POST /api/public/scan
Send application/json with a url field. The optional deep field is ignored by the public endpoint.
API
Website security scans as structured JSON.
The public API exposes the same lite-scan engine used on the website. It requires no account today and returns scores, category results, findings, evidence, and remediation.
Consistent result model
Responses include target_url, hostname, score, grade, category_scores, findings, and is_deep.
Finding detail
Each finding includes category, severity, title, description, remediation, evidence, and pass state.
CORS enabled
The endpoint accepts browser and server-side callers. Consumers should handle non-2xx JSON errors.
Planned
Managed API keys
Planned: account-scoped keys, usage views, and revocation.
Planned
Native CI integrations
Planned: packaged actions and merge-request annotations.