Integrate
Connect your developer portal
Show what ScaleQuality measures inside the portal your engineers already open: Backstage, Port, or one you built. One read-only key, one API, and every number links back into ScaleQuality for the detail.
1 · Your portal's backend
Keeps the key and makes the call. The key never reaches the browser.
2 · The /v1 API
GET /v1/<card>/<level>/<id> answers for an organization, business unit, team, business area or repository.
3 · The card in your portal
A value, its status, its provenance and a link back to the same reading in ScaleQuality.
What you can show
Each card is read for the levels marked below, and only when the key carries its scope. A card asked for a level it is not read for answers 400.
| Card | Endpoint | Org | Unit | Team | Area | Repo | Key scope |
|---|---|---|---|---|---|---|---|
| Code maturity | /v1/health | ● | ● | ● | ● | ● | maturity:read |
| Security | /v1/security | ● | ● | ● | ● | ● | maturity:read |
| Test coverage | /v1/coverage | ● | ● | ● | ● | ● | maturity:read |
| Evolution | /v1/evolution | ● | ● | ● | ● | ● | maturity:read |
| Licenses | /v1/licenses | ● | ● | ● | ● | ● | evidence:read |
| Compliance | /v1/compliance | ● | ● | ● | ● | ● | evidence:read |
| AI | /v1/ai | ● | ● | ● | ● | – | durability:read |
| People and cost | /v1/people-cost | ● | ● | ● | ● | – | business:read |
| Initiatives | /v1/initiatives | ● | – | ● | ● | – | business:read |
| Engineering maturity | /v1/eng-maturity | ● | ● | ● | – | – | maturity:read |
| Technology landscape | /v1/radar | ● | ● | ● | – | – | catalog:read |
| Bugs | /v1/bugs | ● | ● | ● | – | – | maturity:read |
| Incidents | /v1/incidents | ● | ● | ● | – | – | maturity:read |
| AI durability | /v1/durability | ● | ● | ● | – | – | durability:read |
| Diagnosis scores | /v1/code-maturity | ● | ● | ● | – | – | maturity:read |
To read several cards at once, /v1/entity/<level>/<id> returns every card the entity is read for and the key carries, in one response. /v1/entities returns every organization, unit, team, area and repository with the lighter cards, for a portal that syncs the whole company; Compliance, AI, People and cost, Initiatives, Bugs and Incidents are read one entity at a time.
Before you start
What you need
- A portal you can configure: a Backstage app you can redeploy, a Port account, or your own.
- Owner or admin in ScaleQuality, to create the key.
- A backend or secret store for the key. It must never be part of a browser bundle.
- At least one entity measured in ScaleQuality; otherwise every card shows its empty state.
1. Create a key
- In ScaleQuality, open Developers and choose the API tab.
- Press Create key and name it after where it runs, for example Backstage production.
- Leave Share people cost and initiatives unchecked, unless the portal should show those two cards.
- Copy the key. It starts with sq_live_.
2. Find your ids
Every call names a level and an id. The catalog lists your organization, its business units, teams, business areas and repositories, each with its id.
curl https://app.scalequality.io/v1/catalog \ -H "Authorization: Bearer sq_live_..."
In the app, Developers, IDP shows the call of each card for the entity you pick, and a dashboard's Take it to the IDP lists the calls of all its cards.
3. Connect your portal
Pick the portal you run. The steps above are the same for all three.
The official plugin, @scalequality/backstage-plugin 0.3.0 on npm, renders the cards on an entity page. The key stays in the Backstage backend through the proxy.
Install the plugin
# from your Backstage app root yarn --cwd packages/app add @scalequality/backstage-plugin@^0.3.0
Configure the backend proxy
Store the key as SCALEQUALITY_API_KEY in the backend environment, then add the proxy. The plugin calls it by the id scalequality.
proxy:
endpoints:
'/scalequality':
target: https://app.scalequality.io/v1
changeOrigin: true
headers:
Authorization: 'Bearer ${SCALEQUALITY_API_KEY}'Add the card to the entity page
import { EntityScaleQualityCard } from '@scalequality/backstage-plugin';
<Grid item md={6}>
<EntityScaleQualityCard />
</Grid>Map each entity to ScaleQuality
metadata:
annotations:
scalequality.io/repo-id: <project-uuid>
# or: scalequality.io/team-id, area-id, bu-id or org-idThe most specific annotation wins: repository, then team, business area, business unit and organization. An entity with none shows the missing-annotation state, never another entity's number.
Reference
Endpoints
| Endpoint | Returns |
|---|---|
GET /v1/catalog | Your organization, business units, teams, business areas and repositories, with their ids. |
GET /v1/<card>/<level>/<id> | One card, for the fifteen cards in the table above. |
GET /v1/entity/<level>/<id> | Every card the entity is read for and the key carries, in one response. |
GET /v1/entities | Every organization, unit, team, area and repository with the lighter cards, in one array. |
GET /v1/summary/org/<id> | The organization's AI durability as one headline, with the month's AI spend, the rework and a deep link. |
GET /v1/controls/regimes | The regimes the platform reads, with id, version and control count. |
GET /v1/controls/<level>/<id>?regime= | The status of every control of one regime, read from measured evidence. Needs evidence:read. |
GET /v1/evidence/<level>/<id> | The evidence artifacts with their SHA-256 hashes, and the latest dossier attestation. Needs evidence:read. |
Parameters
| Name | Values |
|---|---|
level | org, bu, team, area or repo. A repository can be one module of a monorepo. |
id | The id from /v1/catalog. A key only reads inside its own organization. |
period | 7d, 15d, 30d, month, quarter or year, on a single card. |
regime | The regime id from /v1/controls/regimes. Optional on /v1/compliance, required on /v1/controls. |
Errors
| Code | Means |
|---|---|
400 | Unknown level or period, or a card asked for a level it is not read for. |
401 | No key, or a key that was revoked or rotated. |
403 | The key does not carry the card's scope, or the id belongs to another organization. |
404 | The id does not exist. |
429 | Too many calls for this key. Wait for Retry-After. |
503 | The controls or evidence reading is unavailable right now. Try again later. |
Troubleshooting
| What you see | Fix |
|---|---|
| 401 from the portal or the proxy | Check that the key is set in the backend that makes the call, and that it is still active under Developers, API. |
| 403 for an id that exists | Take the ids from /v1/catalog called with this key, not from another organization. |
| People and cost or Initiatives never appear | Create a key with Share people cost and initiatives checked, and point the portal at it. |
| A card is missing for a repository or a business area | Nothing to fix: the table at the top says where each card is read. |
| Bugs says no team has a board connected | Connect the team's board on the team's page. The card fills in once ScaleQuality reads it. |
| Incidents is empty | Connect PagerDuty on the team's page. |
| Every card shows its empty state | Measure a repository, complete an assessment or connect an AI provider for that entity. |
| Backstage shows the missing-annotation state | Add one of the five scalequality.io annotations to the entity and reload the catalog. |
| Backstage requests never leave the portal | Keep the proxy path exactly /scalequality, as in the Backstage steps. |