Skip to main content

​
How the docs are organized

The Apex docs are organized around the workflow most teams follow: connect code, define the workspace, scope the scan, and then run or automate the scan from the app or CLI. Use this page as the entry point when you are deciding which guide belongs to the next step in setup or scan planning.
Key idea Start with onboarding when access is not configured yet. Start with the scan manual when a workspace already exists and the main decision is scope.

​
Guides

  • Start here - Client onboarding: Connect GitHub or GitLab, choose repositories, and send the context Apex needs before the first scan.
  • Run scans - Apex scan manual: Scope a scan, choose when to run it, explain the threat model, and split larger repos into useful review units.
  • Automate scans - Scheduled scans: Turn on recurring auto-scans of a workspace, choose a daily or weekly cadence, and keep monitoring without manual runs.
  • Reference - Apex CLI guide: Install the CLI, wire Apex into Claude Code, Codex CLI, or GitHub Copilot CLI, and drive scan workflows from the terminal.
  • Reference - Apex service API: Create an organization service key, trigger scans from a headless worker, poll their status, and retrieve GitLab SAST findings.

​
Scan workflow

Apex works best when the workspace reflects a real security surface, not a loose collection of unrelated directories. The path below keeps access, scope, and context aligned before the scan starts.
  • Connect a code host or use the CLI from the repository you want to scan.
  • Create a workspace and choose the repositories, branches, pull requests, or commits in scope.
  • Add private docs, architecture notes, API specs, and threat model details that are not obvious from the code.
  • Run the scan after the scope and context describe one coherent system.
  • Use the CLI or workspace UI to track progress, read findings, and export results.
Before the first scan Make sure the person approving repository access and the person deciding scan scope agree on the same repos, refs, and supporting materials.

​
Reference

The CLI guide is the canonical reference for local and agent-driven workflows. The service API guide covers static-token, headless HTTP integrations for serverless workers and audit hubs.
  • Read client onboarding if you are setting up a workspace for the first time.
  • Read the scan manual before spending a scan entitlement or splitting a large repo.
  • Use the CLI guide when you want Apex available directly inside developer and agent workflows.
  • Use the service API when a serverless function, cron job, or internal audit hub needs static-token HTTP access.