Developer API

The same AI-powered configuration review that drives the Renovate Initializr UI is exposed as a small, public REST API. Send it a renovate.json and get back a plain-language summary, a list of concrete issues, and an improved configuration.

Overview

The API has a single job: analyse a Renovate configuration and tell you how to make it better. Under the hood your config is first validated against the official Renovate JSON schema, then handed to an DeepSeek model that returns structured, actionable feedback. It's the right tool when you want to lint and improve renovate.json files programmatically — in CI, a bot, or your own developer tooling.

Base URL

Productionhttps://renovate.oglimmer.com/api

Local devhttp://localhost:8080/api

Conventions

All requests and responses are application/json.
UTF-8 encoded, no trailing slash on paths.
The /api prefix is the server context path.

Auth & CORS

No authentication is required — the endpoint is open.
CORS is restricted to https://renovate.oglimmer.com, so browser calls from other origins are blocked. Call it server-to-server instead.
Rate limited to 1 request per minute per IP — extra calls get 429 Too Many Requests.
Be a good citizen: each call costs an LLM round-trip.

POST/api/feedback

Submit a Renovate configuration and receive AI feedback on it.

What it does: validates your config against the Renovate JSON schema, then asks an LLM to review it for best practices, security, and PR hygiene.

Why you'd use it: to catch misconfigurations and get an opinionated, improved config without reading the entire Renovate documentation — automatable from CI or your own tools.

How a request flows

The renovateJson string is parsed and validated against the Renovate schema (draft-07).
If invalid, you get 400 Bad Request immediately — no LLM call is made.
If valid, the config is sent to the model, which returns a structured summary, issues, and an improved config.

Request body

RenovateFeedbackRequest

Field	Type	Required	Description
`renovateJson`	string	Yes	Your Renovate config, serialised as a JSON string (i.e. the file contents), not a nested JSON object.

Heads up: renovateJson is a string field. Stringify your config and place it inside the request object — see the examples below, which double-encode it.

Example request

JavaScript (fetch)

// renovateJson is a *string* — stringify your config, then the request object.
const renovateConfig = {
  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
  extends: ['config:recommended', ':enableVulnerabilityAlerts'],
  timezone: 'Europe/Berlin'
}

const res = await fetch('https://renovate.oglimmer.com/api/feedback', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ renovateJson: JSON.stringify(renovateConfig) })
})

if (!res.ok) throw new Error(`Validation failed: ${res.status}`)

const feedback = await res.json()
console.log(feedback.summary)
feedback.issues.forEach(i => console.log(`[${i.severity}] ${i.jsonPath}: ${i.message}`))

cURL

bash

curl -X POST https://renovate.oglimmer.com/api/feedback \
  -H "Content-Type: application/json" \
  -d '{
    "renovateJson": "{\"extends\":[\"config:recommended\"],\"timezone\":\"Europe/Berlin\"}"
  }'

Response — 200 OK

RenovateFeedbackResponse

json

{
  "summary": "Solid baseline using recommended presets. A couple of tweaks would improve PR hygiene.",
  "issues": [
    {
      "severity": "warning",
      "jsonPath": "$.prConcurrentLimit",
      "message": "No concurrency limit set; Renovate may open many PRs at once.",
      "suggestion": "Add \"prConcurrentLimit\": 10 to cap simultaneous open PRs."
    },
    {
      "severity": "info",
      "jsonPath": "$.timezone",
      "message": "Timezone is set but no schedule is defined, so it has no effect.",
      "suggestion": "Add a \"schedule\", e.g. [\"before 5am on monday\"]."
    }
  ],
  "improvedRenovateJson": "{\n  \"extends\": [\"config:recommended\", \":enableVulnerabilityAlerts\"],\n  \"timezone\": \"Europe/Berlin\",\n  \"prConcurrentLimit\": 10\n}"
}

Status codes

Code	Meaning
`200 OK`	Feedback generated successfully (see the graceful-degradation note below).
`400 Bad Request`	The renovateJson is not valid JSON, or fails Renovate schema validation. The error message names the offending fields.
`429 Too Many Requests`	Rate limit exceeded — the endpoint allows 1 request per minute per IP. Wait and retry.

Graceful degradation: if the upstream model call itself fails (timeout, quota, etc.), the API still returns 200 OK with a summary describing the failure, an empty issues array, and your original config echoed back in improvedRenovateJson. Check issues.length and the summary text rather than relying on the status code alone.

GET/api/generateno auth · no rate limit

Build a renovate.json straight from URL query parameters — the form, without the form. Returns application/json, so you can pipe it straight into a file from curl, CI or a bot.

What it does: maps query parameters onto the default configuration and returns the generated config as JSON. No request body — everything is in the query string.

Why it exists: it runs the exact same generation function as the interactive form (one shared module) — single source of truth, so the API and the UI can never drift apart.

How it differs from /api/feedback: this is a pure, deterministic mapping — no AI, no schema validation, no rate limit, no authentication. CORS is open (Access-Control-Allow-Origin: *), so unlike /api/feedback you can also call it from the browser cross-origin.

Prefer a browser? The same result is rendered as a human-friendly page at /generate (same query parameters) with a copy button.

Rules

Any parameter you omit keeps its default value (see the table below).
Nested options use dot notation, e.g. grouping.npm=true.
Booleans accept true/1/yes/on; anything else is false.
Unknown parameters are ignored.

