API Reference — MergeGuide

Authentication

All API requests require authentication using an API key passed in the Authorization header.

Authorization: Bearer mg_live_xxxxxxxxxxxxxxxxxxxx

API keys are managed in your MergeGuide dashboard under Settings → API Keys. Keys are scoped to your organization and carry your tier's rate limits.

Policy Evaluation

POST /evaluate

Evaluate a code snippet against your organization's active policy set. Returns violations with severity, control mapping, and remediation guidance.

Parameter	Type	Description
code required	string	The source code to evaluate
language required	string	Programming language: python, javascript, typescript, go, java, ruby, rust, php, csharp, cpp, scala, kotlin, swift
frameworks	string[]	Override active frameworks for this evaluation. Defaults to organization's configured frameworks.
context	object	Optional: repository, branch, actor for evidence generation

curl -X POST https://api.mergeguide.ai/v1/evaluate \
  -H "Authorization: Bearer mg_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "code": "conn = psycopg2.connect(password=\"admin123\")",
    "language": "python",
    "context": {
      "repository": "acme/payments",
      "actor": "developer@acme.com"
    }
  }'

POST /evaluate/commit

Evaluate all changed files in a Git commit. Returns consolidated violations and generates an immutable evidence artifact.

Parameter	Type	Description
repository required	string	Repository in owner/repo format
commit_sha required	string	Full SHA of the commit to evaluate
actor	string	Identity of the person who authored the commit

GET /evidence/export/oscal

Export evidence artifacts as OSCAL documents. Returns a ZIP containing SSP, SAP, SAR, POA&M, and Component Definition in OSCAL JSON format.

Parameter	Type	Description
start_date required	string	ISO 8601 date. Evidence from this date forward.
end_date required	string	ISO 8601 date. Evidence through this date.
frameworks	string[]	Filter to specific frameworks. Defaults to all.
document_types	string[]	ssp, sap, sar, poam, component. Defaults to all.

GET /policies/merged

Returns the current PolicyMerge output — the unified policy set after deconfliction across all configured frameworks. Includes per-control attribution showing which framework drove each requirement.

Rate limits

Free: 100 evaluations/day. Pro: 1,000/day. Team: 10,000/day. Business: 50,000/day. Enterprise: custom. Rate limit headers are returned on every response: X-RateLimit-Remaining, X-RateLimit-Reset.

MergeGuide REST API

Authentication

Policy Evaluation

Rate limits