urlscan.io logo urlscan.io

urlscan.io Blog

urlscan API: Mandatory authentication starting May 4th

Changelog Product Api

Starting May 4th, 2026 some of the publicly accessible API endpoints on urlscan.io will only respond to authenticated requests. An authenticated request is a request with a valid API key or by a signed-in user. The API endpoints affected are:

  • GET /api/v1/result/{scanId}/
  • GET /dom/{scanId}/
  • GET /responses/{fileHash}/

Make sure all of your API integrations are sending the urlscan API key via the appropriate api-key HTTP request header today.

Make sure to send API key headers for all requests against urlscan.io, even for API paths that do not require authentication today.

API Calls

This is what an authenticated API call looks like:

curl -i -X GET \
  'https://urlscan.io/api/v1/result/{scanId}/' \
  -H 'api-key: YOUR_API_KEY_HERE'

For more details please check the API docs.

Background

These changes are necessary to curb abuse of our platform and ensure its stability and availability for legitimate users.