Example request

cURL

bash

curl 'https://renovate.oglimmer.com/api/generate?schedule=weekly&prLimitStrategy=conservative&groupAllNonMajor=false&grouping.npm=true&grouping.docker=true' \
  -o renovate.json

URL (also opens in a browser at /generate)

url

https://renovate.oglimmer.com/api/generate?schedule=weekly&prLimitStrategy=conservative&groupAllNonMajor=false&grouping.npm=true&grouping.docker=true

Response

The generated renovate.json for the request above (omitted parameters fall back to defaults):

json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":enableVulnerabilityAlerts",
    ":dependencyDashboard",
    ":semanticCommits",
    "docker:pinDigests",
    "helpers:pinGitHubActionDigests",
    ":pinDevDependencies",
    "abandonments:recommended"
  ],
  "configMigration": true,
  "timezone": "Europe/Berlin",
  "schedule": ["before 5am on monday"],
  "prHourlyLimit": 1,
  "prConcurrentLimit": 3,
  "rebaseWhen": "behind-base-branch",
  "rangeStrategy": "bump",
  "automergeType": "branch",
  "packageRules": [
    { "description": "Group npm dependencies (non-major updates)", "matchManagers": ["npm"], "matchUpdateTypes": ["minor", "patch", "pin", "digest"], "groupName": "npm dependencies" },
    { "description": "Group Docker dependencies (non-major updates)", "matchManagers": ["dockerfile", "docker-compose"], "matchUpdateTypes": ["minor", "patch", "pin", "digest"], "groupName": "Docker dependencies" },
    { "description": "Automerge minor, patch, pin, digest updates (low-risk, non-major)", "matchUpdateTypes": ["minor", "patch", "pin", "digest"], "automerge": true },
    { "description": "Automerge all devDependencies (build/test tooling, not shipped to consumers)", "matchDepTypes": ["devDependencies"], "automerge": true },
    { "description": "Automerge Maven/Gradle wrapper updates", "matchManagers": ["maven-wrapper", "gradle-wrapper"], "automerge": true },
    { "description": "Never automerge 0.x releases — semver allows breaking changes before 1.0", "matchCurrentVersion": "/^0\\./", "automerge": false },
    { "description": "Isolate major updates behind Dependency Dashboard approval", "matchUpdateTypes": ["major"], "dependencyDashboardApproval": true }
  ],
  "minimumReleaseAge": "7 days",
  "internalChecksFilter": "strict",
  "lockFileMaintenance": {
    "enabled": true,
    "schedule": ["before 5am on monday"],
    "automerge": true
  },
  "vulnerabilityAlerts": {
    "minimumReleaseAge": "0 days",
    "labels": ["security"],
    "schedule": ["at any time"],
    "automerge": true
  }
}

Parameters

Parameter	Accepts	Default
`semanticCommits`	boolean	`true`
`timezone`	IANA timezone, e.g. UTC	`Europe/Berlin`
`schedule`	at-any-time \| weekly \| monthly \| weekends \| outside-business-hours	`at-any-time`
`prLimitStrategy`	default \| conservative \| active	`active`
`rebaseWhen`	auto \| never \| conflicted \| behind-base-branch	`behind-base-branch`
`rangeStrategy`	auto \| pin \| bump \| replace \| widen \| update-lockfile	`bump`
`automergeType`	pr \| branch \| pr-comment	`branch`
`automergeLevel`	disabled \| patch \| minor \| all	`minor`
`automergeDevDependencies`	boolean	`false`
`ignoreTests`	boolean	`false`
`disablePreOneAutomerge`	boolean	`true`
`requireMajorApproval`	boolean	`true`
`minimumReleaseAge`	never \| 3-days \| 7-days \| 14-days	`7-days`
`pinning.dockerDigests`	boolean	`true`
`pinning.githubActionDigests`	boolean	`true`
`pinning.devDependencies`	boolean	`true`
`flagAbandonedPackages`	boolean	`true`
`lockFileMaintenance.enabled`	boolean	`true`
`lockFileMaintenance.schedule`	same values as schedule	`weekly`
`lockFileMaintenance.automerge`	boolean	`true`
`vulnerabilityAlerts.labels`	comma-separated string	`security`
`vulnerabilityAlerts.scheduleOverride`	boolean	`true`
`vulnerabilityAlerts.automerge`	boolean	`true`
`grouping.<manager>`	boolean — manager is one of: npm, docker, maven, gradle, pip, composer, helm, githubActions, terraform, gomod, cargo, bundler, nuget	`false`

Data types (DTOs)

RenovateFeedbackResponse

The top-level response object.

Field	Type	Description
`summary`	string	A 1-2 sentence plain-language assessment of the configuration and its quality.
`issues`	Issue[]	Up to 8 concrete findings. Empty when nothing noteworthy was found (or the model call failed).
`improvedRenovateJson`	string	A corrected/optimised version of your config as a JSON string. Falls back to your original input if generation fails.

Issue

A single finding inside issues[].

Field	Type	Description
`severity`	string	Severity level: "info", "warning", or "error".
`jsonPath`	string	JSONPath pointing at the relevant part of the config, e.g. "$.prConcurrentLimit".
`message`	string	What the issue is.
`suggestion`	string	A concrete recommendation for how to fix it.

severity is one of: infowarningerror

Questions or an integration to share? Open an issue on GitHub.