Authentication
Log in at POST /api/auth/login on the same domain. The browser receives an HttpOnly session cookie; no token is returned in the response body. The project endpoints below belong to the authenticated browser BFF. Write requests must come from the same origin. The underlying backend API stays private within the production network and uses bearer sessions internally. Separately issued API keys and a public external API for integrators are not offered at the moment.
Project and scan endpoints
| Method | Path | Description |
|---|---|---|
| POST | /api/auth/login | E-mail and password → HttpOnly session cookie |
| GET / POST | /api/v1/projects | Read / create projects |
| POST | /api/v1/projects/:id/scans | Start a scan for one of your projects |
| GET | /api/v1/scans/:id | Read the status of a scan |
| GET | /api/v1/scans/:id/summary | Summary and severity levels |
| GET | /api/v1/scans/:id/pages | Paginated page results |
| GET | /api/v1/scans/:id/export?format=csv | Export the report as csv, json, html or pdf |
| GET / PUT | /api/v1/projects/:id/monitoring | Read / configure scheduled scans |
Public website check
POST /api/check with {"url":"https://example.com"} returns a check and an access token. Retrieve it via GET /api/check/:id with the token as bearer. The token belongs exclusively to this check and is not a login. You get a PDF at GET /api/check/:id/pdf; POST /api/check/:id/report with an e-mail address requests a one-off delivery. Both need the same check bearer token. A voluntary contact request at POST /api/check/:id/lead additionally requires consent: true. Do not store the token in URLs, logs or public links.
Errors and limits
Invalid input returns 400, a missing login 401, forbidden access 403 or 404, exhausted limits 429 and temporarily unavailable services 503. The response contains an understandable error. Quotas are checked on the server.
Reports
JSON suits your own analyses, CSV spreadsheets, HTML readable documentation and PDF a report you can download right away. POST /api/v1/scans/:id/email sends the report once to the confirmed account address. The export contains the results of the pages actually checked and states its limits. Credentials, internal network addresses and private targets are blocked for the scanner.