URLScan.io API

Overview

Measurement Record

What actually happened when we called this API from our own infrastructure. Every value below was recorded by the request, not copied from the provider's documentation.

Request

GET https://urlscan.io/api/v1/search/?q=domain:urlscan.io

Result

HTTP 200 · application/json · 175,111 bytes · compressed

Response time

617 ms (median of 3) · fastest 598 ms

Transport

TLSv1.3 · TLS_AES_256_GCM_SHA384 · certificate issued by Let's Encrypt

Browser CORS

No Access-Control-Allow-Origin header — call it from a server, not the browser

Rate limit

30 per window

Served by

nginx

Recorded

2026-08-10

Fields Returned

Top-level fields present in the response we captured, with the type and value we actually received.

Captured Response

Captured from a real request to https://urlscan.io/api/v1/search/?q=domain:urlscan.io on 2026-08-10. Long arrays and nested objects are truncated to keep the shape readable.

{
  "results": [
    {
      "submitter": {},
      "canonical": {
        "…": "(2 more fields)"
      },
      "task": {
        "…": "(7 more fields)"
      },
      "stats": {
        "…": "(5 more fields)"
      },
      "page": {
        "…": "(20 more fields)"
      },
      "_id": "019fec4c-012b-71e9-a10d-3d839356646a",
      "_score": null,
      "sort": [
        1786375838304
      ],
      "result": "https://urlscan.io/api/v1/result/019fec4c-012b-71e9-a10d-3d839356646a/",
      "screenshot": "https://urlscan.io/screenshots/019fec4c-012b-71e9-a10d-3d839356646a.png"
    }
  ],
  "total": 10000,
  "took": 583,
  "has_more": true
}

Implementation Example

Calls a real endpoint of this API. Replace any placeholder credentials with your own key.

const url = "https://urlscan.io/about-api/";
// Replace headers or query params with the values required by this API.
const response = await fetch(url, {
  headers: {
  "X-API-Key": "YOUR_API_KEY"
  }
});
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data);

import requests

url = "https://urlscan.io/about-api/"
headers = {"X-API-Key": "YOUR_API_KEY"}

response = requests.get(url, headers=headers, timeout=30)
response.raise_for_status()
data = response.json()
print(data)

curl -X POST https://urlscan.io/api/v1/scan/ -H "API-Key: YOUR_API_KEY" -H "Content-Type: application/json" -d '{"url":"https://example.com","visibility":"public"}'

What Can You Build?

// Check if a URL is malicious
const headers = { 'X-Api-Key': 'YOUR_API_KEY' };
const targetUrl = 'https://example.com';
const response = await fetch(`https://urlscan.io/about-api`, { headers });
const result = await response.json();
console.log('Scan result:', result);
const isSafe = !result.malicious;
console.log(isSafe ? 'URL is safe' : 'WARNING: URL may be dangerous');

// Check file hash reputation
const headers = { 'X-Api-Key': 'YOUR_API_KEY' };
const fileHash = 'abc123def456';
const response = await fetch(`https://urlscan.io/about-api`, { headers });
const data = await response.json();
console.log('File reputation:', data);
if (data.threat) {
  console.warn('Threat detected:', data.threat);
}

// Check domain reputation
const headers = { 'X-Api-Key': 'YOUR_API_KEY' };
const domain = 'suspicious-site.com';
const response = await fetch(`https://urlscan.io/about-api`, { headers });
const report = await response.json();
console.log('Domain report:', report);
document.getElementById('status').textContent =
  report.safe ? 'Domain is clean' : 'Domain flagged as unsafe';

Note: These code examples are AI-generated and unverified. Always refer to the official API documentation for accurate usage.

How This API Fails

We deliberately sent this API a broken request and recorded exactly what came back on 2026-08-10. Knowing the shape of an error before you hit it makes error handling much easier to write.

{
  "message": "Not Found",
  "description": "We could not find this page",
  "status": 404,
  "errors": [
    {
      "title": "Not Found",
      "detail": "We could not find this page",
      "status": 404
    }
  ]
}

{
  "message": "ElasticSearch search error, make sure your query is syntactically correct",
  "status": 400,
  "errors": [
    {
      "title": "ElasticSearch search error, make sure your query is syntactically correct",
      "detail": "ElasticSearch search error, make sure your query is syntactically correct",
      "status": 400
    }
  ]
}

Common Errors & Troubleshooting

Generated guidance based on this API's documentation, not observed by us. Treat it as a starting point and check against the provider's own error reference.