Connect Meta Muse to Sekura: the Sekura API for agents

What the connector does

It reads what your Sekura dashboard shows you:

your account, and whether your free first scan is still available;
the repositories you granted the Sekura GitHub App, which are the ones Sekura can scan;
each repository’s plan, Sekura Once or Sekura Always, with its schedule and last scan;
your scans, their status, a summary of what each found, and the link to its full report;
your billing: the card on file by brand and last four digits, your Always subscription, and this month’s charges.

And it acts, each time only after you have agreed (how):

start a Sekura Once scan, or scan again a repository already on your dashboard;
subscribe a repository to Sekura Always on the schedule you choose, or move one from Once to Always;
change when an Always repository is scanned;
cancel Sekura Always on a repository, from the end of the period already paid for;
cancel a scan in its first five minutes, as Cancel on the dashboard does.

Each of these uses the same functions your dashboard uses, so Muse cannot see or do anything the dashboard would not let you. Reading never changes anything, and acting always shows you what will happen first.

What it cannot do

See anything you have not granted: repositories without the Sekura GitHub App, other people’s scans, card numbers or API keys.
Grant a repository. That is GitHub’s install screen; Muse gives you the link.

Connect Sekura to Muse

Ask Muse to connect Sekura, for example: “Connect my Sekura account.”
Muse opens a Sekura link. Sign in with GitHub, as the GitHub account whose repositories you want scanned.
If the Sekura GitHub App is not yet installed on those repositories, GitHub’s install page comes next. Choose the repositories Sekura may read, public or private.
Approve. The page names Muse, the Sekura account being connected, and what Muse will be able to do: read, or read and act.
Go back to Muse. It is connected; there is no key to copy or paste.

The link works for 10 minutes. If it runs out, ask Muse to connect again. The connection appears in Settings → Agents and API keys, where you can revoke it at any time; Muse is refused from its next request.

What you need

A Sekura account. Signing in with GitHub creates one; accept the Terms when Sekura asks. GitHub supplies the verified email address reports are sent to.
The Sekura GitHub App installed on the repositories you want scanned. Each must not be empty.
A Meta Muse account.
For a paid scan or Sekura Always, one way to pay: approve the amount in the Muse chat and Link pays it; or a card already saved on your Sekura account; or, with neither, a Stripe Checkout link Muse gives you. Your first scan is free and needs none of them.

How paid actions work

Everything Muse does on your behalf that charges, authorizes or stops something takes two calls, so that you see what will happen before it happens.

You ask Muse to scan a repository. Muse asks Sekura for a quote, and Sekura answers with the price, how it would be paid, and the authorization text you are agreeing to. Nothing has happened yet.
Muse shows you the price and the text and asks you to agree. If you pay through Link, this is where you approve the amount.
Muse confirms, repeating the price and the text’s version. If either changed since the quote — the free scan was used elsewhere, or the wording was updated — Sekura refuses, charges nothing, and Muse shows you the new quote.

A Link payment is for the amount you approved and no more. Your saved card is charged only when the confirmation says to charge it, after the quote named it by brand and last four digits. With neither, you get a Stripe Checkout link: the scan or subscription starts when Stripe confirms your payment, and if you close the page without paying, nothing starts. A free first scan starts at once.

Sekura Always works the same way: the quote shows the monthly price, any free trial and the schedule before anything is subscribed. Changing a schedule charges nothing and takes one call. Cancelling always asks first: a scan still in its first five minutes stops, one already running is asked to stop and may finish, and Always stops at the end of the period you have already paid for. Neither deletes your scan history or your authorizations.

The authorization is recorded in your name, as the name or email on your Sekura account; Muse cannot supply a different one. The record also names the connection Muse used, and it is listed with every other authorization you have given under Authorizations.

Limits

120 requests a minute per connection.
10 confirmed actions an hour per account: starting a scan, subscribing, changing a schedule or cancelling. Asking for a quote or a preview does not count.
30 connection attempts an hour from one network address; a connect link works for 10 minutes.
Over a limit, the answer is 429 Too Many Requests with a Retry-After header giving the seconds to wait.
A request body over 64 KB is refused with 413.
One scan runs at a time per account; the others wait their turn.

Data handling

The API answers Muse with what your Sekura dashboard shows you, for your account and the repositories you granted the Sekura GitHub App only: your name and email, whether your free scan is available, your repositories and plans, your scans’ status and metadata, a summary of each scan’s findings (severity, title, file and a one-line description), a link to the full report, and the brand and last four digits of a saved card. The full report stays on sekura.ai behind your sign-in.

Card details never pass through Sekura or Muse. When Link pays, Stripe holds the card and Muse hands Sekura a payment token limited to the amount you approved; a saved card and a Checkout payment stay with Stripe as they do on the dashboard.

What Muse does with those answers is governed by Meta’s terms. What Sekura does with your data is in the privacy policy and the terms of service; a scan Muse starts is authorized and recorded on the same terms as one you start on sekura.ai.

