urlscan.io

Stop ongoing scans for an active urlscan Pro incident and transition it to the closed state. Closing does not delete the incident or its history, and the incident can later be restarted.

Untrusted display-only summary

Create a separate urlscan Pro incident from an existing incident's configuration. This create operation can consume incident capacity and does not copy the source incident's stored state history; use the distinct fork operation when history must be preserved. The provider does not document whether the copied incident…

Untrusted display-only summary

Create a Pro notification channel. This operation configures external effects: active webhook channels send requests to the supplied secret URL, and active email channels send messages to the supplied recipients. Confirm the destination and activation settings before calling.

Untrusted display-only summary

Create a Pro incident that persistently monitors an observable. This high-impact operation starts ongoing external scans and can send alerts through every supplied notification channel; confirm the observable, visibility, channels, cadence, and expiration settings before calling. The operation is contract-only because…

Untrusted display-only summary

Run a temporary Live Scan synchronously and return only after the provider finishes the scan. This requires the separate Live Scanning product.

Untrusted display-only summary

Start a non-blocking temporary Live Scan on a selected scanner and return its UUID immediately without waiting for completion. This external scan side effect requires the separate urlscan.io Live Scanning entitlement; a generic Pro plan may not include it.

Untrusted display-only summary

Create a reusable scans or hostnames search definition. This operation creates a persistent saved search and requires urlscan Pro; the hostnames datasource may require an additional product entitlement.

Untrusted display-only summary

Create a persistent scheduled or live alert subscription for saved searches. This Pro-only operation has external notification side effects: an active subscription can send email, invoke configured channels or webhooks, and create incidents. Confirm all recipients and channel or incident settings before calling.

Untrusted display-only summary

Permanently delete a scan owned by the connected user or team. This destructive operation cannot be reversed and requires urlscan Pro.

Untrusted display-only summary

Permanently delete a saved search by ID. This destructive operation cannot be undone and requires urlscan Pro saved-search access plus ownership or team write permission. Use it only for a saved search created or explicitly selected by the current workflow.

Untrusted display-only summary

Permanently delete an alert subscription by ID. This destructive operation cannot be undone and requires urlscan Pro subscriptions access plus ownership or team write permission. Use it only for a subscription created or explicitly selected by the current workflow.

Untrusted display-only summary

Retrieve a captured binary file by its SHA-256 hash as a password-encrypted ZIP archive. This operation requires urlscan Pro access.

Untrusted display-only summary

Create a new Pro incident by copying an existing incident's configuration and complete stored state history. This creates a separate persistent incident; history volume and whether monitoring starts immediately are not documented.

Untrusted display-only summary

Get non-sensitive plan, product, feature, visibility, submission, and limit information for the connected urlscan.io API key.

Untrusted display-only summary

Return detectable brands with detected-page totals and latest hits. This operation requires urlscan Pro access and uses the official contract only; the provider does not document its response fields.

Untrusted display-only summary

Get one urlscan Pro notification channel by ID while preserving provider-specific metadata and removing webhook destinations or credentials.

Untrusted display-only summary

Generate a temporary download URL for a path returned by LIST_DATA_DUMPS. Data Dumps require an Enterprise or Ultimate urlscan.io plan.

Untrusted display-only summary

Return the plain-text DOM snapshot captured for a completed scan.

Untrusted display-only summary

Return one page of historical Pro Hostnames observations for a hostname.

Untrusted display-only summary

Get one incident's configuration, source, runtime state, and timestamps.

Untrusted display-only summary

Retrieve the stored state history for an incident.

Untrusted display-only summary

Retrieve one temporary result, DOM, screenshot, captured response, or download from the separate urlscan.io Live Scanning product. JSON and text are returned inline; binary content is offloaded as a downloadable file.

Untrusted display-only summary

Retrieve the deprecated urlscan Pro phishing feed in JSON, CSV, or TSV. Prefer SEARCH_SCANS for new workflows, as recommended by urlscan.io.

Untrusted display-only summary

Get current products, features, query capabilities, and per-action minute, hour, and day quota usage.

Untrusted display-only summary

Return textual content captured in a scan response, addressed by its SHA-256 hash.

Untrusted display-only summary

Retrieve the complete metadata and captured request data for a completed scan UUID.

Untrusted display-only summary

Run a urlscan Pro saved search and return its current Search API results. The provider redirect is followed automatically; this operation does not expose pagination controls.

Untrusted display-only summary

Retrieve a completed urlscan.io scan screenshot as a downloadable PNG file reference.

Untrusted display-only summary

Find one page of scan results structurally similar to a specified scan. Requires urlscan Pro access.

Untrusted display-only summary

Resolve a urlscan Pro alert subscription and datasource to its current Search API results. The provider redirect is followed automatically; this operation does not expose pagination controls.

Untrusted display-only summary