Your first analysis.
A clear path.

Create your key.

API access comes with an active Team, Professional or Enterprise plan. Open API & settings, create a key, and store it as DEVIRT_API_KEY in your server environment. Never put it in browser code or a public repository.

Only reading existing jobs? Leave out jobs:write. Keys are shown once and can be revoked.

Send your file.

POST/packages/triage

Request a Triage Plus summary for one authorized file. This bounded static check identifies file structure and protection indicators; it does not recover code.

1import os
2import uuid
3 
4import httpx
5 
6headers = {
7    "Authorization": f"Bearer {os.environ['DEVIRT_API_KEY']}",
8    "Idempotency-Key": str(uuid.uuid4()),
9}
10 
11# Keep this key when retrying the same request.
12with open("authorized-sample.bin", "rb") as binary:
13    response = httpx.post(
14        "https://devirt.re/api/v1/packages/triage",
15        headers=headers,
16        files={"binary": binary},
17        data={
18            "product_id": "triage_plus",
19            "use_allowance": "false",
20            "authorization": "true",
21        },
22        timeout=300,
23    )
24 
25response.raise_for_status()
26job = response.json()
27print(job["job_id"])

1curl https://devirt.re/api/v1/packages/triage \
2  -H "Authorization: Bearer $DEVIRT_API_KEY" \
3  -H "Idempotency-Key: research-upload-0001" \
4  -F "[email protected]" \
5  -F "product_id=triage_plus" \
6  -F "use_allowance=false" \
7  -F "authorization=true"

Follow its progress.

GET/job/{job_id}

Poll every 5–15 seconds with the same Bearer key, or use a completion webhook. Payment state distinguishes an unfunded submission from a funded queue entry.

A job can also fail. Read its error and refund state instead of waiting indefinitely.

1{
2  "job_id": "demo_001",
3  "status": "processing",
4  "progress": 60,
5  "stage": "Comparing recovered behavior"
6}

Save your evidence.

GET/job/{job_id}/result

Once complete, paid work returns a signed output_url. Recovery results also include coverage_ledger and proof_summary. Static triage returns static_summary; Community Triage has no artifact download. Save paid outputs in your own evidence store.

1{
2  "job_id": "demo_001",
3  "status": "complete",
4  "product_id": "protected_full",
5  "output_url": "https://storage.example/result.zip?signature=…",
6  "coverage_ledger": {
7    "proven": 86,
8    "runtime_dependent": 7,
9    "unresolved": 2,
10    "permanently_bounded": 5,
11    "total": 100,
12    "scope": "Synthetic example: 100 assessed protected functions",
13    "notes": []
14  },
15  "proof_summary": {
16    "proven_count": 86,
17    "sat_count": 2,
18    "timeout_count": 3,
19    "permanent_bounds_count": 5
20  }
21}

While output is retained, request another signed link if needed. Renewing a link never extends retention. SAT and timeout counts are proof-summary outcomes, not extra coverage buckets.

Receive completion events.

Configure a public HTTPS endpoint in settings and securely save its signing secret.

1. Keep the raw body. Sign the timestamp, a period, and the unmodified request bytes.
2. Verify authenticity. Compare HMAC-SHA256 with v1 in X-Devirt-Signature using a constant-time comparison.
3. Check freshness. Reject timestamps outside five minutes. Deduplicate X-Devirt-Event or event_id.
4. Record, then acknowledge. Return 2xx after durable storage; process the event separately.

Delivery can repeat. Redirects are not followed; private-network destinations are rejected.

Assess before committing.

For General Analysis, protected recovery or custom work, POST binary, description, contact_email, and authorization=true to /novel/assess with an idempotency key. The email must match the verified account. Keep the returned assessment_id.

Completed assessments can include package_offers. Each offer identifies the exact binary, accepted outputs, price and expiry. POST to /packages/offers/{offer_id}/accept with {"accept_terms": true, "use_allowance": false, "priority": "standard"}. Use only an allowance for that product. Express is available only when the offer permits it. The returned job_id identifies the accepted order; use its checkout path if checkout_required is true. General Analysis allowances never purchase recovery.

For a separately quoted engagement, GET /novel/assess/{assessment_id}to read its written offer. POST to its /accept path with {"accept_terms": true}, then fund the deposit. Or POST to /decline with nothing charged. Offers and assessment reports expire after 72 hours. Acceptance and decline require the assessments:write scope.

The endpoint map.

Paths begin with /api/v1. The OpenAPI schema is available for tools and code generation; this page is the human reference.

Database routes also require permanent library access. Search with q, category, and page; download with format=ida or another available format.

Errors with a next step.