---
title: "Analyze code"
method: POST
path: "/api/v2/static-analysis/static-analysis-server/analyze"
tags: ["Security Monitoring"]
---

# Analyze code

`POST /api/v2/static-analysis/static-analysis-server/analyze`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/static-analysis/static-analysis-server/analyze`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `code_analysis_read`

Run static analysis rules against a source code file and return violations found.

## Request body

- AnalysisRequest: The request payload for running static analysis on source code.
  - `data` AnalysisRequestData, required: The primary data object in the analysis request.
    - `attributes` AnalysisRequestDataAttributes, required: The attributes of the analysis request, containing the source code and rules to apply.
      - `code` string, required: The base64-encoded source code to analyze.
      - `file_encoding` string, required: The encoding of the source code file (must be `utf-8`).
      - `filename` string, required: The name of the file being analyzed.
      - `language` string, required: The programming language of the source code.
      - `rules` AnalysisRequestRule[], required: The list of static analysis rules to apply during analysis.
        - `category` string, required: The category of the rule (for example, `BEST_PRACTICES`, `SECURITY`).
        - `checksum` string, required: A checksum of the rule definition.
        - `code` string, required: The base64-encoded rule implementation code.
        - `entity_checked` string, nullable: The code entity type checked by the rule, applicable when rule type is `AST_CHECK`.
        - `id` string, required: The unique identifier of the rule.
        - `language` string, required: The programming language this rule targets.
        - `regex` string, nullable: A base64-encoded regex pattern used by the rule, applicable when rule type is `REGEX`.
        - `severity` string, required: The severity of findings from this rule (for example, `ERROR`, `WARNING`).
        - `tree_sitter_query` string, required: The base64-encoded tree-sitter query used by the rule.
        - `type` string, required: The rule type indicating the detection mechanism (for example, `TREE_SITTER_QUERY`).
    - `id` string: An optional identifier for the analysis request resource.
    - `type` 'analysis_request', required: Analysis request resource type.

## Response `200`

OK

- AnalysisResponse: The response payload from running static analysis on source code.
  - `data` AnalysisResponseData, required: The primary data object in the analysis response.
    - `attributes` AnalysisResponseDataAttributes, required: The attributes of the analysis response, containing rule results and any top-level errors.
      - `errors` string[], required: Top-level error messages encountered during the analysis operation.
      - `rule_responses` AnalysisRuleResponse[], required: The list of results for each static analysis rule applied during analysis.
        - `errors` string[], required: A list of error messages encountered while executing the rule.
        - `execution_error` string, nullable, required: An error message if the rule execution failed, or null if execution succeeded.
        - `execution_time_ms` integer, required: The time taken to execute the rule, in milliseconds.
        - `identifier` string, required: The identifier of the rule that produced this response.
        - `output` string, required: The raw output produced by the rule engine during execution.
        - `violations` AnalysisViolation[], required: The list of violations found by this rule.
          - `category` string, required: The category of the violation.
          - `end` AnalysisPosition, required: A position in source code, identified by line and column numbers.
            - `col` integer, required: The column number in the source file (1-based).
            - `line` integer, required: The line number in the source file (1-based).
          - `fixes` AnalysisFix[], required: The list of suggested fixes for this violation.
            - `description` string, required: A human-readable description of what the fix does.
            - `edits` AnalysisEdit[], required: The list of edit operations that constitute the fix.
              - …
          - `message` string, required: A human-readable description of the violation.
          - `severity` string, required: The severity level of the violation.
          - `start` AnalysisPosition, required: A position in source code, identified by line and column numbers.
            - `col` integer, required: The column number in the source file (1-based).
            - `line` integer, required: The line number in the source file (1-based).
    - `id` string, required: The unique identifier of the analysis response resource.
    - `type` 'server_request', required: Analysis response resource type.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)