//API

Scan from your own code.

One endpoint. It returns JSON by default and Markdown if you ask for it, so an agent can read a report as a document instead of reassembling one. No key needed for a public URL scan.

If you’re wiring this into an assistant, the MCP server is usually the better route, it gives the agent tools and an explicit stop condition rather than a payload to interpret.

Run a scan

bash

curl -X POST https://flarehq.dev/api/scan \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://your-app.com"}'

Get it as Markdown

Either send Accept: text/markdown or add ?format=md. Same scan, same redaction, only the representation changes.

bash

curl -X POST 'https://flarehq.dev/api/scan?format=md' \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://your-app.com"}'

Response

Field	Type	Meaning
summary.headline	string	One line describing the worst of it.
summary.critical\|high\|medium\|low	number	Counts by severity. Excludes compound findings so the same problem isn't counted twice.
findings[].severity	string	critical · high · medium · low
findings[].category	string	e.g. Secret leak, Toxic combination, Shadow API route
findings[].cwe	string	CWE identifier, when one applies.
findings[].proof	string	Reproducible evidence, usually a command you can run.
findings[].fix	string	What to change.
findings[].verification	object	Present on credentials; status is live · dead · unverified.
findings[].locked	boolean	Free tier: detail was withheld and is absent from the payload.
lockedCount	number	How many findings had detail withheld.

Status codes

200Scan completed.

400Bad URL, or a host that can't be scanned (private and loopback addresses are rejected).

402Free-tier limit reached for this host. Rescanning is a Pro feature.

429Rate limited. Back off and retry.

502The scan itself failed, usually the target was unreachable.

Health

Returns component status and 503 when something is down, so it works directly as a monitor target.

bash

curl https://flarehq.dev/api/health

Limits & conduct

Scans are rate limited per IP. Every check is read-only: no logins, no writes, no attack payloads. Only scan apps you own or are authorised to test.

Credentials found in a bundle are verified against the provider that issued them, on non-billable identity endpoints and nowhere else.

verified against

Building an agent against this? /llms.txt has the same contract in a form a model can read directly.