ServerScan API

Read and manage your PCI ASV scanning from your own systems.

Authentication. Use your Scan Manager User Token. In Scan Manager, open Access Token and generate a User Token, then send it as Authorization: Bearer <token>. That one token is all you need: you create, replace and revoke it in Scan Manager, and a revoked token stops working here on the next call. Send the User Token, not the API Key shown on the same page. Tokens are never accepted in the query string, and browser sessions are refused. The examples read your token from a SCANMANAGER_TOKEN environment variable.

Paging. Collections take limit (1 to 100, default 25) and return next_cursor. Pass it back as cursor until it is null.

Base URL: https://www.serverscan.com/api/v1.

Targets

List your scan targets.

GET /targets

Parameters

`limit` query	integer
`cursor` query	string next_cursor from the previous page, passed back unchanged.

curl "https://www.serverscan.com/api/v1/targets" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/targets",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/targets", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/targets', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": [
        {
            "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
            "...": ""
        }
    ],
    "next_cursor": null
}

Register a scan target.

POST /targets

Body application/json

`name`	string
`hosts`	string
`comment`	string

curl -X POST "https://www.serverscan.com/api/v1/targets" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Main storefront","hosts":"shop.example.com","comment":"Quarterly external scan"}'

import os
import requests

resp = requests.request(
    "POST",
    "https://www.serverscan.com/api/v1/targets",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    json={"name": "Main storefront", "hosts": "shop.example.com", "comment": "Quarterly external scan"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/targets", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"name":"Main storefront","hosts":"shop.example.com","comment":"Quarterly external scan"}),
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('POST', 'https://www.serverscan.com/api/v1/targets', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
    'json' => ['name' => 'Main storefront', 'hosts' => 'shop.example.com', 'comment' => 'Quarterly external scan'],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 201 Created
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

How many more targets your licence allows.

GET /targets/allow

curl "https://www.serverscan.com/api/v1/targets/allow" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/targets/allow",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/targets/allow", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/targets/allow', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

Read one target.

GET /targets/{uuid}

Parameters

uuid
path, required string (uuid)

curl "https://www.serverscan.com/api/v1/targets/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/targets/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/targets/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/targets/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

Change a target.

PATCH /targets/{uuid}

Send only the fields you want to change. Everything else is kept.

Parameters

uuid
path, required string (uuid)

Body application/json

`name`	string
`hosts`	string
`comment`	string

curl -X PATCH "https://www.serverscan.com/api/v1/targets/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Main storefront","hosts":"shop.example.com","comment":"Quarterly external scan"}'

import os
import requests

resp = requests.request(
    "PATCH",
    "https://www.serverscan.com/api/v1/targets/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    json={"name": "Main storefront", "hosts": "shop.example.com", "comment": "Quarterly external scan"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/targets/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35", {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"name":"Main storefront","hosts":"shop.example.com","comment":"Quarterly external scan"}),
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('PATCH', 'https://www.serverscan.com/api/v1/targets/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
    'json' => ['name' => 'Main storefront', 'hosts' => 'shop.example.com', 'comment' => 'Quarterly external scan'],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

Remove a target.

DELETE /targets/{uuid}

Parameters

uuid
path, required string (uuid)

curl -X DELETE "https://www.serverscan.com/api/v1/targets/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "DELETE",
    "https://www.serverscan.com/api/v1/targets/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()

const resp = await fetch("https://www.serverscan.com/api/v1/targets/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35", {
  method: "DELETE",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('DELETE', 'https://www.serverscan.com/api/v1/targets/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);

Example response

HTTP/1.1 204 No Content

Scans

List your scans.

GET /scans

Parameters

`limit` query	integer
`cursor` query	string next_cursor from the previous page, passed back unchanged.

curl "https://www.serverscan.com/api/v1/scans" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/scans",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/scans", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/scans', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": [
        {
            "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
            "...": ""
        }
    ],
    "next_cursor": null
}

Create a scan and start it. Uses one licence; send an Idempotency-Key.

POST /scans

Requires an Idempotency-Key header. Repeating a key with the same body returns the first answer, marked Idempotent-Replayed: true, instead of creating a second scan.

