> ## Documentation Index
> Fetch the complete documentation index at: https:// zenveil.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /v1/scan/api

> Scan an API endpoint for missing security headers and CORS misconfigurations.

## Endpoint

```
POST /v1/scan/api
```

## Request

### Headers

| Header         | Value                |
| -------------- | -------------------- |
| `X-API-Key`    | Your ZenVeil API key |
| `Content-Type` | `application/json`   |

### Body

```json theme={null}
{
  "url": "https://api.your-app.com"
}
```

| Field | Type   | Required | Description                                            |
| ----- | ------ | -------- | ------------------------------------------------------ |
| `url` | string | Yes      | The API base URL to scan. Must be publicly accessible. |

<Warning>
  Private IP addresses, localhost, and loopback addresses are blocked (SSRF protection). Only publicly reachable URLs are accepted.
</Warning>

## Response

Same structure as `/v1/scan/github` — see [Scan GitHub](/docs/api-reference/scan-github) for the full schema.

```json theme={null}
{
  "scan_id": "b2c3d4e5f6g7",
  "status": "completed",
  "target_type": "api",
  "target": "https://api.your-app.com",
  "started_at": "2026-05-25T09:41:22Z",
  "completed_at": "2026-05-25T09:41:23Z",
  "finding_count": 2,
  "findings": [
    {
      "id": "ZG-H1I2J3",
      "category": "headers",
      "severity": "HIGH",
      "title": "Missing Content-Security-Policy",
      "description": "The Content-Security-Policy header is not set...",
      "evidence": "CSP header absent in HTTP response.",
      "location": {
        "target": "https://api.your-app.com",
        "url": "https://api.your-app.com",
        "method": "GET"
      },
      "scanner_name": "api_headers",
      "remediation": "Add Content-Security-Policy header with appropriate directives.",
      "confidence": 0.99,
      "owasp_categories": ["A05:2021"]
    }
  ]
}
```

## Examples

<CodeGroup>
  ```bash curl theme={null}
  curl -X POST https://api.zenveil.dev/v1/scan/api \
    -H "X-API-Key: zvk_live_your_key" \
    -H "Content-Type: application/json" \
    -d '{"url": "https://api.your-app.com"}'
  ```

  ```python Python theme={null}
  import httpx

  response = httpx.post(
      "https://api.zenveil.dev/v1/scan/api",
      headers={"X-API-Key": "zvk_live_your_key"},
      json={"url": "https://api.your-app.com"},
  )
  result = response.json()
  for finding in result["findings"]:
      print(f"[{finding['severity']}] {finding['title']}")
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch('https://api.zenveil.dev/v1/scan/api', {
    method: 'POST',
    headers: {
      'X-API-Key': 'zvk_live_your_key',
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ url: 'https://api.your-app.com' }),
  });
  const result = await response.json();
  ```
</CodeGroup>

## Error responses

| Status | Error                      | Cause                                               |
| ------ | -------------------------- | --------------------------------------------------- |
| `400`  | Could not reach target URL | URL is not publicly accessible or timed out         |
| `400`  | Bad request                | URL contains a private IP address (SSRF protection) |
| `500`  | Scan failed                | Unexpected error                                    |