Vibe App Scanner API for Make

The native app is available by invitation and is awaiting Make directory approval.

Authentication and connection test

Origin: https://api.vibeappscanner.com. Use an expiring API key with only scan:read and a REST-eligible VAS account. Report ownership is enforced on the connected account. Keys allow account-wide reads, rather than access to one report. Request report-only access through VAS support.

Make stores the key in its connection and sends Authorization: Bearer <VAS API key>. The connection check is GET /integrations/connection, returning:

{"contract":"vas-report-connection-v1","connected":true}

Get a website report

GET /integrations/reports/00000000-0000-4000-8000-000000000001 reads one existing website report. This UUID is an authored example. It does not start, rerun or poll a scan. Repository reports are outside this contract.

The dedicated summary endpoint excludes individual findings, evidence, target URLs, scanner details and account data. The Make module returns its JSON body unchanged, with the actual API field names:

Field	Meaning
`contract`	vas-report-handoff-v1
`id`, `scanId`	Existing report UUID
`status`, `terminal`	Lifecycle and whether the scan has ended; not a security verdict
`findingsCount`	Reported total count or null
`criticalFindingsCount`, `highFindingsCount`, `mediumFindingsCount`, `lowFindingsCount`, `infoFindingsCount`	Reported severity counts or null
`pageCoverage`, `reviewRequired`, `coverageNote`	Coverage category and required manual review caveat
`reportAccess`	available, locked or unknown
`reportUrl`	Authenticated VAS dashboard URL; grants no recipient access
`eligibleForNotification`	Terminal report with available access; sends nothing and requires destination review
`summary`	Plain-text summary produced by the API

Pending or unavailable counts are null. Zero findings and completion do not establish that an app is secure. Review skipped, failed, bounded or unreachable checks.

Make an API call

The universal module follows Make's standard contract: relative URL, method (GET, POST, PUT, PATCH or DELETE), optional headers, query string and body. A safe example is GET /integrations/connection. The URL is joined to the fixed VAS origin. Redirects are disabled. Authorization comes from the connection; do not place credentials in URLs, headers or body parameters yourself.

Output contains the full body, response headers and statusCode. The connected key's scopes and REST eligibility control permitted operations. Using this module does not grant write access to a read-only key. Other endpoints may return detailed private data, so choose the summary endpoint for report handoffs.

Logging and errors

Authorization is sanitized in HTTP debug logs. Response bodies and headers remain available for troubleshooting. Enable Keep data confidential for real reports. Make supplies the normal request timeout; the modules add no custom response-size or lifecycle filters. API errors stop execution instead of silently skipping a module.

Errors include the HTTP status and the API's message, falling back to its error name and then a generic message when neither is present. Make determines the error type, including its standard RateLimitError retry behavior for HTTP 429.

Status	Next step
400	Correct the report UUID or request parameters.
401	Check key expiry, validity and the connection.
403	Check REST eligibility and the key's scopes.
404	Check the endpoint and report ownership.
429	Let Make apply its rate-limit handling; do not start a new scan.
Other errors / timeout	Check service availability and the API's returned message.

See the shared API contract for examples.