Parameters

Idempotency-Key
header, required string

Body application/json

`name`	string
`comment`	string
`target_id`	string (uuid)
`schedule_id`	string (uuid)
`notification_ids`	array of string (uuid)

curl -X POST "https://www.serverscan.com/api/v1/scans" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN" \
  -H "Idempotency-Key: create-scan-2026-09-18-001" \
  -H "Content-Type: application/json" \
  -d '{"name":"Q4 external scan","comment":"string","target_id":"3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35","schedule_id":"3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35","notification_ids":["3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35"]}'

import os
import requests

resp = requests.request(
    "POST",
    "https://www.serverscan.com/api/v1/scans",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}", "Idempotency-Key": "create-scan-2026-09-18-001"},
    json={"name": "Q4 external scan", "comment": "string", "target_id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35", "schedule_id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35", "notification_ids": ["3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35"]},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/scans", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
    "Idempotency-Key": "create-scan-2026-09-18-001",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"name":"Q4 external scan","comment":"string","target_id":"3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35","schedule_id":"3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35","notification_ids":["3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35"]}),
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('POST', 'https://www.serverscan.com/api/v1/scans', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
        'Idempotency-Key' => 'create-scan-2026-09-18-001',
    ],
    'json' => ['name' => 'Q4 external scan', 'comment' => 'string', 'target_id' => '3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35', 'schedule_id' => '3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35', 'notification_ids' => ['3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35']],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 201 Created
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35"
    },
    "started": true
}

Read one scan and its status.

GET /scans/{uuid}

Parameters

uuid
path, required string (uuid)

curl "https://www.serverscan.com/api/v1/scans/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/scans/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/scans/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/scans/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

Stop a running scan.

POST /scans/{uuid}/stop

Parameters

uuid
path, required string (uuid)

curl -X POST "https://www.serverscan.com/api/v1/scans/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/stop" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "POST",
    "https://www.serverscan.com/api/v1/scans/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/stop",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/scans/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/stop", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('POST', 'https://www.serverscan.com/api/v1/scans/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/stop', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

List the reports one scan produced.

GET /scans/{uuid}/reports

Parameters

`uuid` path, required	string (uuid)
`limit` query	integer
`cursor` query	string next_cursor from the previous page, passed back unchanged.

curl "https://www.serverscan.com/api/v1/scans/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/reports" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/scans/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/reports",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/scans/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/reports", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/scans/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/reports', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": [
        {
            "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
            "...": ""
        }
    ],
    "next_cursor": null
}

Schedules

List your schedules.

GET /schedules

Parameters

`limit` query	integer
`cursor` query	string next_cursor from the previous page, passed back unchanged.

curl "https://www.serverscan.com/api/v1/schedules" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/schedules",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/schedules", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/schedules', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": [
        {
            "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
            "...": ""
        }
    ],
    "next_cursor": null
}

Create a schedule.

POST /schedules

Body application/json

`name`	string
`comment`	string
`first_time`	string
`period`	string
`period_unit`	string
`duration`	string
`duration_unit`	string
`timezone`	string
`byday`	string
`bymonthday`	string

curl -X POST "https://www.serverscan.com/api/v1/schedules" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Quarterly","comment":"string","first_time":"string","period":"string","period_unit":"string","duration":"string","duration_unit":"string","timezone":"string","byday":"string","bymonthday":"string"}'

import os
import requests

resp = requests.request(
    "POST",
    "https://www.serverscan.com/api/v1/schedules",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    json={"name": "Quarterly", "comment": "string", "first_time": "string", "period": "string", "period_unit": "string", "duration": "string", "duration_unit": "string", "timezone": "string", "byday": "string", "bymonthday": "string"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/schedules", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"name":"Quarterly","comment":"string","first_time":"string","period":"string","period_unit":"string","duration":"string","duration_unit":"string","timezone":"string","byday":"string","bymonthday":"string"}),
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('POST', 'https://www.serverscan.com/api/v1/schedules', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
    'json' => ['name' => 'Quarterly', 'comment' => 'string', 'first_time' => 'string', 'period' => 'string', 'period_unit' => 'string', 'duration' => 'string', 'duration_unit' => 'string', 'timezone' => 'string', 'byday' => 'string', 'bymonthday' => 'string'],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 201 Created
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

The values a schedule accepts.

