Integrate automated website QA, continuous regression monitoring, and CI/CD quality gates into your engineering pipelines and agency workflows.
All requests to the ScanFix API require an active API key generated from the Agency Settings → API Keys dashboard. Pass your key in the standard Authorization: Bearer sc_live_... header or the x-api-key: sc_live_... header.
websites:read — View client websiteswebsites:write — Register & delete sitesscans:read — Fetch audit & scan findingsscans:write — Trigger scans & CI/CD gatesissues:read — Query detected issuesissues:write — Update issue status & noteswebhooks:* — Webhook managementautomations:* — Automation rules engine| Method | Endpoint | Required Scope | Description |
|---|---|---|---|
| GET | /api/v1/websites | websites:read | List websites with pagination & search |
| POST | /api/v1/websites | websites:write | Add website with SSRF validation |
| POST | /api/v1/scans | scans:write | Trigger scan (202 Async or Sync wait) |
| GET | /api/v1/scans/:id | scans:read | Fetch normalized machine-readable results |
| GET | /api/v1/scans/:id/export | scans:read | Download scan findings as CSV or JSON |
| POST | /api/v1/quality-gates | scans:read | Evaluate CI/CD thresholds (200 or 422) |
| POST | /api/v1/bulk-scans | scans:write | Queue audit batch for multiple URLs |
| GET | /api/v1/automations | automations:read | List automation rules & conditions |
Use Quality Gates to block deployment pull requests if health scores drop or if regressions are detected. Returns HTTP 200 on success and HTTP 422 with detailed threshold evaluations on failure.
name: ScanFix Quality Gate
on: [push, pull_request]
jobs:
qa_gate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run ScanFix CI/CD Quality Gate
run: |
RESPONSE=$(curl -s -X POST https://app.scanfix.dev/api/v1/quality-gates \
-H "Authorization: Bearer ${{ secrets.SCANFIX_API_KEY }}" \
-H "Content-Type: application/json" \
-d '{
"url": "https://staging.example.com",
"config": {
"minimum_score": 85,
"maximum_critical": 0,
"maximum_regressions": 0
}
}')
echo "$RESPONSE"
PASSED=$(echo "$RESPONSE" | grep -o '"passed":true' || true)
if [ -z "$PASSED" ]; then
echo "Quality Gate Failed!"
exit 1
fi
echo "Quality Gate Passed!"ScanFix webhooks deliver real-time notifications for scan completions, regression detections, and monitoring incidents. Every request includes cryptographic HMAC SHA-256 headers:
curl -X POST https://app.scanfix.dev/api/v1/scans \
-H "Authorization: Bearer sc_live_YOUR_API_KEY" \
-H "Idempotency-Key: scan-deploy-$(date +%s)" \
-H "Content-Type: application/json" \
-d '{
"url": "https://example.com",
"wait": false
}'