and reset date. Requires API token authentication (Authorization: Bearer <token>).

Response:

{
  "success": true,
  "data": {
    "remaining": 4.82,
    "used": 0.18,
    "total": 5.0,
    "hasCredits": true,
    "periodStart": "2026-03-01T00:00:00.000Z",
    "resetDate": "2026-03-31T00:00:00.000Z",
    "plan": "free"
  }
}

Get Usage History

GET /api/lm/usage

Returns the most recent 50 LLM usage log entries for the authenticated user. Requires session authentication (web dashboard).

Response:

{
  "success": true,
  "data": [
    {
      "id": "abc123",
      "model": "claude-sonnet-4-6",
      "inputTokens": 1200,
      "outputTokens": 350,
      "costUsd": 0.0089,
      "date": "2026-03-15T10:30:00.000Z"
    }
  ]
}

LLM Proxy

POST /api/lm/v1/messages

Forwards requests to the Anthropic Messages API using platform-managed credentials. This is the endpoint the CLI calls when running tests with cloud credits (no local ANTHROPIC_API_KEY required). Requires API token authentication via Authorization: Bearer <token> or x-api-key header.

The proxy:

• Authenticates the user and checks remaining credit balance
• Forwards the request to https://api.anthropic.com/v1/messages (with streaming disabled)
• Calculates cost server-side from the Anthropic response usage fields
• Deducts the cost from the user's credit balance and logs the usage
• Returns the Anthropic response as-is

Error (402 -- credits exhausted):

{
  "type": "error",
  "error": {
    "type": "invalid_request_error",
    "message": "LLM credit limit reached ($5.00/month). Usage resets on 3/31/2026. Upgrade your plan or set a local ANTHROPIC_API_KEY to continue."
  }
}

Rate Limits

The API is rate-limited to 100 requests per minute per API key. The CLI handles rate limiting automatically with exponential backoff.

SDK

There is no standalone SDK at this time. Use the CLI (axm sync) or make HTTP requests directly. If you need programmatic access, axm run --json outputs structured results suitable for piping to other tools.