Developer API Documentation

Welcome to the AssurePort Freemium Threat Intel API. This API exposes all 14 public reconnaissance and security inspection tools driving our online toolbox, enabling you to automate scans directly inside your CI/CD workflows, custom monitoring scripts, or security pipelines.

With a free developer account, you receive a personal API key providing 100 free requests per month across all endpoints, bypassing anonymous IP-based rate limiting.

Authentication

All programmatic API requests must carry your personal API Key passed as a Bearer token in the Authorization header:

Authorization: Bearer aprt_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

To generate your API Key, sign in to your dashboard at app.assureport.com, navigate to Settings > API Keys, and click Generate Key.

Limits & Quotas

Our freemium layer enforces two levels of rate limits to guarantee system reliability:

• Monthly Quota: 100 requests per calendar month per tenant. Check your usage metrics in the developer dashboard.
• Burst Limit: 10 requests per minute per API key to prevent brief throttling or spamming.

API Endpoints

1. DNS Lookup

Query standard DNS records directly from global authoritative name servers.

2. TLS/SSL Logs

Query Certificate Transparency logs for public certificate mappings and expirations.

3. HTTP Security Headers

Inspect HTTP headers and calculate security grade (A+ to F).

4. CryptoCheck Grader

Grade the cryptographic hygiene, TLS configurations, and post-quantum readiness.

5. Aggregated Threat Intelligence

Aggregate reputation lookups across Shodan, URLhaus, ThreatFox, and ASN listings.

Code Examples

Integrate our endpoints using your favorite programming language:

curl -X GET "https://api.assureport.com/api/intel/headers?url=https://example.com" \
  -H "Authorization: Bearer aprt_YOUR_FREE_API_KEY"

Response

All endpoints return JSON. A successful GET /api/intel/headers responds 200 with a HeaderGrade object:

{
  "url": "https://example.com",
  "status": 200,
  "scoreOutOf100": 82,
  "letterGrade": "B",
  "redirects": 0,
  "headers": {
    "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
    "content-security-policy": "default-src 'self'"
  },
  "checks": [
    { "name": "Strict-Transport-Security", "status": "pass", "value": "max-age=63072000; includeSubDomains; preload", "weight": 20, "notes": "Present with a long max-age." },
    { "name": "Content-Security-Policy", "status": "warn", "value": "default-src 'self'", "weight": 20, "notes": "Present, but no report-uri configured." }
  ]
}

Errors

Errors return a JSON body with an error code (and often a human-readable message) at the matching HTTP status:

Parameter reference

Endpoints take one of three input parameters. The name reflects what the check actually needs — it is not interchangeable:

Platform API — run real scans

Everything above is the free threat-intel surface. The Platform API drives the paid engines — dispatch a pentest, poll it, read findings, check your balance — with the same aprt_ key. It is the API behind the console, exposed for CI/CD, a scan step in your pipeline, or your own tooling.

Dispatch a scan

POST /api/scans — start a scan. Supply a URL target (web/api/github/email) or structured config (cloud/ad/sap). Returns 202 with a scanId to poll.

curl -X POST "https://api.assureport.com/api/scans" \
  -H "Authorization: Bearer aprt_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 9f2c1e7a-..." \
  -d '{ "engine": "web", "targetUrl": "https://example.com", "onboardingMode": "quick", "attestation": true }'

Idempotency (recommended). Send a unique Idempotency-Key header and reuse it verbatim if you retry (a timed-out request, an at-least-once queue). A retry with the same key replays the original scan instead of starting — and charging for — a second one. Keys are scoped to your tenant and cover a short retry window.

Successful 202 response:

{
  "scanId": "b6571822-4232-4f5e-81b8-15a3c62c5855",
  "status": "queued",
  "reservation": { "id": "...", "credits": 6900 },
  "gate": "quick_scan"
}

Poll, findings & balance

All Platform endpoints are tenant-scoped: a key only ever sees its own tenant's scans, findings and balance.