# Technical due diligence API: assess a repository with ForwardLane

ForwardLane's agent storefront sells technical due-diligence data, code quality scores and static security findings for the repositories ForwardLane has analysed. Each call is a synchronous JSON read. Start with a repository's executive summary at $0.05, and buy the deep packet at $1 when you need every factor behind it. Send a `GET` to the endpoint path, such as `https://agents.forwardlane.com/zcj/eh0dinhlseog/api/dd/executive/{repo}`. The storefront answers with a 402, a price quote that you pay over x402 or MPP and then retry with the same request.

## At a glance

- **Endpoints:** `GET https://agents.forwardlane.com/zcj/eh0dinhlseog/api/dd/executive/{repo}`, `GET https://agents.forwardlane.com/zcj/eh0dinhlseog/api/dd/deep/{repo}`, `GET https://agents.forwardlane.com/zcj/eh0dinhlseog/api/quality/current?repo={repo}`, `GET https://agents.forwardlane.com/zcj/eh0dinhlseog/api/security`
- **Request:** a `GET` with no body. The repository name goes in the path or in the `repo` query parameter.
- **Price:** summary $0.05, deep packet $1, quality read $0.05, security findings $0.10, counted per finding returned
- **Free reads:** the factor catalog `/api/dd/factors` and the run index `/api/dd/pipeline-runs`, at $0
- **Payment:** the 402 quote, paid over x402 (Base USDC) or MPP (Tempo USDC) and retried with the proof. No account or API key is needed.
- **Response:** JSON. The summary carries `mercor`, `score`, `highlights` and `pipeline`.
- **Full purchase flow:** [the buyer skill](https://agents.forwardlane.com/zcj/eh0dinhlseog/SKILL.md)

## Choose what to read

| Need | Request | Price |
| --- | --- | --- |
| Which repositories have a due-diligence run | `GET /api/dd/pipeline-runs?limit=100` | $0 |
| What a report measures | `GET /api/dd/factors` | $0 |
| One repository's executive summary | `GET /api/dd/executive/{repo}` | $0.05 |
| One factor report for one repository | `GET /api/dd/repos/{repo}/factors/{factor_id}` | $0.05 |
| Summary, full metric matrix, scored run and every factor report in one response | `GET /api/dd/deep/{repo}` | $1 |
| Current quality score | `GET /api/quality/current?repo={repo}` | $0.05 |
| Score history over 1 to 365 days, or rankings and tiers | `GET /api/quality/history?repo={repo}&days=30`, `/api/rankings?top_n=20`, `/api/tiers` | $0.05 |
| Static security findings | `GET /api/security?repo={repo}&severity=critical&limit=10` | $0.10 |

## Read a repository's due-diligence report

1. Check that the repository has a run. The index returns one row per repository, each for its latest analysis run. `limit` accepts 1 to 500.

   ```bash
   curl -s "https://agents.forwardlane.com/zcj/eh0dinhlseog/api/dd/pipeline-runs?limit=500"
   ```

2. Read the factor catalog. The response holds `items`, each with `id`, `kind`, `title` and `description`, and a `total` of 16. One item is:

   ```json
   {"id": "documentation", "kind": "score_dimension", "title": "Documentation", "description": "Docstring / documentation coverage of analyzed functions."}
   ```

3. Request the executive summary, pay the 402 quote and retry the same `GET`:

   ```bash
   curl -si https://agents.forwardlane.com/zcj/eh0dinhlseog/api/dd/executive/core-pipeline-manager
   ```

   The example summary paid $0.05 and returned these fields, shortened here:

   ```json
   {"repo": "core-pipeline-manager", "report_type": "executive_summary",
    "mercor": {"test_coverage_pct": 44.1, "has_ci": true, "ci_system": "Bitbucket Pipelines", "tests_in_ci": true, "total_deps": 18, "deps_pinned": true, "service_dependency_level": "Medium"},
    "score": {"composite_score": 81.5, "grade": "A", "dimensions": {"documentation": 72.4, "security": 100, "bus_factor": 100}},
    "highlights": {"bus_factor": 5, "critical_silos": 8, "security_findings": 0},
    "pipeline": {"timestamp": "2026-07-28T01:53:01.002465+00:00", "source": "pipeline_reports"}}
   ```

4. Buy the deep packet when the summary is not enough. Use the same request on `/api/dd/deep/{repo}` with the same payment. The example packet paid $1. It returned `report_type` `deep_diligence` with four parts: `executive`, which is the summary above; `mercor_full`, which adds lockfiles, pinning strategy, language distribution, patch sizes and CI files; `pipeline_run`, the scored run with its analysis; and `factors`, the 16 factor reports keyed by `factor_id`.