For developers

Base URL: https://sekura.ai/api/muse/v1. JSON in and out.
OpenAPI 3.1: https://sekura.ai/api/muse/v1/openapi.json, readable without a key. It is the reference for every schema.
Authentication: Authorization: Bearer sek_live_… on every call except connecting and the OpenAPI document.
Errors: { code, error, link } — a code to branch on, one sentence for the person, and a link to where they take the next step.
401 no key, or a revoked one; 403 a scope is missing, and the error names it; 402 payment is needed, and link is a Stripe Checkout page; 409 the amount or the authorization text changed since the quote, and the body carries the new quote; 429 with Retry-After.

Scopes

Scope	What it permits
`read`	reading your account, the repositories you granted the Sekura GitHub App, your plans, your scans, their findings and report links, and your billing summary.
`write`	asking for a price and then starting a Sekura Once scan, subscribing a repository to Sekura Always, changing its schedule, cancelling Always and cancelling a scan. Every one of them first shows you what it will do and what it costs, and is paid only in the way you agreed to: approved in the Muse chat, your saved card, or a Stripe Checkout page.

Connecting

The device-authorization pattern: no redirect URL, and the person never handles the key. Show the person the link; poll with the code, no faster than interval. Polling answers authorization_pending, slow_down, access_denied or expired_token until the person approves, then the key exactly once.

POST https://sekura.ai/api/muse/v1/connect
→ { "code": "…", "verificationUrl": "https://sekura.ai/…", "expiresIn": …, "interval": … }

POST https://sekura.ai/api/muse/v1/connect/token      (with the code, every interval seconds)
→ { "code": "authorization_pending", … }   the person is still on the page
→ { "apiKey": "sek_live_…", "scopes": ["read", "write"] }   once

Quote, then confirm

Every call that charges, authorizes or stops something has a GET quote or preview that changes nothing, and a POST that repeats what the quote said. Show the person the quote before you confirm it.

GET  https://sekura.ai/api/muse/v1/scans/quote?repository=your-org/your-repo
→ the amount, how it would be paid, the authorization text and its version

POST https://sekura.ai/api/muse/v1/scans
{ "repository": "your-org/your-repo",
  "disclosureVersion": "…",          repeated from the quote
  "amountCents": …,                  repeated from the quote
  "payment": { "sharedPaymentToken": "spt_…" } }
  or  "payment": { "savedCard": true }
  or  no payment: 402 with a Stripe Checkout link

Operations

Call	Scope	What it does
`POST /connect`	none	Starts connecting: answers a code for the agent to poll with and a link for the person to open.
`POST /connect/token`	none	Polls with the code until the person has approved, then answers the API key, once.
`GET /account`	`read`	Name and email, whether the free first scan is available, the GitHub App’s installations, a billing summary without card details.
`GET /repositories`	`read`	The repositories granted to the Sekura GitHub App, per installation, marked private or empty.
`GET /plans`	`read`	Each repository’s plan, Sekura Once or Sekura Always, with its schedule and last scan.
`GET /scans`	`read`	Your scans, newest first, 1 to 20 at a time.
`GET /scans/{id}`	`read`	One scan: status, phase, findings by severity, where the report was sent.
`GET /scans/{id}/findings`	`read`	Counts by severity and the most severe findings, each with title, file and one line.
`GET /scans/{id}/report-link`	`read`	The link to the full report on sekura.ai, while the report is kept.
`GET /billing`	`read`	The card on file by brand and last four, the Always subscription, charges this month.
`GET /scans/quote?repository=`	`write`	The price of a Sekura Once scan, how it would be paid, and the authorization text with its version. Changes nothing.
`POST /scans`	`write`	Starts the scan the quote described, repeating its amount and version.
`GET /always/quote?repository=&schedule=`	`write`	The monthly price, any free trial, the schedule in words, how it would be paid, and the authorization text. Changes nothing.
`POST /always`	`write`	Subscribes the repository, or moves it from Once to Always, as the quote described.
`PATCH /plans/{id}/schedule`	`write`	Changes when an Always repository is scanned. Charges nothing; one call.
`GET /plans/{id}/cancel-preview`	`write`	Names the repository and the date its scans would stop. Changes nothing.
`POST /plans/{id}/cancel`	`write`	Cancels Sekura Always at the end of the period already paid for.
`GET /scans/{id}/cancel-preview`	`write`	Whether the scan can still be cancelled, and whether cancelling is certain. Changes nothing.
`POST /scans/{id}/cancel`	`write`	Cancels the scan in its first five minutes.
`GET /openapi.json`	none	The OpenAPI 3.1 document for every operation above.

Example prompts

Which of my repositories can Sekura scan?
Is my free Sekura scan still available?
Run a Sekura scan on your-org/your-repo.
Is my Sekura scan of your-org/your-repo finished yet?
What did my last Sekura scan find? Summarise the critical and high findings.
Give me the link to the full report for that scan.
Subscribe acme/shop to Sekura Always every Monday at 02:00.
Cancel the scan that just started.
Move my Always scan of acme/shop to Fridays.

Help

Write to hello@sekura.ai with the time and what you asked Muse. Never send an API key.
The support icon on any sekura.ai page opens an agent that can read your account’s situation and help you get unstuck.
If you think a connection or a key has leaked, remove it in Settings → Agents and API keys first, then write to us.