Rafter

Static application security scanning with Rafter — API docs: https://docs.rafter.so/api-reference/introduction

Connection: an API key from Settings → API Keys. Rafter keys begin with RF, and are sent in the x-api-key header. Rate limit is 100 requests per minute per IP.

Base URL: https://rafter.so

Actions

Start Security Scan, Get Scan Result, Get Usage.

Start Security Scan scans a GitHub repository branch, not pasted source — give it org/repo and a branch. GitHub Token is only needed for a private repo when your Rafter account has no GitHub OAuth link; a fine-grained PAT with Contents: Read is enough.

Scan Mode — fast runs SAST, secret detection and dependency checks; plus adds agent-driven analysis passes and is metered separately, so a Plus scan past your plan limit returns 403.

Why scanning is two actions, not one

POST /api/static/scan starts a scan and returns an id; the findings appear later on GET /api/static/scan. Scanning is asynchronous, so this ships as Start and Get rather than one blocking "scan and return findings" action — a synchronous wrapper would have to poll inside the step, and a slow scan would burn the step timeout with nothing to show for it.

Put a Delay step between Start and Get. Don't loop Get tightly: the rate limit is 100 requests per minute per IP.

Rafter picks its response format from a format=md query parameter, not the Accept header — JSON is the default, so this piece simply never sends format and always gets structured output a flow can branch on.

No triggers

The documented surface is three endpoints, with no webhook for scan completion and no list endpoint to poll. There's nothing to build a trigger on until Rafter publishes one.