API Reference

Automate security testing.

The ScanRub REST API lets you trigger scans, retrieve findings, and integrate security testing into your CI/CD pipeline. Available on the Premium plan.

See pricing Get API access

Quick Start

Get your API key

Generate one from the dashboard (Settings → API Keys). Requires the Premium plan.

Start a scan

POST /api/v1/scans with a target. Returns a scan_id immediately.

Poll for results

Poll GET /api/v1/scans/{id} until status is "completed", then pull findings or run the CI/CD gate check.

Example: Start a scan

curl

curl -X POST https://api.scanrub.com/api/v1/scans \
  -H "Authorization: Bearer srub_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "target": "https://example.com",
    "profile": "standard"
  }'

Authentication

All API requests require a Bearer token. API access is available on the Premium plan - generate a key from the dashboard under Settings → API Keys. Free-plan accounts cannot create keys.

Include in every request:

Authorization: Bearer srub_live_YOUR_KEY

The full key is shown exactly once, at creation time - ScanRub stores only a hash of it, never the plaintext. If you lose it, revoke the key and create a new one. Never commit keys to source control - use environment variables or CI secrets.

Endpoints

Base URL: https://api.scanrub.com

POST/api/v1/scans

Start a scan

Queue a new scan against a target. The scan is scoped to your account - the same as starting one from the dashboard.

Request Body

{
  "target": "https://example.com",
  "profile": "standard"
}

Response

{
  "scan_id": "68b1f2a9c4e5d6f7a8b9c0d1",
  "status": "running",
  "target": "https://example.com",
  "created_at": "2026-07-01T14:23:00Z"
}

GET/api/v1/scans/{scan_id}

Get scan status

Retrieve the current status, phase progress, stats, and quality score of a scan.

Response

{
  "scan_id": "68b1f2a9c4e5d6f7a8b9c0d1",
  "status": "completed",
  "target": "https://example.com",
  "profile": "standard",
  "started_at": "2026-07-01T14:23:00Z",
  "completed_at": "2026-07-01T14:28:14Z",
  "phases": { "recon": {}, "analysis": {}, "testing": {}, "browser": {} },
  "stats": {
    "critical": 1,
    "high": 3,
    "medium": 5,
    "low": 12
  },
  "quality_score": 92
}

GET/api/v1/scans/{scan_id}/findings

List findings

Get all findings from a scan. Filter by severity with ?severity=critical|high|medium|low|info.

Response

{
  "findings": [
    {
      "id": "68b1f3...",
      "type": "sqli",
      "severity": "critical",
      "title": "SQL Injection in search parameter",
      "url": "https://example.com/search?q=",
      "evidence": "...",
      "remediation": "...",
      "confidence": 0.94
    }
  ],
  "total": 21
}

GET/api/v1/scans/{scan_id}/gate

CI/CD gate check

Compare a scan against a baseline (?compareTo=<baseline_scan_id>) and get a pass/fail verdict for use in a CI pipeline. Fails on any new critical or high severity finding - new medium/low findings are reported but do not block.

Response

// GET /api/v1/scans/{scan_id}/gate?compareTo=68a0...
{
  "pass": false,
  "scan_id": "68b1f2a9c4e5d6f7a8b9c0d1",
  "compare_to": "68a0d1e2f3a4b5c6d7e8f9a0",
  "newFindings": [
    { "severity": "high", "title": "Reflected XSS in ?redirect=", "url": "..." }
  ],
  "summary": {
    "newCritical": 0,
    "newHigh": 1,
    "newMedium": 2,
    "newLow": 0
  }
}

Rate Limits

Free

API not available

Web UI only

Premium

30 req/min

5 concurrent scans, CI/CD gate included

Rate limit info is returned in RateLimit-* response headers. Exceeded requests return 429 Too Many Requests.

Integrate ScanRub into your pipeline

Get API access on the Premium plan.

See pricing Contact sales