GET /schedules/options

curl "https://www.serverscan.com/api/v1/schedules/options" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/schedules/options",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/schedules/options", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/schedules/options', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

Read one schedule.

GET /schedules/{uuid}

Parameters

uuid
path, required string (uuid)

curl "https://www.serverscan.com/api/v1/schedules/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/schedules/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/schedules/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/schedules/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

Change a schedule.

PATCH /schedules/{uuid}

Send only the fields you want to change. Everything else is kept.

Parameters

uuid
path, required string (uuid)

Body application/json

`name`	string
`comment`	string
`first_time`	string
`period`	string
`period_unit`	string
`duration`	string
`duration_unit`	string
`timezone`	string
`byday`	string
`bymonthday`	string

curl -X PATCH "https://www.serverscan.com/api/v1/schedules/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Quarterly","comment":"string","first_time":"string","period":"string","period_unit":"string","duration":"string","duration_unit":"string","timezone":"string","byday":"string","bymonthday":"string"}'

import os
import requests

resp = requests.request(
    "PATCH",
    "https://www.serverscan.com/api/v1/schedules/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    json={"name": "Quarterly", "comment": "string", "first_time": "string", "period": "string", "period_unit": "string", "duration": "string", "duration_unit": "string", "timezone": "string", "byday": "string", "bymonthday": "string"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/schedules/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35", {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"name":"Quarterly","comment":"string","first_time":"string","period":"string","period_unit":"string","duration":"string","duration_unit":"string","timezone":"string","byday":"string","bymonthday":"string"}),
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('PATCH', 'https://www.serverscan.com/api/v1/schedules/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
    'json' => ['name' => 'Quarterly', 'comment' => 'string', 'first_time' => 'string', 'period' => 'string', 'period_unit' => 'string', 'duration' => 'string', 'duration_unit' => 'string', 'timezone' => 'string', 'byday' => 'string', 'bymonthday' => 'string'],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

Remove a schedule.

DELETE /schedules/{uuid}

Parameters

uuid
path, required string (uuid)

curl -X DELETE "https://www.serverscan.com/api/v1/schedules/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "DELETE",
    "https://www.serverscan.com/api/v1/schedules/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()

const resp = await fetch("https://www.serverscan.com/api/v1/schedules/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35", {
  method: "DELETE",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('DELETE', 'https://www.serverscan.com/api/v1/schedules/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);

Example response

HTTP/1.1 204 No Content

Reports

List your reports.

GET /reports

Parameters

`limit` query	integer
`cursor` query	string next_cursor from the previous page, passed back unchanged.

curl "https://www.serverscan.com/api/v1/reports" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/reports",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/reports", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/reports', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": [
        {
            "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
            "...": ""
        }
    ],
    "next_cursor": null
}

Read one report.

GET /reports/{uuid}

Parameters

uuid
path, required string (uuid)

curl "https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

Read one report in full, findings included.

GET /reports/{uuid}/details

The report with every finding in `results`. This is where findings are read: there is no separate results endpoint.

Parameters

uuid
path, required string (uuid)

curl "https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/details" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/details",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/details", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/details', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

Ask for a report document to be generated.

POST /reports/{uuid}/generate

Parameters

`uuid` path, required	string (uuid)
`type` query	string

curl -X POST "https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/generate" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "POST",
    "https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/generate",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/generate", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('POST', 'https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/generate', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

Download the detailed report as a PDF.

GET /reports/{uuid}/pdf

The PDF must be generated first with POST /reports/{uuid}/generate. Until it is ready this answers 404 not_found, with a message saying so.

Parameters

uuid
path, required string (uuid)

curl "https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/pdf" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN" \
  -o report.pdf

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/pdf",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
open("report.pdf", "wb").write(resp.content)

const resp = await fetch("https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/pdf", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
await require("fs/promises").writeFile("report.pdf", Buffer.from(await resp.arrayBuffer()));

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/reports/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35/pdf', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
    'sink' => 'report.pdf',
]);

Example response

HTTP/1.1 200 OK
Content-Type: application/pdf
Content-Disposition: attachment; filename="serverscan-report-3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35.pdf"

%PDF-1.7 ...

