What can I scan with the CyberLens API?
The documented API starts a website security scan for a URL that you own or are authorized to assess. Review the returned evidence and scope before treating a result as a complete security assessment.
Developer API
Website security scanner API
Integrate CyberLens website security scans into your application or delivery workflow. Start a URL scan programmatically, poll for the evidence-backed result, and use a webhook when your workflow needs one.
What the API supports
The REST API starts security scans for URLs you are authorized to assess and returns JSON results after the scan completes.
- Create a scan with POST /scan
- Poll a scan result with GET /scan/:scan_id
- Check scan quota with GET /quota
- Optionally provide a webhook URL when starting a scan
Protect API credentials
API requests use an X-API-Key header. Keep that key in server-side environment variables or another secure secret store; do not expose it in browser-delivered code.
Questions and answers
How should I store a CyberLens API key?
Store the key in a server-side environment variable or secure secret store and send it only in the X-API-Key header. Do not include it in client-side JavaScript or other browser-delivered code.
Security references
CyberLens AI guidance is informed by established security standards and public vulnerability intelligence.
- OWASP Top 10: Common web application security risks used as a baseline reference.
- OWASP Application Security Verification Standard: Application security verification guidance for web application controls.
- NIST Cybersecurity Framework: Cybersecurity risk management guidance from NIST.
- CISA Known Exploited Vulnerabilities Catalog: Known exploited vulnerability intelligence for prioritization context.