ScanFix Developer Platform

Integrate automated website QA, continuous regression monitoring, and CI/CD quality gates into your engineering pipelines and agency workflows.

Base URL
https://app.scanfix.dev/api/v1
Authentication
Bearer Token / x-api-key
API Version
2026-01 (OpenAPI 3.1)
CLI Tool
npx scanfix --help

1. Authentication & Granular Scopes

All requests to the ScanFix API require an active API key generated from the Agency Settings → API Keys dashboard. Pass your key in the standard Authorization: Bearer sc_live_... header or the x-api-key: sc_live_... header.

Available API Key Scopes:
websites:read — View client websites
websites:write — Register & delete sites
scans:read — Fetch audit & scan findings
scans:write — Trigger scans & CI/CD gates
issues:read — Query detected issues
issues:write — Update issue status & notes
webhooks:* — Webhook management
automations:* — Automation rules engine

2. Core REST Endpoints

MethodEndpointRequired ScopeDescription
GET/api/v1/websiteswebsites:readList websites with pagination & search
POST/api/v1/websiteswebsites:writeAdd website with SSRF validation
POST/api/v1/scansscans:writeTrigger scan (202 Async or Sync wait)
GET/api/v1/scans/:idscans:readFetch normalized machine-readable results
GET/api/v1/scans/:id/exportscans:readDownload scan findings as CSV or JSON
POST/api/v1/quality-gatesscans:readEvaluate CI/CD thresholds (200 or 422)
POST/api/v1/bulk-scansscans:writeQueue audit batch for multiple URLs
GET/api/v1/automationsautomations:readList automation rules & conditions

3. CI/CD Quality Gate Pipeline

Use Quality Gates to block deployment pull requests if health scores drop or if regressions are detected. Returns HTTP 200 on success and HTTP 422 with detailed threshold evaluations on failure.

.github/workflows/scanfix.yml
name: ScanFix Quality Gate
on: [push, pull_request]

jobs:
  qa_gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run ScanFix CI/CD Quality Gate
        run: |
          RESPONSE=$(curl -s -X POST https://app.scanfix.dev/api/v1/quality-gates \
            -H "Authorization: Bearer ${{ secrets.SCANFIX_API_KEY }}" \
            -H "Content-Type: application/json" \
            -d '{
              "url": "https://staging.example.com",
              "config": {
                "minimum_score": 85,
                "maximum_critical": 0,
                "maximum_regressions": 0
              }
            }')
          echo "$RESPONSE"
          PASSED=$(echo "$RESPONSE" | grep -o '"passed":true' || true)
          if [ -z "$PASSED" ]; then
            echo "Quality Gate Failed!"
            exit 1
          fi
          echo "Quality Gate Passed!"

4. Webhooks & HMAC SHA-256 Signatures

ScanFix webhooks deliver real-time notifications for scan completions, regression detections, and monitoring incidents. Every request includes cryptographic HMAC SHA-256 headers:

x-scanfix-signature: t=1773750000,v1=a5c8...
x-scanfix-event: scan.completed
x-scanfix-event-id: evt_83f2a1b0c9
x-scanfix-version: 2026-01
Quickstart Request
curl -X POST https://app.scanfix.dev/api/v1/scans \
  -H "Authorization: Bearer sc_live_YOUR_API_KEY" \
  -H "Idempotency-Key: scan-deploy-$(date +%s)" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com",
    "wait": false
  }'