Skip to content
Indiana
Dashboard
Docs
Browse docs / Submit a complete code-reference report

Submit a complete code-reference report

POST/api/v1/code-references

Merchant CI uses a dedicated code-references:write Key to atomically submit every current feature, including explicit empty results. Configuration, key set and workflow order must match; missing or failed scans never imply zero references. Retry the same saved report. No source text is uploaded, Feature content changed or archival triggered. Let the CLI generate the current timestamp, commit and scan ID.

API v1Updated

Make the request

Merchant CI uses a dedicated code-references:write Key to atomically submit every current feature, including explicit empty results. Configuration, key set and workflow order must match; missing or failed scans never imply zero references. Retry the same saved report. No source text is uploaded, Feature content changed or archival triggered. Let the CLI generate the current timestamp, commit and scan ID.

Credential
Server API key only. Call from your trusted backend.
Permission
code-references:write
Set the base URL and App ID from SDK setup. These examples use placeholders and do not execute requests. Never put a server key in browser code.
request.shShell
curl -X POST "$INDIANA_BASE_URL/api/v1/code-references" \  -H "Authorization: Bearer $INDIANA_CODE_REFERENCES_KEY" \  -H "X-Indiana-Project: $INDIANA_PROJECT_ID" \  -H "X-Indiana-Protocol: 0.5" \  -H "X-Indiana-Environment: sandbox" \  -H "Content-Type: application/json" \  -d '{  "protocol": 1,  "repositoryId": "00000000-0000-4000-8000-000000000001",  "branch": "main",  "workflow": ".github/workflows/indiana-code-references.yml",  "configurationRevision": 1,  "keySetHash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",  "commit": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",  "scanId": "00000000-0000-4000-8000-000000000001",  "runNumber": 12,  "runAttempt": 1,  "scannerVersion": "1",  "scannedAt": "2026-10-03T12:00:00.000Z",  "coverage": {    "complete": true,    "files": 1,    "sourceBytes": 96,    "unresolvedCalls": 0,    "unsupportedFiles": 0  },  "features": [    {      "key": "new_checkout",      "refs": [        {          "filePath": "src/checkout.ts",          "startingLineNumber": 12        }      ]    },    {      "key": "unused_flag",      "refs": []    }  ]}'

The response is illustrative, not the result of a live request.

Request parameters

JSON body

protocol1Required

The protocol value for this operation. Its accepted type and constraints are listed above and below.

repositoryIduuidRequired

The repositoryId value for this operation. Its accepted type and constraints are listed above and below.

branchstringRequired

The branch value for this operation. Its accepted type and constraints are listed above and below.

minLength: 1 · maxLength: 200 · pattern: ^[a-zA-Z0-9_./-]+$

workflowstringRequired

The workflow value for this operation. Its accepted type and constraints are listed above and below.

maxLength: 200

configurationRevisionintegerRequired

The configurationRevision value for this operation. Its accepted type and constraints are listed above and below.

max: 9007199254740991

keySetHashstringRequired

The keySetHash value for this operation. Its accepted type and constraints are listed above and below.

pattern: ^[a-f0-9]{64}$

commitstringRequired

The commit value for this operation. Its accepted type and constraints are listed above and below.

pattern: ^(?:[a-f0-9]{40}|[a-f0-9]{64})$

scanIduuidRequired

The scanId value for this operation. Its accepted type and constraints are listed above and below.

runNumberintegerRequired

The runNumber value for this operation. Its accepted type and constraints are listed above and below.

min: 1 · max: 9007199254740991

runAttemptintegerRequired

The runAttempt value for this operation. Its accepted type and constraints are listed above and below.

min: 1 · max: 10000

scannerVersion"1"Required

The scannerVersion value for this operation. Its accepted type and constraints are listed above and below.

scannedAtdate-timeRequired

The scannedAt value for this operation. Its accepted type and constraints are listed above and below.

coverageobjectRequired

The coverage value for this operation. Its accepted type and constraints are listed above and below.

Show child fields
completetrueRequired

The complete value for this operation. Its accepted type and constraints are listed above and below.

filesintegerRequired

The files value for this operation. Its accepted type and constraints are listed above and below.

min: 0 · max: 10000

sourceBytesintegerRequired

The sourceBytes value for this operation. Its accepted type and constraints are listed above and below.

min: 0 · max: 100000000

unresolvedCallsintegerRequired

The unresolvedCalls value for this operation. Its accepted type and constraints are listed above and below.

min: 0 · max: 1000000

unsupportedFilesintegerRequired

The unsupportedFiles value for this operation. Its accepted type and constraints are listed above and below.

min: 0 · max: 10000

featuresarrayRequired

The features value for this operation. Its accepted type and constraints are listed above and below.

maxItems: 2000

Show child fields
keystringRequired

The key value for this operation. Its accepted type and constraints are listed above and below.

pattern: ^[a-zA-Z0-9_.:|-]{1,256}$

refsarrayRequired

The refs value for this operation. Its accepted type and constraints are listed above and below.

maxItems: 2000

Show child fields
filePathstringRequired

The filePath value for this operation. Its accepted type and constraints are listed above and below.

minLength: 1 · maxLength: 512

startingLineNumberintegerRequired

The startingLineNumber value for this operation. Its accepted type and constraints are listed above and below.

min: 1 · max: 10000000

Response fields

Successful responses include requestId and scope. Use the actual business status or accepted field to determine the result. Optional fields are omitted when unavailable.

HTTP 200 · application/json

requestIduuidRequired

Server-generated HTTP request UUID. Include it when reporting a failed request.

scopeobjectRequired

The App and environment of this response. Headers only verify scope; they cannot switch key scope.

Show child fields
projectIdstringRequired

App ID bound to the credential.

minLength: 1

environmentenumRequired

Separate data scope: sandbox or live.

Show allowed values

"sandbox""live"

receiptobjectRequired

The receipt value for this operation. Its accepted type and constraints are listed above and below.

Show child fields
scanIduuidRequired

The scanId value for this operation. Its accepted type and constraints are listed above and below.

commitstringRequired

The commit value for this operation. Its accepted type and constraints are listed above and below.

receivedAtstringRequired

The receivedAt value for this operation. Its accepted type and constraints are listed above and below.

referencesintegerRequired

The references value for this operation. Its accepted type and constraints are listed above and below.

min: 0 · max: 9007199254740991

removedReferencesintegerRequired

The removedReferences value for this operation. Its accepted type and constraints are listed above and below.

min: 0 · max: 9007199254740991

Handle errors

Common failures
CodeRecovery
UNAUTHENTICATEDVerify the key or refresh the expired customer token once.
FORBIDDENCheck current key permissions and customer access.
INVALID_REQUESTCheck field types, UUIDs, decimal strings and mutually exclusive fields.
SCOPE_MISMATCHUse the App and environment bound to the credential.

Common failures

  • UNAUTHENTICATED

    Recovery
    Verify the key or refresh the expired customer token once.

  • FORBIDDEN

    Recovery
    Check current key permissions and customer access.

  • INVALID_REQUEST

    Recovery
    Check field types, UUIDs, decimal strings and mutually exclusive fields.

  • SCOPE_MISMATCH

    Recovery
    Use the App and environment bound to the credential.

Related:All request and error conventions·Back to endpoint index