API Reference

Installation

<script
  src="https://cdn.eazipost.com/v1/sdk.js"
  data-key="pk_live_YOUR_KEY"
  async>
</script>

npm install @vybesec/sdk

# React Native / Expo
npm install @vybesec/react-native

Need a full setup guide with platform-specific instructions? See the Documentation page.

Quick start

Call init() once at the very root of your app — before anything renders. All error capture is automatic from that point.

import { init } from "@vybesec/sdk"

init({
  key:         "pk_live_YOUR_KEY",
  platform:    "cursor",      // personalizes your fix prompts
  environment: "production",
})

Initializes the SDK and begins automatic error capture. Must be called before your app renders.

init({
  key:         "pk_live_YOUR_KEY",   // required
  platform:    "cursor",             // optional — tailors fix prompts
  environment: "production",         // optional — default: "production"
  sampleRate:  1.0,                  // optional — default: 1.0 (capture all)
})

Manually send an error with optional key-value context. Use inside try/catch blocks when you want to attach extra information — like an order ID or user state — to the captured error.

try {
  await submitOrder(cart)
} catch (err) {
  captureError(err, {
    userId:  currentUser.id,
    orderId: cart.id,
    total:   cart.total.toString(),
  })
}

Track meaningful events that aren't errors — a payment declining, a user hitting a limit, or a slow operation completing. These appear in your issues feed alongside errors.

import { captureMessage } from "@vybesec/sdk"

// Warn when something degrades but doesn't crash
captureMessage("Stripe webhook timeout — retrying", "warning")

// Track unusual but non-critical paths
captureMessage("User exported 10,000+ rows", "info")

Link all subsequent errors to a specific user. Call this after login so your dashboard shows who was affected — not just how many users.

import { setUser } from "@vybesec/sdk"

// After login
setUser({ id: user.id, username: user.displayName })

// After logout — clears user context
setUser(null)

Base URL

All endpoints are versioned. The current version is v1. Breaking changes will be introduced under a new version, not in-place.

Authentication

All REST API requests require your secret API key as a Bearer token. Get yours from Dashboard → Settings → API keys.

# Every request needs this header
Authorization: Bearer sk_live_YOUR_SECRET_KEY
Content-Type: application/json

curl https://api.vybesec.io/v1/projects \
  -H "Authorization: Bearer sk_live_YOUR_SECRET_KEY"

Projects

Issues

Analytics

Security

Alerts

Events

Subscribe to any of these events in Dashboard → Project → Settings → Webhooks. VybeSec will POST a signed JSON payload to your URL within seconds of the event firing.

Verifying signatures

Every webhook request includes an X-VybeSec-Signature header — an HMAC-SHA256 signature of the raw request body, signed with your webhook secret. Always verify it before processing.

// Node.js / Next.js API route example
import crypto from "crypto"

export async function POST(req: Request) {
  const rawBody = await req.text()
  const signature = req.headers.get("x-vybesec-signature") ?? ""
  const secret = process.env.VYBESEC_WEBHOOK_SECRET!

  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex")

  if (signature !== `sha256=${expected}`) {
    return new Response("Unauthorized", { status: 401 })
  }

  const event = JSON.parse(rawBody)
  // handle event.type …
  return new Response("OK", { status: 200 })
}

Payload shape

All webhook payloads share the same envelope. The data field contains event-specific details.

{
  "id":        "evt_01J…",          // unique event ID — use for deduplication
  "type":      "issue.new",         // one of the event types above
  "projectId": "proj_01J…",
  "orgId":     "org_01J…",
  "createdAt": "2025-03-18T09:41:00Z",
  "data": {
    // event-specific payload
    // issue.new → { fingerprint, message, severity, affectedUsers }
    // alert.fired → { ruleName, threshold, count, windowMs }
    // security.finding → { type, severity, fixPrompt }
  }
}

Webhook deliveries are retried up to 3 times with exponential backoff (30s, 5min, 30min) if your endpoint returns a non-2xx status. After 3 failures the delivery is abandoned and logged in your dashboard.