Exceptions

List the exceptions you have raised.

GET /exceptions

Parameters

`limit` query	integer
`cursor` query	string next_cursor from the previous page, passed back unchanged.

curl "https://www.serverscan.com/api/v1/exceptions" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/exceptions",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/exceptions", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/exceptions', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": [
        {
            "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
            "...": ""
        }
    ],
    "next_cursor": null
}

Read one exception.

GET /exceptions/{uuid}

Parameters

uuid
path, required string (uuid)

curl "https://www.serverscan.com/api/v1/exceptions/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/exceptions/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/exceptions/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/exceptions/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

Withdraw an exception.

DELETE /exceptions/{uuid}

Parameters

uuid
path, required string (uuid)

curl -X DELETE "https://www.serverscan.com/api/v1/exceptions/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "DELETE",
    "https://www.serverscan.com/api/v1/exceptions/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()

const resp = await fetch("https://www.serverscan.com/api/v1/exceptions/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35", {
  method: "DELETE",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('DELETE', 'https://www.serverscan.com/api/v1/exceptions/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);

Example response

HTTP/1.1 204 No Content

Notifications

List your notification rules.

GET /notifications

Parameters

`limit` query	integer
`cursor` query	string next_cursor from the previous page, passed back unchanged.

curl "https://www.serverscan.com/api/v1/notifications" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "GET",
    "https://www.serverscan.com/api/v1/notifications",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/notifications", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('GET', 'https://www.serverscan.com/api/v1/notifications', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": [
        {
            "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
            "...": ""
        }
    ],
    "next_cursor": null
}

Create a notification rule.

POST /notifications

Body application/json

`name`	string
`to_address`	string
`status_changed`	string
`severity_at_least`	string

curl -X POST "https://www.serverscan.com/api/v1/notifications" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Security team","to_address":"[email protected]","status_changed":"string","severity_at_least":"string"}'

import os
import requests

resp = requests.request(
    "POST",
    "https://www.serverscan.com/api/v1/notifications",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    json={"name": "Security team", "to_address": "[email protected]", "status_changed": "string", "severity_at_least": "string"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/notifications", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"name":"Security team","to_address":"[email protected]","status_changed":"string","severity_at_least":"string"}),
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('POST', 'https://www.serverscan.com/api/v1/notifications', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
    'json' => ['name' => 'Security team', 'to_address' => '[email protected]', 'status_changed' => 'string', 'severity_at_least' => 'string'],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 201 Created
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

Change a notification rule.

PATCH /notifications/{uuid}

Send only the fields you want to change. Everything else is kept.

Parameters

uuid
path, required string (uuid)

Body application/json

`name`	string
`to_address`	string
`status_changed`	string
`severity_at_least`	string

curl -X PATCH "https://www.serverscan.com/api/v1/notifications/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Security team","to_address":"[email protected]","status_changed":"string","severity_at_least":"string"}'

import os
import requests

resp = requests.request(
    "PATCH",
    "https://www.serverscan.com/api/v1/notifications/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    json={"name": "Security team", "to_address": "[email protected]", "status_changed": "string", "severity_at_least": "string"},
    timeout=60,
)
resp.raise_for_status()
print(resp.json())

const resp = await fetch("https://www.serverscan.com/api/v1/notifications/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35", {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"name":"Security team","to_address":"[email protected]","status_changed":"string","severity_at_least":"string"}),
});
if (!resp.ok) throw new Error((await resp.json()).error.code);
console.log(await resp.json());

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('PATCH', 'https://www.serverscan.com/api/v1/notifications/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
    'json' => ['name' => 'Security team', 'to_address' => '[email protected]', 'status_changed' => 'string', 'severity_at_least' => 'string'],
]);
print_r(json_decode((string) $resp->getBody(), true));

Example response

HTTP/1.1 200 OK
Content-Type: application/json
X-Request-Id: 9f1c2e7a4b6d8e03

{
    "data": {
        "id": "3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
        "...": ""
    }
}

Remove a notification rule.

