# User Login
Source: https://docs.scorton.tech/api-reference/endpoint/auth/post_login
POST /auth/login
Authenticate a user and obtain an access token.\
This endpoint verifies the user's email and password, checks the user role (`user`), and returns a JWT token upon successful authentication.
## Request Body
The user's email address
The user's password
## Example Request
```bash theme={null}
curl -X POST "https://api.scorton.tech/auth/login" \
-H "Content-Type: application/json" \
-d '{
"email": "user@example.com",
"password": "StrongPassword123!"
}'
```
## Example Response
```json theme={null}
{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "TokenType"
}
```
## Success Response
| Status | Description |
| ---------- | ------------------------------------------------------------------------------ |
| **200 OK** | User authenticated successfully; returns `access_token`, `role`, and `user_id` |
## Error Responses
| Status | Description | Example |
| ----------------------------- | ------------------------------------ | ---------------------------------------------------------- |
| **401 Unauthorized** | Invalid credentials or role mismatch | `json { "detail": "Unauthorized: Invalid credentials." } ` |
| **404 Not Found** | User email not found | `json { "detail": "Not Found: User not found." } ` |
| **500 Internal Server Error** | Unexpected server error | `json { "detail": "An unexpected error occurred" } ` |
# Run scan
Source: https://docs.scorton.tech/api-reference/endpoint/scans/post_scan
POST /scans/scan
Run one or multiple scan tools on a given target (e.g., `dns`, `ports`, `ssl`, `headers`, `whois`).\
Requires a valid authentication token in the `AUTH` header.
## Headers
Authentication token (JWT) obtained from the `/auth/login` endpoint
## Request Body
The domain to scan with http or https prefix
List of scan types to perform.\
Available values: `dns`, `ports`
/!\ These tools are still work in progress, new tools will be added soon.
## Example Request
````bash theme={null}
curl -X POST "https://api.scorton.tech/scans/" \
-H "AUTH: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
-H "Content-Type: application/json" \
-d '{
"target": "example.com",
"scans": ["dns", "ports", "ssl"]
}'
## Example Response
```json
{
"target": "https://scorton.tech",
"performed_scans": ["type1", "type2"],
"results": {
"type1": {
"data": "example data"
},
"type2": {
"data": "example data"
},
}
}
````
## Success Response
| Status | Description |
| ------- | ------------------------ |
| **200** | Returns the scan results |
## Error Responses
| Status | Description | Example |
| ------- | --------------------------- | ----------------------------------------------------------------------------------------------------- |
| **400** | Missing or invalid argument | `{ "detail": "Bad request: Missing target." }, { "detail": "Bad Request: No scan types specified." }` |
| **401** | Missing or invalid token | `{ "detail": "Unauthorized: Invalid or expired token." } ` |
| **403** | Account not validated yet | `{ "detail": "Forbidden: Account is not validated yet." } ` |
| **404** | User not found | `{ "detail": "Not Found: User does not exist." } ` |
# Run score
Source: https://docs.scorton.tech/api-reference/endpoint/scans/post_score
POST /scans/score
Run one or multiple scan tools on a given target (e.g., `dns`, `ports`, `ssl`, `headers`, `whois`) and calculates a score based on the result.\
Requires a valid authentication token in the `AUTH` header.
## Headers
Authentication token (JWT) obtained from the `/auth/login` endpoint
## Request Body
The domain to scan with http or https prefix
List of scan types to perform.\
Available values: `dns`, `ports`
/!\ These tools are still work in progress, new tools will be added soon.
