Run a scan
Starts a scan of a website and saves it to your history. It answers straight away with the scan at running. Poll the saved scan until its status is no longer running, or poll the findings to get the report as soon as it is ready.
Limited to 10 requests a minute and 150 a day for each person, after which it answers 429 with a Retry-After header. Only scans that start count toward the daily limit.
Requires membership of the workspace.
AuthorizationBearer <JWT>An OpenID Connect access token from signing in to CentralCSP, acting as the signed-in user.
workspaceId*stringThe workspace's id.
application/json- body
tool*stringWhich scanner produced the scan. csp-scanner grades the Content Security Policy, header-scanner grades every security header, and reporting-api checks the reporting setup.
"csp-scanner""header-scanner""reporting-api"target*stringDomain or URL to scan.
1 <= length <= 2048followRedirects?booleanFollow redirects and scan where they land.
truelisted?booleanWhether the scan appears in your scan history. Set it to false for automated checks. The scan stays readable by its scanId either way.
trueA saved website scan and its outcome.
application/json- response
scanId*stringIdentifies the scan. Pass it as scanId to the other scan endpoints.
tool*stringWhich scanner produced the scan. csp-scanner grades the Content Security Policy, header-scanner grades every security header, and reporting-api checks the reporting setup.
"csp-scanner""header-scanner""reporting-api"target*stringDomain or URL that was scanned.
status*stringWhere the scan job stands: running until it finishes, then done or failed. A done scan may still have been unable to read the site (bot protection, an error page, an unreachable host): read state for what the scan came to.
"running""done""failed"state*stringWhat the scan came to: queued or running while it runs, completed when the site was read and graded, otherwise why it could not be: blocked (bot protection answered), site_error (the site answered an error page), not_found (the host does not resolve), unreachable (nothing answered), redirect_loop (too many redirects), refused (an address we do not scan) or failed (the scan produced no result).
"queued""running""completed""blocked""site_error""not_found""unreachable""redirect_loop""refused""failed"outcome*|nullerror*|nullhttpStatus*|nullurlAnalyzed*|nullfollowRedirects*booleanWhether the scan followed redirects.
scanResultId*stringIdentifies the scan's result in a share link. Anyone holding it can read the result, so treat it as a share token.
scores*|nullfindings*|nullcreatedAt*stringWhen the scan was started.
date-timefinishedAt*|nullcurl -X POST 'https://api.centralcsp.com/v1/workspaces/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/scans' \ -H 'Content-Type: application/json' \ -d '{ "tool": "csp-scanner", "target": "example.com"}'{ "scanId": "01a09f1b-76f9-7499-8734-038798d60789", "tool": "csp-scanner", "target": "example.com", "status": "done", "state": "completed", "outcome": "no_host", "error": "bot protection interstitial detected", "httpStatus": 403, "urlAnalyzed": "https://example.com/", "followRedirects": true, "scanResultId": "11132a50-38c2-4554-b967-40e599a28163", "scores": { "overall": 37, "security": 17, "quality": 94 }, "findings": { "critical": 0, "high": 3, "medium": 7, "low": 3, "info": 6, "total": 19 }, "createdAt": "2026-09-14T08:49:32.409Z", "finishedAt": "2026-09-14T08:49:32.830Z"}