View all systems

51 available actions

What your AI agent can do in urlscan.io

Submit and retrieve website scans, search urlscan.io data, and manage urlscan Pro resources for threat intelligence and security investigations. This page lists every available action. Your agent only receives the actions and permissions required for the role you approve.

Common starting points

  • Get Saved Search ResultsRun a urlscan Pro saved search and return its current Search API results.
  • Search ScansSearch urlscan.io data with Elasticsearch Query String syntax and return one controllable page of results.
  • Create Live Scan TaskStart a non-blocking temporary Live Scan on a selected scanner and return its UUID immediately without waiting for completion.
  • Create Notification ChannelCreate a Pro notification channel.
  • Update Notification ChannelReplace the complete configuration of an existing Pro notification channel.
  • Update IncidentReplace an existing incident's monitoring configuration and runtime options.

Browse all 51 actions by capability

Open a capability to see every supported action and its description.

Find & reviewLook up and review existing recordsView 28 actionsHide actions
  • Download Captured FileRetrieve a captured binary file by its SHA-256 hash as a password-encrypted ZIP archive.
  • Get Account CapabilitiesGet non-sensitive plan, product, feature, visibility, submission, and limit information for the connected urlscan.io API key.
  • Get Brand SummaryReturn detectable brands with detected-page totals and latest hits.
  • Get Notification ChannelGet one urlscan Pro notification channel by ID while preserving provider-specific metadata and removing webhook destinations or credentials.
  • Get Data Dump Download LinkGenerate a temporary download URL for a path returned by LIST_DATA_DUMPS.
  • Get Scan DOMReturn the plain-text DOM snapshot captured for a completed scan.
  • Get Hostname HistoryReturn one page of historical Pro Hostnames observations for a hostname.
  • Get IncidentGet one incident's configuration, source, runtime state, and timestamps.
  • Get Incident StatesRetrieve the stored state history for an incident.
  • Get Live Scan ResourceRetrieve one temporary result, DOM, screenshot, captured response, or download from the separate urlscan.io Live Scanning product.
  • Get Deprecated Phishing FeedRetrieve the deprecated urlscan Pro phishing feed in JSON, CSV, or TSV.
  • Get API QuotasGet current products, features, query capabilities, and per-action minute, hour, and day quota usage.
  • Get Captured Response ContentReturn textual content captured in a scan response, addressed by its SHA-256 hash.
  • Get Scan ResultRetrieve the complete metadata and captured request data for a completed scan UUID.
  • Get Saved Search ResultsRun a urlscan Pro saved search and return its current Search API results.
  • Get Scan ScreenshotRetrieve a completed urlscan.io scan screenshot as a downloadable PNG file reference.
  • Get Similar Scan ResultsFind one page of scan results structurally similar to a specified scan.
  • Get Subscription ResultsResolve a urlscan Pro alert subscription and datasource to its current Search API results.
  • Get Available BrandsList brand identifiers and metadata tracked by urlscan.io brand and phishing detection.
  • Get Available Scan CountriesList scanner country codes currently accepted by the Scan API.
  • List Notification ChannelsList email and webhook notification channels for the current user without returning webhook URLs or embedded credentials.
  • List Data DumpsList available urlscan.io data-dump files for a time window, file type, and date.
  • List Live ScannersList Live Scanning nodes available to the connected account and their current metadata.
  • List Saved SearchesList saved searches owned by or shared with the current user.
  • List Alert SubscriptionsList alert subscriptions configured for the current user.
  • Get Scan User AgentsList grouped browser user-agent strings available for scan submission.
  • Get Watchable Incident AttributesList attribute values accepted when configuring incident change monitoring.
  • Search ScansSearch urlscan.io data with Elasticsearch Query String syntax and return one controllable page of results.
Create & communicateCreate records or send supported messagesView 6 actionsHide actions
  • Create Notification ChannelCreate a Pro notification channel.
  • Create IncidentCreate a Pro incident that persistently monitors an observable.
  • Create Live Scan TaskStart a non-blocking temporary Live Scan on a selected scanner and return its UUID immediately without waiting for completion.
  • Create Saved SearchCreate a reusable scans or hostnames search definition.
  • Create Alert SubscriptionCreate a persistent scheduled or live alert subscription for saved searches.
  • Submit ScanSubmit a URL for asynchronous external scanning, creating persistent result state and consuming quota.
Update & manageChange and manage existing recordsView 7 actionsHide actions
  • Copy IncidentCreate a separate urlscan Pro incident from an existing incident's configuration.
  • Run Blocking Live ScanRun a temporary Live Scan synchronously and return only after the provider finishes the scan.
  • Update Notification ChannelReplace the complete configuration of an existing Pro notification channel.
  • Update IncidentReplace an existing incident's monitoring configuration and runtime options.
  • Update Scan VisibilityChange the visibility of a scan owned by the connected user or team.
  • Update Saved SearchReplace the complete definition and metadata of an existing saved search.
  • Update Alert SubscriptionReplace the complete configuration of an existing alert subscription.
Remove & cancelRemove records or cancel supported workView 3 actionsHide actions
  • Delete Scan ResultPermanently delete a scan owned by the connected user or team.
  • Delete Saved SearchPermanently delete a saved search by ID.
  • Delete Alert SubscriptionPermanently delete an alert subscription by ID.
Other actionsSpecialist and administrative actions.View 7 actionsHide actions
  • Close IncidentStop ongoing scans for an active urlscan Pro incident and transition it to the closed state.
  • Fork IncidentCreate a new Pro incident by copying an existing incident's configuration and complete stored state history.
  • Lookup Malicious ObservableLook up malicious-scan occurrence counts and first/last seen timestamps for an IP, hostname, domain, or exact URL.
  • Purge Live Scan ResultPermanently delete a temporary result from the separate urlscan.io Live Scanning product before its normal expiration.
  • Reset Scan VisibilityRemove an owned scan's visibility override and restore the visibility originally assigned at submission.
  • Restart IncidentRestart a closed urlscan Pro incident and extend its expiry.
  • Store Live Scan ResultPermanently store an existing temporary Live Scan result with the selected visibility.

Connection record

A connection you can control.

Sign-in
Customer-managed key
Setup
Use a key you create and control. It is stored securely and limited to the work agreed for the role.
Boundaries
Only the approved role and actions.
Off switch
Revoke the connection from your account.

FAQ

Before you connect urlscan.io

How does the agent connect to urlscan.io?
With a key you create and control. It is stored securely, permissions are limited to what the agent needs, and you can revoke it at any time.
What can the agent actually do in urlscan.io?
The page above lists the 51 actions currently available through the urlscan.io connection. The role determines which of those actions the agent may use, and write access is only enabled when the workflow needs it.
Is urlscan.io included in my plan?
Connections are priced per tool on top of the base plan. Some are included and some are premium. See pricing for how connection charges work.
How long until urlscan.io is ready?
Timing depends on the sign-in method, permissions and workflow being connected. We confirm the scope and setup plan before enabling the connection.

Bring the workflow together

Ready to put urlscan.io to work?

Start with the responsibility you want off your plate. We’ll map the connection and the boundaries around it.

Book a setup call Browse all connections

All product names, logos, and brands are property of their respective owners and are used for identification only. ZeroToClaw is not affiliated with or endorsed by urlscan.io.