> ## Documentation Index
> Fetch the complete documentation index at: https:// zenveil.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /v1/scan/api

> Scan an API endpoint for missing security headers and CORS misconfigurations.

## Endpoint

```
POST /v1/scan/api
```

## Request

### Headers

| Header | Value |
| - | - |
| `X-API-Key` | Your ZenVeil API key |
| `Content-Type` | `application/json` |

### Body

```json theme={null}
{
  "url": "https://api.your-app.com"
}
```

| Field | Type | Required | Description |
| - | - | - | - |
| `url` | string | Yes | The API base URL to scan. Must be publicly accessible. |

> [!WARNING]
>
> Private IP addresses, localhost, and loopback addresses are blocked (SSRF protection). Only publicly reachable URLs are accepted.

## Response

Same structure as `/v1/scan/github` — see [Scan GitHub](https:// zenveil.dev/docs/api-reference/scan-github.md) for the full schema.

```json theme={null}
{
  "scan_id": "b2c3d4e5f6g7",
  "status": "completed",
  "target_type": "api",
  "target": "https://api.your-app.com",
  "started_at": "2026-05-25T09:41:22Z",
  "completed_at": "2026-05-25T09:41:23Z",
  "finding_count": 2,
  "findings": [
    {
      "id": "ZG-H1I2J3",
      "category": "headers",
      "severity": "HIGH",
      "title": "Missing Content-Security-Policy",
      "description": "The Content-Security-Policy header is not set...",
      "evidence": "CSP header absent in HTTP response.",
      "location": {
        "target": "https://api.your-app.com",
        "url": "https://api.your-app.com",
        "method": "GET"
      },
      "scanner_name": "api_headers",
      "remediation": "Add Content-Security-Policy header with appropriate directives.",
      "confidence": 0.99,
      "owasp_categories": ["A05:2021"]
    }
  ]
}
```

## Examples

```bash curl theme={null}
curl -X POST https://api.zenveil.dev/v1/scan/api \
  -H "X-API-Key: zvk_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://api.your-app.com"}'
```

```python Python theme={null}
import httpx

response = httpx.post(
    "https://api.zenveil.dev/v1/scan/api",
    headers={"X-API-Key": "zvk_live_your_key"},
    json={"url": "https://api.your-app.com"},
)
result = response.json()
for finding in result["findings"]:
    print(f"[{finding['severity']}] {finding['title']}")
```

```javascript JavaScript theme={null}
const response = await fetch('https://api.zenveil.dev/v1/scan/api', {
  method: 'POST',
  headers: {
    'X-API-Key': 'zvk_live_your_key',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ url: 'https://api.your-app.com' }),
});
const result = await response.json();
```

## Error responses

| Status | Error | Cause |
| - | - | - |
| `400` | Could not reach target URL | URL is not publicly accessible or timed out |
| `400` | Bad request | URL contains a private IP address (SSRF protection) |
| `500` | Scan failed | Unexpected error |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.