API Introduction

RESTful API for programmatic access to VulnZap security scanning

Overview

The VulnZap API provides programmatic access to security scanning features, enabling custom integrations, automation, and real-time scan monitoring.

Base URL: https://api.vulnzap.com/api/scan

Need an API Key?

Generate your API key in the dashboard

Authentication

All API requests require authentication via API key in the x-api-key header:

curl https://api.vulnzap.com/api/scan/github \
  -H "x-api-key: your_api_key_here" \
  -H "Content-Type: application/json"

Available Endpoints

VulnZap API provides the following endpoints:

Start GitHub Scan

POST /github - Scan entire GitHub repository

Start Commit Scan

POST /commit - Scan specific files from a commit

Get Job Status

GET /jobs/:jobId - Retrieve scan status and results

GitHub Scan Events

GET /github/:scanId/events - Real-time SSE updates

Commit Scan Events

GET /commit/:jobId/events - Real-time SSE updates

Rate Limits

Rate limits are enforced based on your subscription plan. When exceeded, you’ll receive:

{
  "success": false,
  "error": "Subscription limit exceeded. You have used 100 of 100 scans this month."
}

Contact [e-mail] to increase your rate limits or upgrade your plan.

Response Codes

Code	Description
200	Success
400	Bad Request - Invalid parameters or request body
401	Unauthorized - Missing or invalid API key
403	Forbidden - Subscription limit exceeded
404	Not Found - Resource not found
500	Internal Server Error

Best Practices

Use SSE for Real-Time Updates

Use SSE endpoints (/github/:scanId/events and /commit/:jobId/events) for real-time updates instead of polling. If SSE is not available, poll /jobs/:jobId endpoint every 5-10 seconds.

Handle Errors Gracefully

Always check the success field in responses and handle errors appropriately with proper error messages.

Secure Your API Keys

Never expose your API key in client-side code. Use server-side proxies or environment variables.

Implement Exponential Backoff

For failed requests, implement exponential backoff to avoid overwhelming the API.

Monitor Shared Scans

When multiple users scan the same repository/branch simultaneously, VulnZap optimizes by sharing the scan. Monitor the isSharedScan field in responses.

Support

For questions or issues:

Email Support

[e-mail]

Documentation

Complete documentation

Status Page

Check API status

Dashboard

Manage API keys