SecuProbe
SYSTEMS OPERATIONAL — All security modules running
Developers

SecuProbe for developers

Automate security testing with a REST API, a GitHub Action, webhooks and scheduled scans. This page gives the overview; the API reference has every endpoint.

REST API

Start scans, read their status and list vulnerabilities with severity and remediation guide. JSON over HTTPS, Bearer authentication.

Read the API reference

CI/CD

Scan on every deployment with the official GitHub Action, or call the API from any other pipeline, and fail the build on critical findings.

Set up the GitHub Action

Webhooks

Receive an event on your endpoint when a scan completes. Use it to open tickets, notify a channel or feed your own dashboard.

See all integrations

Quick start

  1. Create an account and add the domain you want to test. Verify its ownership with a DNS record or a file to enable active tests.
  2. Generate an API key in the dashboard settings. Choose only the scopes the key needs: scans:create to start scans, scans:read to read results.
  3. Start a scan with one POST request. The response contains the scan identifier and the URL to poll.
  4. Read the result when the status is completed: the SecuScore, the vulnerability counts by severity and the link to the full report.

Start a scan

curl -X POST https://secuprobe.io/api/v1/scans \
  -H "Authorization: Bearer sp_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://your-domain.com" }'

API keys and limits

API keys start with sp_live_ and are shown once, when you create them. SecuProbe stores only a hash of the key, so a lost key cannot be recovered: revoke it and create a new one. Keep keys out of source control and store them as secrets in your CI.

Requests are rate limited per key and per minute. Each response includes the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers; a request over the limit receives a 429 status. API access is included in the Pro and Enterprise plans.

What the API will and will not do

The API follows the same rule as the dashboard: active security tests only run on domains whose ownership you have verified. This protects third parties and keeps your API key from being used to test a site you do not control.

Need help? Contact support or manage your API keys.