A small API.
An explicit scope.

Public scanner request

The current frontend sends a JSON POST to /api/scan.php with domain and framework. Only scan targets you own or are authorised to assess.

POST /api/scan.php
Content-Type: application/json

{"domain":"YOUR-DOMAIN.example","framework":"global"}

Existing framework identifiers are global, sg and e8. Framework labels refer to selected external mappings, not certification.

Response handling

The existing frontend reads domain, scan_date, score, max_score and a checks array. Check entries include fields such as title, outcome and detail. An error field indicates a failed request. Treat upstream text as untrusted and render it safely.

Not a service-level commitment

Stable versioning, published quotas, API keys and integration support are planned. This note is not a promise of API stability, unlimited use or an uptime SLA. Do not build unattended bulk scanning against the public endpoint without an agreed use policy.

Data and privacy

Results may have public shareable URLs. Do not send credentials or confidential targets. The full backend retention and access-control review remains separate from this public-page redesign.