## Example Request
````bash theme={null}
curl -X POST "https://api.scorton.tech/scans/" \
-H "AUTH: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
-H "Content-Type: application/json" \
-d '{
"target": "example.com",
"scans": ["dns", "ports", "ssl"]
}'
## Example Response
```json
{
"target": "https://scorton.tech",
"performed_scans": ["type1", "type2"],
"global_score": 100,
"results": {
"type1": {
"score": 100,
"data": "example data"
},
"type2": {
"score": 100,
"data": "example data"
},
}
}
````
## Success Response
| Status | Description |
| ------- | ------------------------ |
| **200** | Returns the scan results |
## Error Responses
| Status | Description | Example |
| ------- | --------------------------- | ----------------------------------------------------------------------------------------------------- |
| **400** | Missing or invalid argument | `{ "detail": "Bad request: Missing target." }, { "detail": "Bad Request: No scan types specified." }` |
| **401** | Missing or invalid token | `{ "detail": "Unauthorized: Invalid or expired token." } ` |
| **403** | Account not validated yet | `{ "detail": "Forbidden: Account is not validated yet." } ` |
| **404** | User not found | `{ "detail": "Not Found: User does not exist." } ` |
# Delete User
Source: https://docs.scorton.tech/api-reference/endpoint/users/delete_me
DELETE /users/me
Delete the currently authenticated user's account permanently.\
Requires a valid authentication token in the `AUTH` header.
## Headers
Authentication token (JWT) obtained from the `/auth/login` endpoint
## Example Request
```bash theme={null}
curl -X DELETE "https://api.scorton.tech/users/me" \
-H "AUTH: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
```
## Example Response
```json theme={null}
{
"detail": "Ok: User successfully deleted."
}
```
## Success Response
| Status | Description |
| ------- | ------------------------- |
| **200** | User deleted successfully |
## Error Responses
| Status | Description | Example |
| ------- | ------------------------ | ----------------------------------------------------------- |
| **401** | Missing or invalid token | `{ "detail": "Unauthorized: Invalid or expired token." } ` |
| **403** | Account not validated | `{ "detail": "Forbidden: Account is not validated yet." } ` |
| **404** | User not found | `{ "detail": "Not Found: User does not exist." } ` |
# Get User
Source: https://docs.scorton.tech/api-reference/endpoint/users/get_me
GET /users/user
Retrieve the user's profile.
Requires a valid authentication token in the `AUTH` header.
## Headers
Authentication token (JWT) obtained from the `/auth/login` endpoint
## Example Request
```bash theme={null}
curl -X GET "https://api.scorton.tech/users/me" \
-H "AUTH: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
```
## Example Response
```json theme={null}
{
"id": "123456789",
"email": "user@example.com",
"role": "user"
}
```
## Success Response
| Status | Description |
| ------- | ---------------------------------------- |
| **200** | Returns the authenticated user's details |
## Error Responses
| Status | Description | Example |
| ------- | ------------------------- | ----------------------------------------------------------- |
| **401** | Missing or invalid token | `{ "detail": "Unauthorized: Invalid or expired token." } ` |
| **403** | Account not validated yet | `{ "detail": "Forbidden: Account is not validated yet." } ` |
| **404** | User not found | `{ "detail": "Not Found: User does not exist." } ` |
# Edit User
Source: https://docs.scorton.tech/api-reference/endpoint/users/put_me
PUT /users/me
Update user information such as email or password.\
Requires a valid authentication token in the `AUTH` header.
## Headers
Authentication token (JWT) obtained from the `/auth/login` endpoint
## Request Body
The new email address of the user
The new password for the account
## Example Request
```bash theme={null}
curl -X PUT "https://api.example.com/users/me" \
-H "Content-Type: application/json" \
-H "AUTH: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
-d '{
"email": "newmail@example.com",
"password": "NewPass456!"
}'
```
## Example Response
```json theme={null}
{
"id": "123456789",
"email": "newmail@example.com",
"role": "user"
}
```
## Success Response
| Status | Description |
| ------- | ------------------------- |
| **200** | User updated successfully |
## Error Responses
| Status | Description | Example |
| ------- | ------------------------ | ----------------------------------------------------------- |
| **400** | Invalid input | `{ "detail": "Invalid input format." } ` |
| **401** | Invalid or missing token | `{ "detail": "Unauthorized: Invalid or expired token." } ` |
| **403** | Account not validated | `{ "detail": "Forbidden: Account is not validated yet." } ` |
# Introduction
Source: https://docs.scorton.tech/introduction
Official documentation for the Scorton API — powering Cyberscor with advanced cybersecurity scanning capabilities.
