URLScan.io

About URLScan.io

URLScan.io provides an API for submitting URLs for automated scanning and retrieving the results, including screenshots and DOM snapshots, once a scan completes. It also offers a search API for querying existing scans by attributes such as domains, IPs, autonomous system (AS) numbers, and hashes. Access requires a user account with an API key; unauthenticated requests are limited to minor quotas.

Scans can be submitted at one of three visibility levels: public (visible on the frontpage and in public search results), unlisted (hidden from public search but visible to vetted security researchers on the urlscan Pro platform), or private (visible only to the submitting user or those given the scan ID). Submission options include setting a custom user agent, referer, tags, visibility, and the country from which the scan is performed.

The API enforces per-minute, per-hour, and per-day rate limits depending on the action performed, using a fixed-window approach that resets at the top of the minute, hour, or midnight UTC. Exceeding a limit returns an HTTP 429 response, and each request includes X-Rate-Limit headers indicating the current scope, action, window, limit, remaining calls, and reset time. The service is intended for developers integrating URL scanning and search functionality, with guidance provided on backoff strategies, redirect handling, and avoiding bulk scraping of the data.

Key features

• Submit URLs for automated scanning and retrieve results including screenshots and DOM snapshots
• Search existing scans by domain, IP, ASN, hash, and other attributes
• Three scan visibility levels (public, unlisted, private) to control exposure of submitted URLs
• Configurable scan options including custom user-agent, referer override, tags, and scan origin country
• Per-minute, per-hour, and per-day rate limits with X-Rate-Limit response headers for tracking quota usage

Frequently asked questions