urlscan.io

Delete result

Permanently delete a scan owned by the connected user or team.

Delete saved search

Permanently delete a saved search by ID.

Delete subscription

Permanently delete an alert subscription by ID.

Download file

Retrieve a captured binary file by its SHA-256 hash as a password-encrypted ZIP archive.

Fork incident

Create a new Pro incident by copying an existing incident's configuration and complete stored state history.

Get account capabilities

Get non-sensitive plan, product, feature, visibility, submission, and limit information for the connected urlscan.io API key.

Get brand summary

Return detectable brands with detected-page totals and latest hits.

Get channel

Get one urlscan Pro notification channel by ID while preserving provider-specific metadata and removing webhook destinations or credentials.

Get data dump link

Generate a temporary download URL for a path returned by LIST_DATA_DUMPS.

Get dom

Return the plain-text DOM snapshot captured for a completed scan.

Get hostname history

Return one page of historical Pro Hostnames observations for a hostname.

Get incident

Get one incident's configuration, source, runtime state, and timestamps.

Get incident states

Retrieve the stored state history for an incident.

Get live scan resource

Retrieve one temporary result, DOM, screenshot, captured response, or download from the separate urlscan.io Live Scanning product.

Get phishfeed

Retrieve the deprecated urlscan Pro phishing feed in JSON, CSV, or TSV.

Get quotas

Get current products, features, query capabilities, and per-action minute, hour, and day quota usage.

Get response content

Return textual content captured in a scan response, addressed by its SHA-256 hash.

Get result

Retrieve the complete metadata and captured request data for a completed scan UUID.

Get saved search results

Run a urlscan Pro saved search and return its current Search API results.

Get screenshot

Retrieve a completed urlscan.io scan screenshot as a downloadable PNG file reference.

Get similar results

Find one page of scan results structurally similar to a specified scan.

Get subscription results

Resolve a urlscan Pro alert subscription and datasource to its current Search API results.

List available brands

List brand identifiers and metadata tracked by urlscan.io brand and phishing detection.

List available countries

List scanner country codes currently accepted by the Scan API.

List channels

List email and webhook notification channels for the current user without returning webhook URLs or embedded credentials.

List data dumps

List available urlscan.io data-dump files for a time window, file type, and date.

List live scanners

List Live Scanning nodes available to the connected account and their current metadata.

List saved searches

List saved searches owned by or shared with the current user.

List subscriptions

List alert subscriptions configured for the current user.

List user agents

List grouped browser user-agent strings available for scan submission.

List watchable attributes

List attribute values accepted when configuring incident change monitoring.

Lookup malicious observable

Look up malicious-scan occurrence counts and first/last seen timestamps for an IP, hostname, domain, or exact URL.

Purge live scan result

Permanently delete a temporary result from the separate urlscan.io Live Scanning product before its normal expiration.

Reset result visibility

Remove an owned scan's visibility override and restore the visibility originally assigned at submission.

Restart incident

Restart a closed urlscan Pro incident and extend its expiry.

Search scans

Search urlscan.io data with Elasticsearch Query String syntax and return one controllable page of results.

Store live scan result

Permanently store an existing temporary Live Scan result with the selected visibility.

Submit scan

Submit a URL for asynchronous external scanning, creating persistent result state and consuming quota.

Update channel

Replace the complete configuration of an existing Pro notification channel.

Update incident

Replace an existing incident's monitoring configuration and runtime options.

Update result visibility

Change the visibility of a scan owned by the connected user or team.

Update saved search

Replace the complete definition and metadata of an existing saved search.

Update subscription

Replace the complete configuration of an existing alert subscription.