---
title: "Analyze code"
method: POST
path: "/api/v2/static-analysis/static-analysis-server/analyze"
tags: ["Security Monitoring"]
---

# Analyze code

`POST /api/v2/static-analysis/static-analysis-server/analyze`

Run static analysis rules against a source code file and return violations found.

## Request body

- AnalysisRequest — The request payload for running static analysis on source code.
  - `data` AnalysisRequestData, required — The primary data object in the analysis request.
    - `attributes` AnalysisRequestDataAttributes, required — The attributes of the analysis request, containing the source code and rules to apply.
      - `code` string, required — The base64-encoded source code to analyze.
      - `file_encoding` string, required — The encoding of the source code file (must be `utf-8`).
      - `filename` string, required — The name of the file being analyzed.
      - `language` string, required — The programming language of the source code.
      - `rules` AnalysisRequestRule[], required — The list of static analysis rules to apply during analysis.
        - `category` string, required — The category of the rule (for example, `BEST_PRACTICES`, `SECURITY`).
        - `checksum` string, required — A checksum of the rule definition.
        - `code` string, required — The base64-encoded rule implementation code.
        - `entity_checked` string, nullable — The code entity type checked by the rule, applicable when rule type is `AST_CHECK`.
        - `id` string, required — The unique identifier of the rule.
        - `language` string, required — The programming language this rule targets.
        - `regex` string, nullable — A base64-encoded regex pattern used by the rule, applicable when rule type is `REGEX`.
        - `severity` string, required — The severity of findings from this rule (for example, `ERROR`, `WARNING`).
        - `tree_sitter_query` string, required — The base64-encoded tree-sitter query used by the rule.
        - `type` string, required — The rule type indicating the detection mechanism (for example, `TREE_SITTER_QUERY`).
    - `id` string — An optional identifier for the analysis request resource.
    - `type` 'analysis_request', required — Analysis request resource type.

## Response `200`

OK

- AnalysisResponse — The response payload from running static analysis on source code.
  - `data` AnalysisResponseData, required — The primary data object in the analysis response.
    - `attributes` AnalysisResponseDataAttributes, required — The attributes of the analysis response, containing rule results and any top-level errors.
      - `errors` string[], required — Top-level error messages encountered during the analysis operation.
      - `rule_responses` AnalysisRuleResponse[], required — The list of results for each static analysis rule applied during analysis.
        - `errors` string[], required — A list of error messages encountered while executing the rule.
        - `execution_error` string, nullable, required — An error message if the rule execution failed, or null if execution succeeded.
        - `execution_time_ms` integer, required — The time taken to execute the rule, in milliseconds.
        - `identifier` string, required — The identifier of the rule that produced this response.
        - `output` string, required — The raw output produced by the rule engine during execution.
        - `violations` AnalysisViolation[], required — The list of violations found by this rule.
          - `category` string, required — The category of the violation.
          - `end` AnalysisPosition, required — A position in source code, identified by line and column numbers.
            - `col` integer, required — The column number in the source file (1-based).
            - `line` integer, required — The line number in the source file (1-based).
          - `fixes` AnalysisFix[], required — The list of suggested fixes for this violation.
            - `description` string, required — A human-readable description of what the fix does.
            - `edits` AnalysisEdit[], required — The list of edit operations that constitute the fix.
              - …
          - `message` string, required — A human-readable description of the violation.
          - `severity` string, required — The severity level of the violation.
          - `start` AnalysisPosition, required — A position in source code, identified by line and column numbers.
            - `col` integer, required — The column number in the source file (1-based).
            - `line` integer, required — The line number in the source file (1-based).
    - `id` string, required — The unique identifier of the analysis response resource.
    - `type` 'server_request', required — Analysis response resource type.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)