Developers

No deliveries yet.

POST   /api/public/v1/scans              submit a scan (JSON body)
GET    /api/public/v1/scans              list your scans
GET    /api/public/v1/scans/:id          fetch one scan
GET    /api/public/v1/scans/:id/report   report JSON, or ?format=markdown

Authorization: Bearer <api key>   (or X-Api-Key: <api key>)

Idempotent writes:
  Idempotency-Key: <your unique id>   on POST /api/public/v1/scans
  Same key + same body  -> original response replayed (idempotent-replay: true)
  Same key + other body -> 409 conflict. Keys are retained 30 days.

Rate limits (per API key, fixed windows):
  300 requests / minute      all endpoints
  10,000 requests / day      all endpoints
  60 writes / minute         POST /api/public/v1/scans
  120 requests / minute      per calling address, before authentication
  10 invalid keys / 15 min   locks the calling address out for 15 minutes

  Every response carries x-ratelimit-limit, x-ratelimit-remaining and
  x-ratelimit-reset (seconds). A 429 also carries retry-after.

Webhook requests are signed, replay-safe and flood-capped:
  x-ers-event-id: <uuid>            stable across retries - dedupe on this
  x-ers-idempotency-key: <uuid>     same value, for convenience
  x-ers-delivery-attempt: <n>
  x-ers-timestamp: <ms epoch>       reject if older than 5 minutes
  x-ers-signature: HMAC-SHA256(secret, "<timestamp>.<raw body>")

  Delivery is capped at 60/minute per endpoint and 120/minute per account.
  Retries use exponential backoff (2-60 min), max 5 attempts, and are
  capped at 30/minute per endpoint.