urlscan.io API

Free urlscan.io search API with no key: search millions of website scans for domains, IPs and page content to investigate phishing and malicious sites. Tested.

No API key requiredHTTPSFree tier

Endpoint tested and returned HTTP 200 on 20 Aug 2026

What is the urlscan.io API?

urlscan.io provides a free, key-free search API over its database of millions of website scans, letting you investigate domains, IP addresses, page content and screenshots to identify phishing and malicious infrastructure.

urlscan.io scans websites in a sandboxed browser and records everything — requests made, domains contacted, page content, screenshots and technologies detected. The search API queries that historical corpus.

It is widely used in security operations for phishing investigation: searching for a brand name in page content reveals sites impersonating it, and searching by IP or ASN maps out related malicious infrastructure. Search is key-free; submitting new scans requires a free API key.

Quick facts

Base URL: https://urlscan.io/api/v1
Authentication: Search requires no key. Submitting new scans requires a free API key.
Rate limit: Roughly 60 search requests per minute unauthenticated.
Pricing: Free tier for search and public scans; paid plans for commercial and private use.
CORS: Not enabled — call it from your server
Official docs: Read the docs

How to use the urlscan.io API

Every request below was executed against the live API on 20 Aug 2026, and the response shown is the real body it returned — not an illustration.

1. Search historical website scans

GET https://urlscan.io/api/v1/search/?q=domain%3Aexample.com&size=1

curl

curl 'https://urlscan.io/api/v1/search/?q=domain%3Aexample.com&size=1'

JavaScript (fetch)

const res = await fetch("https://urlscan.io/api/v1/search/?q=domain%3Aexample.com&size=1");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://urlscan.io/api/v1/search/?q=domain%3Aexample.com&size=1", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

{
  "results": [
    {
      "canonical": {
        "task": {
          "url": "accountschallenge-v3slgnin-identifier-continue.com"
        },
        "page": {
          "url": "example.com"
        }
      },
      "task": {
        "visibility": "public",
        "method": "automatic",
        "domain": "accountschallenge-v3slgnin-identifier-continue.com",
        "apexDomain": "accountschallenge-v3slgnin-identifier-continue.com",
        "time": "2026-08-19T21:10:49.659Z",
        "source": "certstream-suspicious",
        "uuid": "01a01bdc-a9b2-7563-9a1c-72fd39b2d216",
        "url": "https://accountschallenge-v3slgnin-identifier-continue.com/"
      },
      "stats": {
        "uniqIPs": 2,
        "uniqCountries": 2,
        "dataLength": 975,
        "encodedDataLength": 878,
        "requests": 2
      },
      "page": {
        "server": "cloudflare",
        "redirected": "off-domain",
        "ip": "172.66.147.243",
        "apexDomainAgeDays": 4269,
        "language": "en",
        "mimeType": "text/html",
        "title": "Example Domain",
        "url": "https://example.com/",
        "tlsValidDays": 90,
        "tlsAgeDays": 20,
        "domainAgeDays": 4269,
        "tlsValidFrom": "2026-07-29T22:10:08.000Z",
        "domain": "example.com",
        "umbrellaRank": 6980,
        "apexDomain": "example.com",
        "asnname": "CLOUDFLARENET - Cloudflare, Inc., US",
        "asn": "AS13335",
        "tlsIssuer": "Cloudflare TLS Issuing ECC CA 3",
        "status": "200"
      },
      "_id": "01a01bdc-a9b2-7563-9a1c-72fd39b2d216",
      "_score": null,

Parameters

Parameter	Type	Required	Description
`q`	string	Required	Elasticsearch-style query. `domain:example.com`
`size`	integer	Optional	Results per page, max 100 unauthenticated. `10`
`search_after`	string	Optional	Cursor for deep pagination. `1234,abcd`

Response fields

totalinteger: Total scans matching the query.
results[].taskobject: Scan metadata — time, submitted URL, visibility.
results[].pageobject: Resolved page details including domain, IP, ASN and country.
results[].statsobject: Request counts and unique domains contacted.
results[].screenshotstring: URL of the captured screenshot.
results[]._idstring: Scan id — fetch full results at /api/v1/result/{id}/.

What you can build with the urlscan.io API

Investigate phishing sites impersonating a brand
Map malicious infrastructure by IP, ASN or certificate
Check what a suspicious URL loads without visiting it
Enrich threat intelligence with historical scan data

Common errors and how to fix them

429

Unauthenticated search limit exceeded.

Fix: Roughly 60 requests per minute; register a free API key for more.

Query syntax errors

The q parameter uses Elasticsearch syntax.

Fix: Use field:value form such as domain:example.com or page.ip:1.2.3.4.

Sensitive data in public scans

Public scans are visible to everyone.

Fix: Never submit URLs containing tokens or session identifiers — they become permanently searchable.

urlscan.io API — frequently asked questions

Is urlscan.io free?

Search over public scans is free with no API key. Submitting new scans requires a free API key, and commercial or private use needs a paid plan.

What can I search for?

Domains, IP addresses, ASNs, page content, technologies and certificate details, using Elasticsearch-style field:value queries.

Is it safe to look up a malicious URL?

Yes — that is the point. urlscan visits sites in its own sandbox, so you can inspect what a URL loads, including screenshots, without visiting it yourself.

Are my scans private?

Public by default, meaning anyone can search them. Never submit URLs containing session tokens or private parameters unless you set the scan to private, which requires an account.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

URL Encoder

Percent-encode text for URLs instantly. Switch between encodeURIComponent and encodeURI modes, see live output and copy the result. Free URL encoder.

Alternatives to urlscan.io API

If urlscan.io does not fit, these security & auth apis cover similar ground. Every one was called before publishing, and each links to its own reference page with a working curl command and the response it returned.

API	What it does	Auth	CORS	Last verified
Pwned Passwords	Free Have I Been Pwned password API with no key. Check if a password appears in known breaches using k-anonymity — the password never leaves your server. Tested.	No key	Yes	19 Aug 2026
Have I Been Pwned Breaches	Free Have I Been Pwned breach list API with no key: every catalogued data breach with date, affected accounts and compromised data types. Tested curl example.	No key	Yes	19 Aug 2026
NVD CVE	Free NIST National Vulnerability Database API: search CVEs by id, keyword, severity, CVSS score and date with full descriptions and references. Tested example.	No key	Yes	19 Aug 2026
CIRCL CVE Search	Free CIRCL CVE Search API with no key: query vulnerabilities by id, vendor or product, and pull the latest published CVEs. CORS enabled. Tested example.	No key	Yes	19 Aug 2026
AlienVault OTX	Free AlienVault Open Threat Exchange API: look up domains, IPs, URLs and file hashes against community threat intelligence, malware and passive DNS. Tested.	No key	Yes	20 Aug 2026
Cert Spotter	Free SSLMate Cert Spotter API with no key: search certificate transparency logs for every TLS certificate issued for a domain, with issuer, SANs and validity dates.	No key	Yes	21 Aug 2026

All Security & Auth APIs

urlscan.io is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 20 Aug 2026; always check the official documentation before relying on this API in production, as terms and limits can change.