![Scorton Hero Dark]()
![Scorton Hero Light]()
## Welcome to Scorton API
The **Scorton API** is the backbone of **Cyberscor**, providing a comprehensive suite of cybersecurity scanning tools.\
It enables the automated analysis of domains and IPs through multiple integrated modules to assess vulnerabilities, configuration issues, and security posture.
***
## Getting Started
Learn how to authenticate and securely access the Scorton API.
Run your first target scan and analyze its security status in seconds.
***
## Available scan features
These features are now available from the scanning tool of the API.
Inspect domain records to identify potential misconfigurations.
Detect exposed services and assess their security risk.
## Work in progress scan features
These features will be added soon to the list of scan tools.
Retrieve domain registration and ownership details.
Evaluate HTTP headers for missing or insecure configurations.
Verify certificate validity and encryption strength.
Identify cross-site scripting vulnerabilities.
Inspect cookies for secure, HttpOnly, and SameSite flags.
Generate a global security score for each analyzed target.
# Verify API Key
Source: https://docs.scorton.tech/scorton_radar/get_verify_key
GET /verify-key
Verify an API key for a registered user.\
Requires a generated API key to verify.
## Header
Generated API key obtained from the `/generated-key` endpoint
## Example Request
```bash theme={null}
curl -X 'GET' \
'https://radar.scorton.tech/verify-key' \
-H 'accept: application/json' \
-H 'x-api-key: example_key'
```
## Example Response
```json theme={null}
{
"status": "success",
"message": "API Key valide",
"data": {
"api_key": "example_key",
"api_key_id": 0,
"client_id": 0,
"level": "free"
}
}
```
## Success Response
| Status | Description |
| ------- | ----------- |
| **200** | Returns |
## Error Responses
| Status | Description | Example |
| ------- | --------------- | ------------------------------------------ |
| **401** | Invalid API key | `json { "detail": "Clé API invalide" } ` |
# Metadata
Source: https://docs.scorton.tech/scorton_radar/metadata
Detailed explanation of metadata and scores used in url scanning.
# Structure of Results
Each technical analysis generates a set of metadata grouped by category.
These indicators help understand the strengths and weaknesses of a domain or scanned service.
Categories include:
* **Technical Hygiene**
* **Network Exposure**
* **Reputation & Threats**
* **Public Data**
* **Vulnerabilities**
* **URL / Domain**
* **AI / Technical Scores**
***
## Technical Hygiene
| Key | Description |
| -------------------------------------------------------- | ----------------------------------------------------------------------------- |
| **TLS\_strength** | Quality of TLS/SSL encryption (e.g., TLS 1.3 = strong, TLS 1.0 = weak) |
| **TLS\_expiry\_days** | Number of days before SSL certificate expiration |
| **cert\_self\_signed** | Indicates whether the certificate is self-signed (not issued by a trusted CA) |
| **cert\_cn** | Common Name of the certificate, usually matching the domain name |
| **san\_count** | Number of *Subject Alternative Names* included in the certificate |
| **CSP\_completeness** | Coverage level of the *Content Security Policy* (CSP) |
| **Security\_headers\_count** | Number of security-related HTTP headers detected |
| **CSRF\_protection** | Indicates whether CSRF protection is enabled |
| **Secure\_cookie\_flag** | Whether cookies are marked as *Secure* |
| **CSP\_header**, **HSTS\_header**, **X\_Frame\_Options** | Binary indicators for the presence of key HTTP headers |
***
## Network Exposure
| Key | Description |
| ---------------------------- | ------------------------------------------------------------------------------ |
| **Nb\_ports\_open** | Number of open TCP ports detected |
| **Risky\_service\_detected** | Indicates the presence of sensitive or risky services (e.g., SSH, FTP, Telnet) |
| **GeoIP\_risk** | Geographic risk associated with the IP address |