## Add the quality score and security findings

The current quality score needs `repo`. The example read paid $0.05. It returned this response:

```json
{"repo": "core-pipeline-manager", "timestamp": "2026-06-09T00:53:47.684537+00:00", "composite_score": 78.12, "doc_coverage": 0.724, "test_density": 1, "complexity_score": 0.9203, "domain_diversity": 0.35, "trajectory_count": 0}
```

Security findings are billed per finding returned, so `limit` (1 to 1000, default 100) caps the charge. You can filter with `repo`, and with `severity` set to `critical`, `high`, `medium` or `info`. A request with `?limit=1` paid $0.10. It returned `items`, each with `type`, `repo`, `file_path`, `severity` and `description`, and a `total`. A finding about a leaked credential, such as a hardcoded key, password or token, shows the directory but not the file.

## Boundaries

- The data covers repositories that ForwardLane has analysed. No endpoint accepts your own code or a repository to analyse.
- Every endpoint is a read. The summary and the packet cover one repository each at `/api/dd/executive/{repo}` and `/api/dd/deep/{repo}`; without a repository, `/api/dd/executive` ($0.05) and `/api/dd/deep` ($1) cover every analysed repository.
- A 402 that you have not paid charges nothing, so you can stop at the quote.
- A card pays a single call only at $0.50 or more. To pay smaller calls by card, buy Credits and draw each call from the balance; [the buyer skill](https://agents.forwardlane.com/zcj/eh0dinhlseog/SKILL.md) covers buying them.

## Errors

| Response | Meaning | Action |
| --- | --- | --- |
| `402` with no `reason` | The price quote | Pay it and retry the same request, or stop |
| `404` | No due-diligence data for the repository, or no quality snapshot | Check the name against `/api/dd/pipeline-runs` |
| `422` | Validation error, such as a missing `repo` | Fix the parameter and resend |
| `settlement_failed` | The payment did not settle | Fix the wallet and start again for a fresh quote |
| `401 bearer_required` | A Credits purchase without an agent credential | Register at [auth.md](https://agents.forwardlane.com/zcj/eh0dinhlseog/auth.md), or pay per call |
| `usage_exhausted` | The prepaid Credits balance ran out | Top up with `POST https://agents.forwardlane.com/zcj/eh0dinhlseog/extend` |

## Frequently asked questions

### What does a technical due diligence report from ForwardLane contain?

The executive summary has four parts. `mercor` holds the engineering-health facts: lines of code, test coverage, CI, Docker and dependency pinning. `score` holds a composite score, a grade and the dimensions. `highlights` covers bus factor, silos and security findings. `pipeline` records when the run was scored. The deep packet adds the full metric matrix, the scored analysis run and every factor report.

### Should I buy the summary or the deep packet?

Start with the summary at $0.05. Buy the packet at $1 when you need the full metric matrix and every factor report in one response. A single factor report for one repository costs $0.05.

### How much do security findings cost?

$0.10 for each finding returned. Set `limit` to the most findings you want to pay for.

### Can I compare code quality scores across repositories?

Yes. `/api/rankings` returns the top repositories by composite score and takes `top_n` and an optional `tier`. `/api/tiers` groups repositories by tier. Each read costs $0.05.

### Do I need an API key or account?

No. Each call is paid on its own through the 402 quote. An agent credential is needed only to buy Credits.

## Keep reading

- [Buyer skill](https://agents.forwardlane.com/zcj/eh0dinhlseog/SKILL.md): the full purchase flow
- [How to pay](https://agents.forwardlane.com/zcj/eh0dinhlseog/payment.md): rails, Credits and top-ups
- [Technical Due Diligence API reference](https://agents.forwardlane.com/zcj/eh0dinhlseog/services/due-diligence/openapi.json)
- [Error reference](https://agents.forwardlane.com/zcj/eh0dinhlseog/errors.md)

---

Updated 2026-10-26. All ForwardLane guides: https://agents.forwardlane.com/guides.md. Storefront: https://agents.forwardlane.com/zcj/eh0dinhlseog/llms.txt.