API reference

Everything in the workspace is available over a REST API. Authenticate with a bearer token and automate analysis anywhere.

Authentication

Create an API key in your workspace settings and pass it as a bearer token. Keep keys server-side.

curl https://api.appmd.dev/v2/analyses \
  -H "Authorization: Bearer $APPMD_API_KEY"

Create an analysis

Upload an APK to start an analysis. The call returns immediately with an id.

POST /v2/analyses
Content-Type: multipart/form-data

file=@app-release.apk

{
  "id": "an_9f2c...",
  "status": "processing",
  "created_at": "2026-07-04T10:00:00Z"
}

Retrieve results

Poll the analysis, or subscribe to a webhook, until status is complete.

GET /v2/analyses/an_9f2c...

{
  "id": "an_9f2c...",
  "status": "complete",
  "framework": "compose",
  "screens": 24,
  "libraries": 18,
  "security_grade": "A-"
}

Webhooks

Register an endpoint to receive an analysis.completed event the moment a report is ready, ideal for CI. See the CLI for a terminal-first workflow.

Rate limits

Limits scale with your plan. Responses include X-RateLimit-Remaining; a 429 means back off and retry with the provided delay.