API Documentation

Integrate NextGenScan security scanning into your applications

Get API Access

Quick Start

1Request API Access: Submit a request at /api-access with your use case and expected usage

2Wait for Approval: Admin will review and approve your request within 24-48 hours

3Get Your API Key: Once approved, you'll receive an API key via email (shown only once!)

4Start Scanning: Use your API key in the Authorization header to make requests

Authentication

All API requests require authentication via Bearer token in the Authorization header:

Authorization: Bearer YOUR_API_KEY

Security Best Practices:

Never expose API keys in client-side code
Store keys in environment variables
Rotate keys regularly
Use different keys for development and production

Rate Limits

PRO Tier

100 req/hour

Suitable for small to medium projects

ENTERPRISE Tier

1,000 req/hour

For high-volume applications

Rate Limit Headers

X-RateLimit-Limit-Hourly: 100
X-RateLimit-Limit-Daily: 1000

API Endpoints

POST/api/v1/scan

Create Scan

Initiate a new security scan for a URL

Authentication:✅ Required

Rate Limit:PRO: 100/hour, ENTERPRISE: 1000/hour

Request Body

{
  "url": "https://example.com",
  "options": {
    "includePerformance": true,
    "includeOWASP": true
  }
}

Code Examples

curl -X POST https://nextgenscan.com/api/v1/scan \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com",
    "options": {
      "includePerformance": true,
      "includeOWASP": true
    }
  }'

GET/api/v1/scan

List Scans

Retrieve a paginated list of your scans with optional filters

Authentication:✅ Required

Rate Limit:PRO: 100/hour, ENTERPRISE: 1000/hour

Query Parameters

{
  "page": "1",
  "limit": "10",
  "filter": "all | critical | warnings | excellent",
  "sort": "date-desc | date-asc | score-desc | score-asc"
}

Code Examples

curl -X GET "https://nextgenscan.com/api/v1/scan?page=1&limit=10&filter=critical" \
  -H "Authorization: Bearer YOUR_API_KEY"

GET/api/v1/scan/:id

Get Scan Details

Retrieve detailed results for a specific scan

Authentication:✅ Required

Rate Limit:PRO: 100/hour, ENTERPRISE: 1000/hour

Code Examples

curl -X GET https://nextgenscan.com/api/v1/scan/SCAN_ID \
  -H "Authorization: Bearer YOUR_API_KEY"

PATCH/api/v1/scan/:id

Update Scan Metadata

Update scan tags, notes, bookmark status, and custom metadata

Authentication:✅ Required

Rate Limit:PRO: 100/hour, ENTERPRISE: 1000/hour

Code Examples

curl -X PATCH https://nextgenscan.com/api/v1/scan/SCAN_ID \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"tags": ["production", "critical"], "isBookmarked": true}'

DELETE/api/v1/scan/:id

Delete Scan

Permanently delete a scan

Authentication:✅ Required

Rate Limit:PRO: 100/hour, ENTERPRISE: 1000/hour

Code Examples

curl -X DELETE https://nextgenscan.com/api/v1/scan/SCAN_ID \
  -H "Authorization: Bearer YOUR_API_KEY"

GET/api/v1/analytics

Get Analytics

Retrieve comprehensive analytics for your scans

Authentication:✅ Required

Rate Limit:PRO: 100/hour, ENTERPRISE: 1000/hour

Code Examples

curl -X GET "https://nextgenscan.com/api/v1/analytics?days=30" \
  -H "Authorization: Bearer YOUR_API_KEY"

POST/api/v1/webhooks

Create Webhook

Create a webhook to receive real-time notifications

Authentication:✅ Required

Rate Limit:PRO: 100/hour, ENTERPRISE: 1000/hour

Code Examples

curl -X POST https://nextgenscan.com/api/v1/webhooks \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://your-domain.com/webhook", "events": ["SCAN_COMPLETED"]}'

POST/api/v1/batch

Batch Scan

Scan multiple URLs in a single batch operation

Authentication:✅ Required

Rate Limit:PRO: 10 batches/hour, ENTERPRISE: 100 batches/hour

Code Examples

curl -X POST https://nextgenscan.com/api/v1/batch \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"urls": ["https://site1.com", "https://site2.com"], "name": "Weekly Scan"}'

Error Codes

401

Unauthorized

Invalid or missing API key

403

Forbidden

API key does not have required permissions

404

Not Found

Resource not found

429

Too Many Requests

Rate limit exceeded

500

Internal Server Error

Unexpected server error

Need Help?

Can't find what you're looking for? Our support team is here to help.

Request API Access Contact Support