웹사이트 취약점 스캐너 API 레퍼런스

예제 요청

curl -H "X-API-Key: $DOMSCAN_API_KEY" "https://domscan.net/v1/vulnerabilities?url=https%3A%2F%2Fexample.com&domain=example.com&mode=standard"

const response = await fetch("https://domscan.net/v1/vulnerabilities?url=https%3A%2F%2Fexample.com&domain=example.com&mode=standard", {
  headers: { "X-API-Key": process.env.DOMSCAN_API_KEY },
});
const data = await response.json();
console.log(data);

import os
import requests

response = requests.get(
    "https://domscan.net/v1/vulnerabilities?url=https%3A%2F%2Fexample.com&domain=example.com&mode=standard",
    headers={"X-API-Key": os.environ["DOMSCAN_API_KEY"]},
)
print(response.json())

package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://domscan.net/v1/vulnerabilities?url=https%3A%2F%2Fexample.com&domain=example.com&mode=standard", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("X-API-Key", os.Getenv("DOMSCAN_API_KEY"))

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	data, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(resp.Status, string(data))
}

require "json"
require "net/http"

uri = URI("https://domscan.net/v1/vulnerabilities?url=https%3A%2F%2Fexample.com&domain=example.com&mode=standard")
request = Net::HTTP::Get.new(uri)
request["X-API-Key"] = ENV.fetch("DOMSCAN_API_KEY")

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end
puts JSON.pretty_generate(JSON.parse(response.body))

예제 응답

{
  "target": {
    "requested_url": "https://www.example.com/",
    "final_url": "https://www.example.com/",
    "hostname": "www.example.com"
  },
  "scan": {
    "mode": "standard",
    "status": "complete",
    "checked_at": "2026-10-09T10:15:30.000Z",
    "duration_ms": 3120,
    "disclaimer": "A clean result means DomScan did not detect an issue within the documented scan coverage. Automated scanning cannot prove that an application is vulnerability-free or replace an authorized penetration test."
  },
  "summary": {
    "posture": "review",
    "risk_level": "medium",
    "finding_count": 2,
    "version_affected_count": 0,
    "misconfiguration_count": 2,
    "urgent_count": 0,
    "severity_counts": {
      "critical": 0,
      "high": 0,
      "medium": 1,
      "low": 1,
      "info": 0,
      "unknown": 0
    }
  },
  "findings": [
    {
      "fingerprint": "configuration:content-security-policy:www.example.com",
      "classification": "security_misconfiguration",
      "severity": "medium",
      "priority": "elevated",
      "title": "Content Security Policy is not advertised",
      "summary": "The observed response did not include a Content-Security-Policy header.",
      "evidence": {
        "confidence": "high",
        "observed": [
          "Public response did not include the expected content-security-policy protection."
        ],
        "limitations": [
          "header_policy_can_vary_by_path_or_response_status"
        ]
      },
      "remediation": {
        "summary": "Deploy a restrictive Content Security Policy in report-only mode first, then enforce it.",
        "fixed_versions": []
      },
      "sources": [
        "target_response"
      ]
    },
    {
      "fingerprint": "configuration:referrer-policy:www.example.com",
      "classification": "security_misconfiguration",
      "severity": "low",
      "priority": "normal",
      "title": "Referrer Policy is not advertised",
      "summary": "The response did not include an explicit Referrer-Policy header.",
      "evidence": {
        "confidence": "high",
        "observed": [
          "Public response did not include the expected referrer-policy protection."
        ],
        "limitations": [
          "header_policy_can_vary_by_path_or_response_status"
        ]
      },
      "remediation": {
        "summary": "Choose and deploy a Referrer-Policy that matches the application privacy and analytics requirements.",
        "fixed_versions": []
      },
      "sources": [
        "target_response"
      ]
    }
  ],
  "components": [
    {
      "technology_id": "jquery",
      "name": "jQuery",
      "detected_version": "3.7.1",
      "version_kind": "asset",
      "confidence": "high",
      "advisory_status": "checked",
      "matched_advisories": 0
    },
    {
      "technology_id": "cloudflare",
      "name": "Cloudflare",
      "detected_version": null,
      "version_kind": null,
      "confidence": "high",
      "advisory_status": "mapping_unavailable",
      "matched_advisories": 0
    }
  ],
  "coverage": {
    "target_response": "checked",
    "technology_detection": "checked",
    "package_advisories": "checked",
    "known_exploitation": "not_requested",
    "exploitation_probability": "not_requested",
    "detected_components": 2,
    "versioned_components": 1,
    "advisory_eligible_components": 1,
    "advisory_checked_components": 1,
    "advisory_deferred_components": 0,
    "advisory_query_limit": 20,
    "relay_used": true,
    "limitations": [
      "Only exact reviewed technology-to-package mappings are checked against OSV.",
      "Versionless or semantically incompatible detections are not reported as vulnerable.",
      "This passive scan does not send exploit payloads or prove exploitability.",
      "Response headers and exposed versions can vary by path, edge location, or authentication state."
    ]
  },
  "sources": [
    {
      "id": "target_response",
      "name": "Observed public response",
      "owner": "Target website",
      "url": "https://domscan.net/tech-stack-api",
      "status": "checked",
      "retrieved_at": "2026-10-09T10:15:30.000Z",
      "cache_hit": false,
      "expected_freshness": "Live at scan time",
      "fallback_behavior": "Unavailable signals remain unknown and never imply that the target is unaffected",
      "cost": "none"
    },
    {
      "id": "osv",
      "name": "OSV",
      "owner": "Google Open Source Security Team",
      "url": "https://google.github.io/osv.dev/",
      "status": "checked",
      "retrieved_at": "2026-10-09T10:15:29.000Z",
      "cache_hit": false,
      "expected_freshness": "OSV targets advisory freshness within 15 minutes",
      "fallback_behavior": "Use a fresh cached result when available; otherwise mark the component advisory check unknown",
      "cost": "none"
    },
    {
      "id": "cisa_kev",
      "name": "CISA Known Exploited Vulnerabilities Catalog",
      "owner": "Cybersecurity and Infrastructure Security Agency",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "status": "not_requested",
      "retrieved_at": null,
      "cache_hit": false,
      "expected_freshness": "Catalog changes are checked hourly",
      "fallback_behavior": "Use a fresh cached catalog when available; otherwise leave exploitation status unknown",
      "cost": "none"
    },
    {
      "id": "first_epss",
      "name": "Exploit Prediction Scoring System",
      "owner": "FIRST",
      "url": "https://www.first.org/epss/",
      "status": "not_requested",
      "retrieved_at": null,
      "cache_hit": false,
      "expected_freshness": "Scores are generated daily",
      "fallback_behavior": "Return the advisory without an EPSS value and mark exploitation probability unknown",
      "cost": "none"
    }
  ],
  "_meta": {
    "served_by": "pop=MAD country=ES",
    "analysis_status": "complete"
  }
}

HTTP 상태 코드

• 200 성공
• 400 잘못된 요청
• 401 인증되지 않음
• 402 결제 필요
• 429 요청 과다
• 503 서비스 이용 불가