# Alibaba Cloud Code Sec API

> Alibaba Cloud Code Sec API on Apizie: 10 endpoints (Finalizes a code bundle after the client completes an OSS PUT operation. This operation validates the…, Creates a function code package in pending status and returns a pre-signed OSS PUT upload credential, Creates a project, Creates a scan task based on a code package that is ready, …) returned as clean JSON through one API key. Send your own provider key in the x-upstream-key header. Call it over REST at https://apizie.tech/v1/cloud:aliyun-codesec/{endpoint} or from Claude, ChatGPT and Cursor through the Apizie MCP server. Free plan: 1,000 requests a month.

- Project key: `cloud:aliyun-codesec`
- Category: Cloud
- Status: byok
- Source: https://api.alibabacloud.com/product/codesec
- Page: https://apizie.tech/api/cloud/aliyun-codesec
- OpenAPI: https://apizie.tech/api/cloud/aliyun-codesec/openapi.json

Alibaba Cloud OpenAPI for Code Sec (codesec, version 2026-04-01). Calls are signed with ACS3-HMAC-SHA256 using your AccessKey ID and secret.

## Endpoints

### Finalizes a code bundle after the client completes an OSS PUT operation. This operation validates the…
`POST https://apizie.tech/v1/cloud:aliyun-codesec/complete-code-bundle` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://codesec.ap-southeast-1.aliyuncs.com |
| projectId | string | yes | The project ID |
| codeBundleId | string | yes | The code bundle ID |
| byteSize | integer | yes | The declared size of the uploaded object. This value must match the OSS Content-Length |
| contentType | string | yes | The MIME type of the stored code bundle. This is typically application/octet-stream for pre-signed PUT operations |

### Creates a function code package in pending status and returns a pre-signed OSS PUT upload credential
`POST https://apizie.tech/v1/cloud:aliyun-codesec/create-code-bundle` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://codesec.ap-southeast-1.aliyuncs.com |
| projectId | string | yes | The project ID |
| filename | string | yes | The file name |
| ciMetadata | string | no | An optional CI/CD metadata JSON string |

### Creates a project
`POST https://apizie.tech/v1/cloud:aliyun-codesec/create-project` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://codesec.ap-southeast-1.aliyuncs.com |
| name | string | yes | The project name |
| description | string | no | The description |
| instructionPrompt | string | no | The natural language prompt that describes scanning or result processing preferences, such as ignoring low-risk vulnerabilities |
| source | string | no | The project source (JSON-encoded) |
| engines | string | no | The engine switches for the project or scan snapshot. Only SAST and SCA are supported (JSON-encoded) |

### Creates a scan task based on a code package that is ready
`POST https://apizie.tech/v1/cloud:aliyun-codesec/create-scan` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://codesec.ap-southeast-1.aliyuncs.com |
| projectId | string | yes | The project ID |
| kind | string | yes | The type. Valid values: full: full data incremental: incremental |
| codeBundleId | integer | yes | The code package ID |
| taskName | string | yes | The task name |

### Generates a download link for an SBOM or license manifest that includes producer metadata
`POST https://apizie.tech/v1/cloud:aliyun-codesec/create-scan-sbom-export` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://codesec.ap-southeast-1.aliyuncs.com |
| projectId | string | yes | The project ID |
| scanId | string | yes | The task ID |
| format | string | yes | Valid values: cyclonedx-json spdx-json |
| fileName | string | no | The file name (including the extension) for the downloaded file. The file name is signed into the Content-Disposition header of the URL.… |

### Lists projects under a tenant by page, with support for fuzzy search by name or prompt
`GET https://apizie.tech/v1/cloud:aliyun-codesec/describe-projects` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://codesec.ap-southeast-1.aliyuncs.com |
| maxResults | integer | no | The number of entries per page. Default value: 10. Maximum value: 20 |
| nextToken | string | no | The pagination token. Do not specify this parameter or set it to an empty string for the first page. For subsequent pages, pass the… |
| query | string | no | The keyword used for fuzzy match by project name or prompt |
| sortBy | string | no | The field by which to sort the results. Default value: last_scan_time. Valid values: last_scan_time: the time when a task was last… |
| sortOrder | string | no | The sort order. Default value: desc. Valid values: desc: descending order. asc: ascending order |

### Queries the details of a scan task
`GET https://apizie.tech/v1/cloud:aliyun-codesec/describe-scan` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://codesec.ap-southeast-1.aliyuncs.com |
| projectId | string | yes | The project ID |
| scanId | string | yes | The task ID |

### Queries the task result list to retrieve detailed SAST or SCA results of a specific scan
`GET https://apizie.tech/v1/cloud:aliyun-codesec/describe-scan-results-by-engine` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://codesec.ap-southeast-1.aliyuncs.com |
| projectId | string | yes | The project ID |
| scanId | string | yes | The task ID |
| engine | string | yes | The engine type. Valid values: sast sca |
| nextToken | string | no | The pagination token. Do not specify this parameter for the first page or set it to an empty string. For subsequent pages, pass the… |
| maxResults | integer | no | The number of entries per page. Default value: 10. Maximum value: 50 |
| baselineState | string | no | Filters results by the baseline state of incremental scans. Valid values: new, unchanged, absent, and updated |
| packageName | string | no | The component name for fuzzy match. This parameter takes effect only when engine is set to sca |
| lang | string | no | The language. Valid values: zh: Chinese (default). en: English |

### Queries the scan tasks of a specific project in a paginated manner
`GET https://apizie.tech/v1/cloud:aliyun-codesec/describe-scans` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://codesec.ap-southeast-1.aliyuncs.com |
| projectId | string | yes | The project ID |
| maxResults | integer | no | The maximum number of entries per page. Default value: 20. Maximum value: 100 |
| nextToken | string | no | The pagination token. To query the first page, leave this parameter empty or do not specify it. To query subsequent pages, pass the… |
| status | string | no | The status of the task. Valid values: running: The task is running. completed: The task is completed. failed: The task failed |
| taskName | string | no | The name of the task |
| query | string | no | The query string. You can perform a fuzzy match by project name or prompt |

### version
`POST https://apizie.tech/v1/cloud:aliyun-codesec/version` (byok)

| Parameter | Type | Required | Description |
|---|---|---|---|
| endpoint | string | no | Regional endpoint, for example https://codesec.ap-southeast-1.aliyuncs.com |

## Example
```
curl "https://apizie.tech/v1/cloud:aliyun-codesec/complete-code-bundle" \
  -H "x-api-key: $APIZIE_KEY" \
  -H "x-upstream-key: $PROVIDER_KEY"
```

## FAQ

### How do I call the Alibaba Cloud Code Sec API?
Create a free Apizie key, then send POST https://apizie.tech/v1/cloud:aliyun-codesec/complete-code-bundle with the header x-api-key. Every endpoint returns { project, data, timestamp }.

### Is the Alibaba Cloud Code Sec API free on Apizie?
Yes. The Free plan includes 1,000 requests a month at 100 requests a minute, no credit card. Alibaba Cloud Code Sec itself also needs your own key from aliyuncs.com.

### Can AI agents use the Alibaba Cloud Code Sec API?
Yes. Add the Apizie MCP server (https://apizie.tech/mcp) to Claude, ChatGPT, Cursor or VS Code, then ask in plain language. The agent calls run_scraper with project key cloud:aliyun-codesec.

### What is the status of the Alibaba Cloud Code Sec API?
Needs your own provider key (bring your own key)