> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting Started: DevSecOps Engineer

> Onboarding guide for DevSecOps and Platform Engineers integrating Snapsec into CI/CD pipelines, infrastructure, and automation.

As a **DevSecOps Engineer**, your goal is to embed continuous security testing directly into software delivery lifecycles, enforce security gates, and automate vulnerability ticketing.

***

## 1. Generating API Credentials

1. Navigate to **Platform > Administration > API Keys**.
2. Generate a Service Account token with scoped permissions (e.g., `scans:trigger`, `findings:read`).
3. Store the token in your CI/CD secrets manager (GitHub Secrets, GitLab CI Variables, HashiCorp Vault).

***

## 2. Integrating into GitHub Actions

Add automated scan triggers to your pull request workflow:

```yaml theme={null}
name: Snapsec Security Gate
on:
  pull_request:
    branches: [main]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Trigger Snapsec Scan
        uses: snapsec/security-action@v2
        with:
          api-key: ${{ secrets.SNAPSEC_API_KEY }}
          project-id: "proj_api_gateway_v2"
          fail-on-severity: "high"
          wait-for-completion: true
```

***

## 3. Webhook Subscriptions

Subscribe your internal automation pipelines or SIEMs to real-time events:

* `finding.created`: Trigger instant alerting on newly identified Critical issues.
* `assessment.completed`: Notify team Slack channels with assessment summary cards.
* `sla.breached`: Escalate overdue vulnerabilities to engineering managers.

Configure webhook endpoints and HMAC signature verification under **Integrations & Automation > Webhooks**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.