Vulnara/ Docs
Sign inStart free

API reference

REST API

Integrate Vulnara into your own tools, dashboards, or deployment pipelines using the REST API.

Base URL: https://api.vulnara.io · Interactive API explorer (Swagger UI) ↗

Authentication

All API requests require a Bearer token in the Authorization header. Get your token from Settings → API keys.

http
Authorization: Bearer YOUR_API_TOKEN

Get a token via login

shell
curl -X POST https://api.vulnara.io/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "your-password"}'
json
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "bearer"
}

Endpoints

POST
/auth/login

Get an access token

GET
/auth/me

Get the current user's profile and plan

POST
/scans

Start a new scan

GET
/scans

List all scans for your account

GET
/scans/{id}

Get scan status and summary

GET
/scans/{id}/findings

List all findings from a scan

GET
/reports/findings

List all findings across all scans

GET
/domains

List your verified domains

POST
/domains

Add a domain for verification

POST
/domains/{id}/verify

Verify domain ownership

Start a scan

shell
curl -X POST https://api.vulnara.io/scans \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "target_url": "https://yourapp.com",
    "modules": ["port-scan", "tls", "access-control"],
    "user_a": {
      "email": "tester_a@yourapp.com",
      "password": "test-password-a"
    },
    "user_b": {
      "email": "tester_b@yourapp.com",
      "password": "test-password-b"
    }
  }'
json
{
  "scan_id": "3f8a1b2c-...",
  "target_url": "https://yourapp.com",
  "status": "queued",
  "modules": ["port-scan", "tls", "access-control"],
  "started_at": null,
  "findings_count": 0
}

Poll scan status

shell
curl https://api.vulnara.io/scans/3f8a1b2c-... \
  -H "Authorization: Bearer YOUR_API_TOKEN"
json
{
  "scan_id": "3f8a1b2c-...",
  "status": "complete",
  "started_at": "2026-06-13T09:12:00Z",
  "completed_at": "2026-06-13T09:17:34Z",
  "findings_count": 3,
  "risk_score": 62,
  "risk_grade": "C"
}

Status values: queued → running → complete or failed

Get findings

shell
curl https://api.vulnara.io/scans/3f8a1b2c-.../findings \
  -H "Authorization: Bearer YOUR_API_TOKEN"

# Filter by severity
curl "https://api.vulnara.io/scans/3f8a1b2c-.../findings?severity=critical,high" \
  -H "Authorization: Bearer YOUR_API_TOKEN"
json
[
  {
    "finding_id": "a1b2c3d4-...",
    "title": "Users can access each other's order data",
    "severity": "critical",
    "category": "Unauthorized Access",
    "module": "access-control",
    "affected_url": "https://yourapp.com/api/orders/1234",
    "description": "A request authenticated as User B returned order data belonging to User A.",
    "curl_command": "curl -H 'Authorization: Bearer <user_b_token>' https://yourapp.com/api/orders/1234"
  }
]

Rate limits

FreeAPI: 100 / hourScans: 5 / month
StarterAPI: 500 / hourScans: 50 / month
PremiumAPI: 2 000 / hourScans: Unlimited
EnterpriseAPI: 10 000 / hourScans: Unlimited

Rate limit headers are returned on every response: X-RateLimit-Remaining and X-RateLimit-Reset.

CLI referenceModules