POST /evaluations

{
  "repository": "owner/repo",
  "ref": "feature-branch",
  "base_ref": "main",
  "files": [
    {
      "path": "src/api/users.ts",
      "content": "...",
      "status": "modified"
    }
  ],
  "policies": ["no-hardcoded-secrets", "no-sql-injection"]
}

{
  "id": "eval_abc123",
  "status": "completed",
  "repository": "owner/repo",
  "ref": "feature-branch",
  "created_at": "2024-01-15T10:30:00Z",
  "completed_at": "2024-01-15T10:30:05Z",
  "passed": false,
  "summary": {
    "total_files": 1,
    "total_violations": 2,
    "errors": 1,
    "warnings": 1
  },
  "violations": [
    {
      "id": "viol_xyz789",
      "policy_id": "no-hardcoded-secrets",
      "severity": "error",
      "file": "src/api/users.ts",
      "line": 45,
      "column": 12,
      "message": "Hardcoded API key detected",
      "code_snippet": "const apiKey = 'sk-abc123...'",
      "suggestion": "Move to environment variable"
    }
  ]
}

GET /evaluations/{evaluation_id}

GET /evaluations

{
  "evaluations": [...],
  "pagination": {
    "next_cursor": "cursor_abc123",
    "has_more": true
  }
}

DELETE /evaluations/{evaluation_id}

GET /policies

{
  "policies": [
    {
      "id": "no-hardcoded-secrets",
      "name": "No Hardcoded Secrets",
      "description": "Detect secrets in code",
      "severity": "error",
      "enabled": true,
      "category": "security",
      "frameworks": ["nist-ssdf:PW", "owasp-asvs:V14"]
    }
  ]
}

GET /policies/{policy_id}

{
  "id": "no-hardcoded-secrets",
  "name": "No Hardcoded Secrets",
  "description": "...",
  "severity": "error",
  "enabled": true,
  "patterns": [...],
  "suggestions": [...],
  "documentation_url": "https://docs.mergeguide.ai/policies/no-hardcoded-secrets"
}

PATCH /policies/{policy_id}

{
  "enabled": true,
  "severity": "warning",
  "settings": {
    "detect_api_keys": true
  }
}

POST /policies

{
  "id": "my-custom-policy",
  "name": "My Custom Policy",
  "description": "Custom organization policy",
  "severity": "warning",
  "patterns": [
    {
      "type": "regex",
      "value": "CUSTOM_PATTERN",
      "message": "Custom violation message"
    }
  ]
}

DELETE /policies/{policy_id}

GET /repositories

{
  "repositories": [
    {
      "id": "repo_abc123",
      "name": "owner/repo",
      "provider": "github",
      "default_branch": "main",
      "connected_at": "2024-01-01T00:00:00Z",
      "last_evaluation": "2024-01-15T10:30:00Z"
    }
  ]
}

POST /repositories

{
  "provider": "github",
  "name": "owner/repo"
}

DELETE /repositories/{repository_id}

GET /compliance

{
  "frameworks": [
    {
      "id": "nist-ssdf",
      "name": "NIST SSDF",
      "coverage": 75,
      "controls": {
        "total": 20,
        "covered": 15
      }
    }
  ],
  "regulations": [
    {
      "id": "soc2",
      "name": "SOC 2",
      "coverage": 80
    }
  ]
}

GET /compliance/frameworks/{framework_id}

{
  "framework": {
    "id": "nist-ssdf",
    "name": "NIST SSDF",
    "version": "1.1"
  },
  "coverage": 75,
  "controls": [
    {
      "id": "PW",
      "name": "Produce Well-Secured Software",
      "covered": true,
      "policies": ["no-hardcoded-secrets", "no-sql-injection"]
    }
  ]
}

POST /compliance/reports

{
  "frameworks": ["nist-ssdf", "soc2"],
  "date_range": {
    "start": "2024-01-01",
    "end": "2024-01-31"
  },
  "format": "pdf"
}

{
  "report_id": "report_abc123",
  "status": "generating",
  "download_url": null
}

GET /compliance/reports/{report_id}

GET /organization

{
  "id": "org_abc123",
  "name": "My Organization",
  "plan": "enterprise",
  "members_count": 25,
  "repositories_count": 15,
  "created_at": "2023-06-01T00:00:00Z"
}

PATCH /organization

{
  "name": "Updated Organization Name",
  "settings": {
    "default_severity": "error",
    "require_evaluation_pass": true
  }
}

GET /webhooks

POST /webhooks

{
  "url": "https://example.com/webhook",
  "events": ["evaluation.completed", "policy.violation"],
  "secret": "webhook_secret"
}

DELETE /webhooks/{webhook_id}

GET /health

{
  "status": "healthy",
  "version": "1.2.3",
  "timestamp": "2024-01-15T10:30:00Z"
}

GET /health/auth

{
  "status": "healthy",
  "authenticated": true,
  "organization": "my-org",
  "scopes": ["read:evaluations", "write:evaluations"]
}