API overview-Code Security(Code Security)-阿里云帮助中心

API standards and multilingual preset SDKs

The OpenAPI of this product (CodeSec/2026-04-01) uses the ROA signature style. We have encapsulated SDKs for common programming languages for developers. Developers can download the SDK to directly call this product's OpenAPI without worrying about technical details. If the existing SDK does not meet your needs, you can use the signature mechanism for self-signing integration. Since the details of self-signing are very complex, it may take around 5 business days. Therefore, we recommend joining our DingTalk service group (147535001692) and conducting signature integration under expert guidance.

Before using the API, you need to prepare your identity account and access key (AccessKey) to effectively access the API through client tools (such as SDK and CLI). For details, see Obtain an AccessKey.

Custom signature scenarios

If your business scenario has special requirements and you need to integrate the API through self-signing, we recommend consulting our technical support team first (DingTalk service group: 147535001692) to obtain professional guidance and ensure efficient integration.

Account and security preparation

Alibaba Cloud accounts have full administrative permissions over all resources. Once an AccessKey is compromised, all associated resources will be at risk of unauthorized access. To ensure security, it is recommended to create a RAM user with only API access permissions and configure its AccessKey, while configuring RAM policies based on the principle of least privilege (PoLP). Use the Alibaba Cloud account only in specific scenarios where Alibaba Cloud account permissions are explicitly required.

Project management

API	Title	Description
CreateProject	Create a project	Creates a project.
DescribeProjects	List projects	Lists projects under a tenant by page, with support for fuzzy search by name or prompt.

Node management

API	Title	Description
CreateCodeBundle	Create a code package and obtain upload credentials	Creates a function code package in pending status and returns a pre-signed OSS PUT upload credential.
CompleteCodeBundle	Finalize a code bundle	Finalizes a code bundle after the client completes an OSS PUT operation. This operation validates the uploaded object and sets the code bundle status to ready. If CI metadata that triggers an automatic scan was provided during creation, a scanId is returned.
CreateScan	Create a scan task	Creates a scan task based on a code package that is ready.
DescribeScan	Query scan details	Queries the details of a scan task.
DescribeScans	List scan tasks	Lists scan tasks under a specified project with pagination.
DescribeScanResultsByEngine	Retrieve task result information	Queries the task result list to retrieve detailed SAST or SCA results of a specific scan.