RedBlueQA CLI Documentation

# 1. Set up your shell (key never enters shell history)
read -s -p "API key: " RBQA_KEY && echo && export RBQA_KEY
export BASE="https://redblueqa.com"

# 2. Trigger a scan — returns 202 with a scanId
curl -X POST $BASE/api/v1/scans \
  -H "Authorization: Bearer $RBQA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com","pages":["https://example.com"]}'

# 3. Open the result in your dashboard
echo "Visit: $BASE/scans/<scanId-from-response>"

# Authorization Bearer (standard)
curl -H "Authorization: Bearer rbqa_xxx..." $BASE/api/v1/scans

# x-api-key (some tools — Postman, Hoppscotch — default to this)
curl -H "x-api-key: rbqa_xxx..." $BASE/api/v1/scans

POST $BASE/api/v1/scans

{
  "url": "https://example.com",          // required: target site
  "pages": ["https://example.com/path"], // optional: skip crawler, scan these
  "personaIds": ["angry-clicker"],       // optional: specific personas
  "personaCategories": ["security"],     // optional: whole categories
  "auth": {                              // optional: log in first
    "loginUrl": "https://example.com/login",
    "email": "test@example.com",
    "password": "..."
  }
}

{
  "scanId": "b94d8770-ea52-43a4-9106-6774f02108df",
  "liveScanId": "f048698f-5fb1-4587-b5a5-7f9d08ba258c",
  "status": "queued",
  "url": "https://example.com/",
  "personas": 2,
  "pages": 9,
  "batches": 2
}

curl -X POST $BASE/api/v1/scans \
  -H "Authorization: Bearer $RBQA_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/dashboard",
    "personaCategories": ["security"],
    "auth": {
      "loginUrl": "https://your-app.com/login",
      "email": "qa-sandbox@example.com",
      "password": "test-password-here"
    }
  }'

SCAN_ID="paste-scanId-here"

while true; do
  DATA=$(curl -s $BASE/api/v1/scans/$SCAN_ID \
    -H "Authorization: Bearer $RBQA_KEY")
  STATUS=$(echo "$DATA" | jq -r '.status')
  BUGS=$(echo "$DATA" | jq -r '.summary.bugCount')
  echo "[$(date +%H:%M:%S)] $STATUS — $BUGS bugs so far"
  [ "$STATUS" = "completed" ] && break
  [ "$STATUS" = "failed" ] && exit 1
  sleep 15
done

# All bugs
curl $BASE/api/v1/scans/$SCAN_ID/bugs \
  -H "Authorization: Bearer $RBQA_KEY" | jq .

# Filter by severity (server-side)
curl "$BASE/api/v1/scans/$SCAN_ID/bugs?severity=critical" \
  -H "Authorization: Bearer $RBQA_KEY" | jq .

# Include screenshots (large, base64 data: URIs)
curl "$BASE/api/v1/scans/$SCAN_ID/bugs?screenshots=1" \
  -H "Authorization: Bearer $RBQA_KEY" > bugs-with-screenshots.json

name: RedBlueQA Scan
on: pull_request

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Trigger
        id: t
        run: |
          RESP=$(curl -sf -X POST https://redblueqa.com/api/v1/scans \
            -H "Authorization: Bearer ${{ secrets.RBQA_API_KEY }}" \
            -H "Content-Type: application/json" \
            -d '{"url":"https://your-app.com","personaCategories":["security"]}')
          echo "id=$(echo "$RESP" | jq -r .scanId)" >> $GITHUB_OUTPUT

      - name: Wait
        run: |
          while true; do
            S=$(curl -sf https://redblueqa.com/api/v1/scans/${{ steps.t.outputs.id }} \
              -H "Authorization: Bearer ${{ secrets.RBQA_API_KEY }}" | jq -r .status)
            echo "$(date +%H:%M:%S) $S"
            [ "$S" = "completed" ] && break
            [ "$S" = "failed" ] && exit 1
            sleep 15
          done

const RBQA_KEY = process.env.RBQA_API_KEY;
const BASE = 'https://redblueqa.com';

const res = await fetch(`${BASE}/api/v1/scans`, {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${RBQA_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    url: 'https://example.com',
    personaCategories: ['accessibility', 'security'],
  }),
});
const { scanId } = await res.json();
console.log('Scan queued:', scanId);

import os, requests

key = os.environ['RBQA_API_KEY']
base = 'https://redblueqa.com'

resp = requests.post(
    f'{base}/api/v1/scans',
    headers={'Authorization': f'Bearer {key}'},
    json={
        'url': 'https://example.com',
        'personaCategories': ['accessibility', 'security'],
    },
)
resp.raise_for_status()
print('Scan queued:', resp.json()['scanId'])

package main

import (
  "bytes"
  "encoding/json"
  "fmt"
  "io"
  "net/http"
  "os"
)

func main() {
  body, _ := json.Marshal(map[string]any{
    "url":               "https://example.com",
    "personaCategories": []string{"accessibility", "security"},
  })
  req, _ := http.NewRequest("POST",
    "https://redblueqa.com/api/v1/scans", bytes.NewReader(body))
  req.Header.Set("Authorization", "Bearer "+os.Getenv("RBQA_API_KEY"))
  req.Header.Set("Content-Type", "application/json")
  resp, _ := http.DefaultClient.Do(req)
  defer resp.Body.Close()
  out, _ := io.ReadAll(resp.Body)
  fmt.Println(string(out))
}