Request a diagnosis

A specialist reads your repositories with you, on a call.

Integrate

Connect your developer portal

Show what ScaleQuality measures inside the portal your engineers already open: Backstage, Port, or one you built. One read-only key, one API, and every number links back into ScaleQuality for the detail.

1 · Your portal's backend

Keeps the key and makes the call. The key never reaches the browser.

2 · The /v1 API

GET /v1/<card>/<level>/<id> answers for an organization, business unit, team, business area or repository.

3 · The card in your portal

A value, its status, its provenance and a link back to the same reading in ScaleQuality.

What you can show

Each card is read for the levels marked below, and only when the key carries its scope. A card asked for a level it is not read for answers 400.

CardEndpointOrgUnitTeamAreaRepoKey scope
Code maturity/v1/health●●●●●maturity:read
Security/v1/security●●●●●maturity:read
Test coverage/v1/coverage●●●●●maturity:read
Evolution/v1/evolution●●●●●maturity:read
Licenses/v1/licenses●●●●●evidence:read
Compliance/v1/compliance●●●●●evidence:read
AI/v1/ai●●●●–durability:read
People and cost/v1/people-cost●●●●–business:read
Initiatives/v1/initiatives●–●●–business:read
Engineering maturity/v1/eng-maturity●●●––maturity:read
Technology landscape/v1/radar●●●––catalog:read
Bugs/v1/bugs●●●––maturity:read
Incidents/v1/incidents●●●––maturity:read
AI durability/v1/durability●●●––durability:read
Diagnosis scores/v1/code-maturity●●●––maturity:read

To read several cards at once, /v1/entity/<level>/<id> returns every card the entity is read for and the key carries, in one response. /v1/entities returns every organization, unit, team, area and repository with the lighter cards, for a portal that syncs the whole company; Compliance, AI, People and cost, Initiatives, Bugs and Incidents are read one entity at a time.

Important. People and cost and Initiatives never travel in a key by default. A team's people cost over its headcount is its average salary, so they appear only in a key created with Share people cost and initiatives checked.

Before you start

What you need

  • A portal you can configure: a Backstage app you can redeploy, a Port account, or your own.
  • Owner or admin in ScaleQuality, to create the key.
  • A backend or secret store for the key. It must never be part of a browser bundle.
  • At least one entity measured in ScaleQuality; otherwise every card shows its empty state.

1. Create a key

  1. In ScaleQuality, open Developers and choose the API tab.
  2. Press Create key and name it after where it runs, for example Backstage production.
  3. Leave Share people cost and initiatives unchecked, unless the portal should show those two cards.
  4. Copy the key. It starts with sq_live_.
Important. The full key is shown once. Rotating it issues a new secret and stops the old one immediately, so update the portal before you rotate, not after.

2. Find your ids

Every call names a level and an id. The catalog lists your organization, its business units, teams, business areas and repositories, each with its id.

curl https://app.scalequality.io/v1/catalog \
  -H "Authorization: Bearer sq_live_..."

In the app, Developers, IDP shows the call of each card for the entity you pick, and a dashboard's Take it to the IDP lists the calls of all its cards.

3. Connect your portal

Pick the portal you run. The steps above are the same for all three.

The official plugin, @scalequality/backstage-plugin 0.3.0 on npm, renders the cards on an entity page. The key stays in the Backstage backend through the proxy.

Install the plugin

# from your Backstage app root
yarn --cwd packages/app add @scalequality/backstage-plugin@^0.3.0

Configure the backend proxy

Store the key as SCALEQUALITY_API_KEY in the backend environment, then add the proxy. The plugin calls it by the id scalequality.

app-config.yaml
proxy:
  endpoints:
    '/scalequality':
      target: https://app.scalequality.io/v1
      changeOrigin: true
      headers:
        Authorization: 'Bearer ${SCALEQUALITY_API_KEY}'

Add the card to the entity page

packages/app/src/components/catalog/EntityPage.tsx
import { EntityScaleQualityCard } from '@scalequality/backstage-plugin';

<Grid item md={6}>
  <EntityScaleQualityCard />
</Grid>

Map each entity to ScaleQuality

catalog-info.yaml
metadata:
  annotations:
    scalequality.io/repo-id: <project-uuid>
    # or: scalequality.io/team-id, area-id, bu-id or org-id

The most specific annotation wins: repository, then team, business area, business unit and organization. An entity with none shows the missing-annotation state, never another entity's number.

Note. The card shows every card of the entity it is annotated with. To show the exact cards of a dashboard, use the calls under Any portal (API).

Reference

Endpoints

EndpointReturns
GET /v1/catalogYour organization, business units, teams, business areas and repositories, with their ids.
GET /v1/<card>/<level>/<id>One card, for the fifteen cards in the table above.
GET /v1/entity/<level>/<id>Every card the entity is read for and the key carries, in one response.
GET /v1/entitiesEvery organization, unit, team, area and repository with the lighter cards, in one array.
GET /v1/summary/org/<id>The organization's AI durability as one headline, with the month's AI spend, the rework and a deep link.
GET /v1/controls/regimesThe regimes the platform reads, with id, version and control count.
GET /v1/controls/<level>/<id>?regime=The status of every control of one regime, read from measured evidence. Needs evidence:read.
GET /v1/evidence/<level>/<id>The evidence artifacts with their SHA-256 hashes, and the latest dossier attestation. Needs evidence:read.

Parameters

NameValues
levelorg, bu, team, area or repo. A repository can be one module of a monorepo.
idThe id from /v1/catalog. A key only reads inside its own organization.
period7d, 15d, 30d, month, quarter or year, on a single card.
regimeThe regime id from /v1/controls/regimes. Optional on /v1/compliance, required on /v1/controls.

Errors

CodeMeans
400Unknown level or period, or a card asked for a level it is not read for.
401No key, or a key that was revoked or rotated.
403The key does not carry the card's scope, or the id belongs to another organization.
404The id does not exist.
429Too many calls for this key. Wait for Retry-After.
503The controls or evidence reading is unavailable right now. Try again later.

Troubleshooting

What you seeFix
401 from the portal or the proxyCheck that the key is set in the backend that makes the call, and that it is still active under Developers, API.
403 for an id that existsTake the ids from /v1/catalog called with this key, not from another organization.
People and cost or Initiatives never appearCreate a key with Share people cost and initiatives checked, and point the portal at it.
A card is missing for a repository or a business areaNothing to fix: the table at the top says where each card is read.
Bugs says no team has a board connectedConnect the team's board on the team's page. The card fills in once ScaleQuality reads it.
Incidents is emptyConnect PagerDuty on the team's page.
Every card shows its empty stateMeasure a repository, complete an assessment or connect an AI provider for that entity.
Backstage shows the missing-annotation stateAdd one of the five scalequality.io annotations to the entity and reload the catalog.
Backstage requests never leave the portalKeep the proxy path exactly /scalequality, as in the Backstage steps.

See it on your own code.

Request a diagnosis. A specialist reads your repositories with you, on a call, and you leave with the first reading in hand.

Trusted AI. Measured, governed and proven.