DELETE /notifications/{uuid}

Parameters

uuid
path, required string (uuid)

curl -X DELETE "https://www.serverscan.com/api/v1/notifications/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35" \
  -H "Authorization: Bearer $SCANMANAGER_TOKEN"

import os
import requests

resp = requests.request(
    "DELETE",
    "https://www.serverscan.com/api/v1/notifications/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35",
    headers={"Authorization": f"Bearer {os.environ['SCANMANAGER_TOKEN']}"},
    timeout=60,
)
resp.raise_for_status()

const resp = await fetch("https://www.serverscan.com/api/v1/notifications/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35", {
  method: "DELETE",
  headers: {
    Authorization: `Bearer ${process.env.SCANMANAGER_TOKEN}`,
  },
});
if (!resp.ok) throw new Error((await resp.json()).error.code);

<?php
$client = new GuzzleHttp\Client(['timeout' => 60]);
$resp = $client->request('DELETE', 'https://www.serverscan.com/api/v1/notifications/3f2c8a1e-5b7d-4c9e-9a61-2d4e8f0b7c35', [
    'headers' => [
        'Authorization' => 'Bearer ' . getenv('SCANMANAGER_TOKEN'),
    ],
]);

Example response

HTTP/1.1 204 No Content

Errors

Branch on code, not on message. Codes keep their meaning and status for the life of v1.

Status	Code	Meaning
401	`missing_token`	Send your Scan Manager User Token as "Authorization: Bearer <token>".
401	`invalid_token`	That token was not accepted. Generate a new User Token on the Access Token page in Scan Manager.
403	`wrong_auth_method`	This API accepts only a bearer token. Browser sessions are refused.
403	`not_enabled`	API access is not enabled for this account yet.
403	`forbidden`	You do not have access to this.
403	`account_blocked`	This ServerScan account is closed. Contact support and quote the request id.
403	`account_not_linked`	That token works in Scan Manager, but it is not linked to a ServerScan account. Contact support and quote the request id.
404	`not_found`	Not found.
405	`method_not_allowed`	Method not allowed on this path.
422	`invalid_request`	The request is not valid.
415	`unsupported_media_type`	Send the request body as application/json.
413	`payload_too_large`	The request body is too large.
409	`idempotency_conflict`	That Idempotency-Key was already used with a different request.
409	`idempotency_in_progress`	A request with that Idempotency-Key is still being processed.
429	`rate_limited`	Too many requests. Slow down and retry after the Retry-After interval.
502	`upstream_error`	The scanning platform returned an error. Retry later, and quote the request id if it persists.
504	`upstream_timeout`	The scanning platform did not answer in time. Retry later.
502	`upstream_too_large`	The scanning platform returned more data than this API forwards.
500	`internal_error`	Something went wrong on our side. Quote the request id to support.

Every error

{
  "error": {
    "code": "invalid_token",
    "message": "That token was not accepted. Generate a new User Token on the Access Token page in Scan Manager.",
    "request_id": "9f1c2e7a4b6d8e03"
  }
}

Main navigation

ServerScan API

ServerScan API

Targets

List your scan targets.

Parameters

Register a scan target.

Body application/json

How many more targets your licence allows.

Read one target.

Parameters

Change a target.

Parameters

Body application/json

Remove a target.

Parameters

Scans

List your scans.

Parameters

Create a scan and start it. Uses one licence; send an Idempotency-Key.

Parameters

Body application/json

Read one scan and its status.

Parameters

Stop a running scan.

Parameters

List the reports one scan produced.

Parameters

Schedules

List your schedules.

Parameters

Create a schedule.

Body application/json

The values a schedule accepts.

Read one schedule.

Parameters

Change a schedule.

Parameters

Body application/json

Remove a schedule.

Parameters

Reports

List your reports.

Parameters

Read one report.

Parameters

Read one report in full, findings included.

Parameters

Ask for a report document to be generated.

Parameters

Download the detailed report as a PDF.

Parameters

Exceptions

List the exceptions you have raised.

Parameters

Read one exception.

Parameters

Withdraw an exception.

Parameters

Notifications

List your notification rules.

Parameters

Create a notification rule.

Body application/json

Change a notification rule.

Parameters

Body application/json

Remove a notification rule.

Parameters

Errors