Skip to main content
POST
Create Scanner

Authorizations

x-api-key
string
header
required

API key for authentication (lowercase header name)

Body

application/json

Create a scanner. webhook_url is required for webhook and discord notifications. webhook_secret applies to custom webhooks. New scanners cannot opt into api_key webhook mode.

name
string
required
scanner_type
enum<string>
required
Available options:
stealer,
breach
query_config
object
required

Persistent scanner search definition.

Scanners reuse the same flat filters and structured filter grammar as V2 search, but reject runtime-only params such as from, to, cursor, page_size, format, debug, and search_id. Scanner runs always execute on indexed_at.

Example:
notification_type
enum<string>
required
Available options:
email,
webhook,
discord
webhook_url
string
webhook_secret
string
webhook_security_mode
enum<string>

New webhook scanners should use signed_json or signed_encrypted.

Available options:
api_key,
signed_json,
signed_encrypted
notify_on_zero_results
boolean

Response

201 - application/json

Raw scanner object

uid
string
user
string
name
string
scanner_type
enum<string>
Available options:
stealer,
breach
scanner_type_display
string
status
enum<string>
Available options:
active,
paused,
disabled
status_display
string
query_config
object

Persistent scanner search definition.

Scanners reuse the same flat filters and structured filter grammar as V2 search, but reject runtime-only params such as from, to, cursor, page_size, format, debug, and search_id. Scanner runs always execute on indexed_at.

Example:
notification_type
enum<string>
Available options:
email,
webhook,
discord
notification_type_display
string
webhook_url
string | null
webhook_security_mode
enum<string>

api_key is only available on existing scanners. New webhook scanners should use signed_json or signed_encrypted.

Available options:
api_key,
signed_json,
signed_encrypted
webhook_secret_last_rotated_at
string<date-time> | null
notify_on_zero_results
boolean
created_at
string<date-time>
updated_at
string<date-time>
last_run_at
string<date-time> | null
last_found_at
string<date-time> | null
next_run_at
string<date-time> | null
total_results_found
integer
total_runs
integer
consecutive_failures
integer