DEVELOPER API

Compliance checks, in your pipeline.

The Defanso API runs the same App Store and Google Play audits as the web app, from your CI/CD. Fail the build before a rejection reaches App Review.

Authentication

The API uses bearer API keys. Create one on the CI/CD page (Agency plan). Keys are shown once — store them as a secret. Send it on every request:

Authorization: Bearer dfns_live_xxx

Base URL: https://defanso.com/api/v1

Endpoints

POST/api/v1/audit

Audit an App Store submission. Body accepts the audit fields plus an optional failOn threshold (high · medium · low, default high).

Request

curl https://defanso.com/api/v1/audit \
  -H "Authorization: Bearer dfns_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "appName": "FocusFlow",
    "description": "A focus timer with cloud sync...",
    "keywords": "focus,timer,pomodoro",
    "category": "Productivity",
    "dataCollected": ["identifiers", "usage_data"],
    "declaredLabel": ["identifiers"],
    "hasScreenshots": true,
    "hasPrivacyPolicyUrl": true,
    "failOn": "high"
  }'

Response

{
  "passed": false,
  "failOn": "high",
  "overall": "high",
  "counts": { "high": 1, "medium": 1, "low": 0 },
  "summary": "One privacy-label mismatch will get this rejected.",
  "findings": [
    {
      "guideline": "5.1.1",
      "title": "Data collection must match the App Privacy label",
      "risk": "high",
      "issue": "Collects usage_data but it's not in the declared label.",
      "fix": "Add 'Usage Data' to your App Privacy label.",
      "fixedText": ""
    }
  ]
}

POST/api/v1/google-play

Audit a Google Play listing. Same shape, with Play fields: appTitle, fullDescription, shortDescription, dataCollected, dataDeclared, targetsChildren. Findings cite Play policy names instead of guideline numbers.

Status codes

200 — audit ran; passed tells you whether it's under your threshold.
401 — missing or invalid API key.
403 — key's plan lacks CI/CD (upgrade to Agency).
400 — invalid JSON or input.
502 — analysis failed, retry.

GitHub Action

Put your audit body in defanso.json, add DEFANSO_API_KEY to your repo secrets, and fail the build when it doesn't pass:

name: Defanso compliance
on: [push]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Defanso audit
        run: |
          curl -sS https://defanso.com/api/v1/audit \
            -H "Authorization: Bearer ${{ secrets.DEFANSO_API_KEY }}" \
            -H "Content-Type: application/json" \
            -d @defanso.json > result.json
          cat result.json
          test "$(jq -r .passed result.json)" = "true"

Get an API key

API access is included in the Agency plan.

Manage keys