| **Hosting\_type** | Hosting type (cloud, shared, dedicated, etc.) |
***
## Reputation & Threats
| Key | Description |
| ------------------------------------------ | ----------------------------------------------------------------------- |
| **Blacklist\_hits** | Number of blacklists in which the domain appears |
| **Nb\_credential\_leaks** | Number of credential leaks associated with the domain |
| **Presence\_databreach** | Whether the domain appears in known data breach databases |
| **Oldest\_breach\_year** | Year of the oldest detected breach |
| **Darkweb\_mentions** | Number of mentions found on dark web sources |
| **Tracker\_detected** / **Tracker\_found** | Presence and types of trackers found on the site (ads, analytics, etc.) |
***
## Public Data
| Key | Description |
| ------------------------- | ----------------------------------------------- |
| **Metadata\_exposure** | Sensitive information exposed publicly |
| **Metadata\_score** | Severity score of exposed information |
| **Nb\_insecure\_cookies** | Number of insecure cookies detected |
| **Nb\_headers\_exposed** | Number of HTTP headers exposing sensitive data |
| **Nb\_ssl\_issues** | Number of SSL-related issues identified |
| **Domain\_age\_days** | Age of the domain in days |
| **WHOIS\_privacy** | Whether WHOIS privacy is enabled for the domain |
***
## Vulnerabilities
| Key | Description |
| ---------------------- | ---------------------------------------------------------------------- |
| **site\_cpes** | List of detected products or software identified by CPE |
| **Nb\_CVE\_open** | Number of known unpatched vulnerabilities (CVEs) |
| **Max\_CVE\_severity** | Highest severity level among detected CVEs |
| **Exploit\_available** | Indicates whether a public exploit exists for a detected vulnerability |
***
## URL / Domain
| Key | Description |
| -------------------- | ---------------------------------------------------------- |
| **domain\_len** | Length of the domain name |
| **subdomain\_depth** | Depth of subdomains detected |
| **has\_idn** | Indicates the use of internationalized domain names (IDN) |
| **url** | Full analyzed URL |
| **label** | Optional label provided from input data (e.g., CSV import) |
***
## AI / Technical Scores
| Key | Description |
| --------------- | ----------------------------------------------------- |
| **score\_ml** | Score generated by the *Machine Learning* model |
| **score\_dl** | Score generated by the *Deep Learning* model |
| **score\_ai** | Global AI score (combining ML and DL outputs) |
| **score\_tech** | Technical score computed from scanners and indicators |
# Generate API Key
Source: https://docs.scorton.tech/scorton_radar/post_generate_key
POST /generate-key
Generate a new API key for a registered user.\
Requires a valid JWT token and a user email address.
## Request Body
The user's email address registered on Scorton (e.g., `user@scorton.tech`)
The access level for the generated key.\
Default: `free`
The JWT token used for authentication.
## Example Request
```bash theme={null}
curl -X 'POST' \
'https://radar.scorton.tech/verify-key' \
-H 'accept: application/json' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'email=user@example.com&level=free&jwt_token=token_example'
```
## Example Response
```json theme={null}
{
"status": "success",
"message": "API key generated",
"data": {
"client_id": 0,
"id": 0,
"key": "key_example",
"level": "free",
"expire_at": "0001-01-01T00:00:00.000000"
}
}
```
## Success Response
| Status | Description |
| ------- | ------------------------------------------ |
| **200** | Returns the generated API key and metadata |
## Error Responses
| Status | Description | Example |
| ------- | ---------------------------- | --------------------------------------------------------------- |
| **400** | Missing required parameters | `json { "detail": "Missing email or jwt_token." } ` |
| **401** | Invalid or expired JWT token | `json { "detail": "Unauthorized: Invalid or expired token." } ` |