CyberCheckNow API v1.0.0

POST /api/v1/scans

Run a basic scan — Runs a passive scan now (usually 2-10 s, max 60 s) and stores it in your account. Counts against the plan's monthly scans.

{"domain": "example.com"}

Cavablar: 201 · 400 · 401 · 422 · 429

GET /api/v1/scans

List your scans

Parametrlər: limit (query), offset (query)

Cavablar: 200 · 401 · 422

GET /api/v1/scans/{id}

Get one of your scans

Parametrlər: id (path)

Cavablar: 200 · 401 · 404

POST /api/v1/deep-scans

Run a Deep Scan on one of your scans — Extended passive checks with findings and Fix Guides. PRO/BUSINESS (or a purchased scan). Counts against monthly Deep Scans.

Cavablar: 201 · 401 · 403 · 404 · 409 · 429

GET /api/v1/monitors

List your monitors

Cavablar: 200 · 401

POST /api/v1/monitors

Monitor a domain — Runs a baseline scan and schedules automatic scans at the plan's interval (PRO weekly, BUSINESS daily). Alerts by e-mail / push when security changes.

Cavablar: 201 · 401 · 403 · 409 · 429

GET /api/v1/monitors/{id}

Get one of your monitors

Parametrlər: id (path)

Cavablar: 200 · 404

DELETE /api/v1/monitors/{id}

Stop a monitor

Parametrlər: id (path)

Cavablar: 200 · 404

GET /api/v1/usage

Usage in the current month

Cavablar: 200

GET /api/v1/account

Your account and plan

Cavablar: 200

POST /api/v1/deep-scans/jobs

Queue a Deep Scan as a background job — Long-running Deep Scans run asynchronously: this returns a job id (202). Poll GET /jobs/{job_id} for status and the result. Requires the Deep Scan entitlement; active collectors still require DNS-TXT ownership verification. Duplicate-safe: an existing active job for the same scan is returned.

Cavablar: 202 · 401 · 403 · 404 · 409 · 429

GET /api/v1/jobs/{job_id}

Get a scan job's status and result

Parametrlər: job_id (path)

Cavablar: 200 · 401 · 404 · 429

POST /api/v1/jobs/{job_id}/cancel

Cancel a queued or running scan job

Parametrlər: job_id (path)

Cavablar: 200 · 401 · 404 · 429

POST /api/v1/corporate-scans/jobs

Queue a Corporate Infrastructure Scan as a background job — Full ownership-verified attack-surface scan of the verified root domain's derived assets (DNS, ports, web, technologies, vulnerabilities, graph, risk, corporate summary). Requires DNS-TXT ownership verification (403 otherwise). Returns a job id (202); poll GET /jobs/{job_id}. Progress phases: queued, discovery, scanning, analyzing, finalizing, completed.

Cavablar: 202 · 401 · 403 · 404 · 409 · 429

GET /api/v1/scans/{id}/findings

Deep Scan findings with risk, confidence and your triage decisions — Open findings by risk, then accepted risks, then false positives. Requires a plan with premium results or a purchased report.

Parametrlər: id (path)

Cavablar: 200 · 401 · 403 · 404 · 429

PUT /api/v1/scans/{id}/findings/{finding_id}/decision

Mark a finding as false positive or accepted risk — The decision belongs to your account and the scan's domain and applies to your later scans of it. Recorded in the audit log.

Parametrlər: id (path), finding_id (path), fingerprint (query)

Cavablar: 200 · 409 · 422 · 401 · 403 · 404 · 429

DELETE /api/v1/scans/{id}/findings/{finding_id}/decision

Remove a decision (the finding counts again)

Parametrlər: id (path), finding_id (path), fingerprint (query), scope (query)

Cavablar: 200 · 401 · 403 · 404 · 429

GET /api/v1/audit-log

Audit log of your account — Security-relevant actions (API key created/revoked, finding decisions, monitors created/stopped), newest first. Kept 365 days. Never contains secrets or request bodies.

Parametrlər: limit (query), offset (query)

Cavablar: 200 · 422 · 401 · 403 · 429

GET /api/v1/scans/{id}/fix-plan

Security Fix Planner of a scan — The failing / warning findings of the scan (from the scan itself - nothing is invented), highest risk first, each a task with status (pending | in_progress | fixed | accepted_risk), evidence, Fix Guide, effort where the scoring model defines it, verification instructions, history and its observation in later scans. 'verification.state' is 'verified' only when a later complete scan reports the check as passed; a user-set 'fixed' is never verified. Owner only; plan feature fix_planner (Pro, Business). Read-only keys allowed.

Parametrlər: id (path)

Cavablar: 200 · 401 · 403 · 404 · 429

PUT /api/v1/scans/{id}/fix-plan/tasks/{fingerprint}

Change a task's status — Allowed transitions: pending -> in_progress | fixed | accepted_risk; in_progress -> pending | fixed | accepted_risk; fixed -> pending | in_progress; accepted_risk -> pending | in_progress. accepted_risk needs a note (the reason, >= 3 characters) and is stored as the account's accepted-risk decision for the finding. Write scope required.

Parametrlər: id (path), fingerprint (path)

{"note": "Legacy CMS; compensating WAF rule until Q1", "status": "accepted_risk"}

Cavablar: 200 · 409 · 422 · 401 · 403 · 404 · 429

POST /api/v1/scans/{id}/fix-plan/retest

Retest the scan's domain — Runs a normal scan of the domain (same validation, limits and monthly scan quota as POST /scans) and returns the plan of the new scan, with the tasks that it verified as fixed. A failed scan changes nothing and returns its quota unit; an incomplete scan verifies nothing. Write scope required.

Parametrlər: id (path)

Cavablar: 201 · 400 · 504 · 401 · 403 · 404 · 429

POST /api/v1/intel/lookup

Look up an indicator in CyberCheckNow's threat database — SHA-256 / SHA-1 / MD5, domain, IPv4 / IPv6, CIDR or URL (defanged spellings accepted). A reputation lookup, not an antivirus scan: 'not_listed' does not mean safe. Read-only keys allowed; counts one ioc_lookups unit.

{"indicator": "203.0.113.7"}

Cavablar: 200 · 401 · 403 · 422 · 429

GET /api/v1/intel/sources

Threat intelligence sources — The verified feeds, their licence, indicator types and import status.

Cavablar: 200 · 401 · 403