Connect urlscan.io to your AI agent
Submit and retrieve website scans, search urlscan.io data, and manage urlscan Pro resources for threat intelligence and security investigations.
We set up the connection using your own urlscan.io account, with keys you control, and keep it running. Your agent picks it up and starts doing the work.
Actions
What your agent can do in urlscan.io
Each one is a real action the agent can take on its own, the same things a person clicking around urlscan.io could do. Read-only by default; write actions are confirmed against your policy.
- Close Incident Stop ongoing scans for an active urlscan Pro incident and transition it to the closed state. Closing does not delete the incident or its history, and the incident can later be restarted.
- Copy Incident Create a separate urlscan Pro incident from an existing incident's configuration. This create operation can consume incident capacity and does not copy the source incident's stored state history; use the distinct fork o…
- Create Notification Channel Create a Pro notification channel. This operation configures external effects: active webhook channels send requests to the supplied secret URL, and active email channels send messages to the supplied recipients. Confir…
- Create Incident Create a Pro incident that persistently monitors an observable. This high-impact operation starts ongoing external scans and can send alerts through every supplied notification channel; confirm the observable, visibilit…
- Run Blocking Live Scan Run a temporary Live Scan synchronously and return only after the provider finishes the scan. This requires the separate Live Scanning product.
- Create Live Scan Task Start a non-blocking temporary Live Scan on a selected scanner and return its UUID immediately without waiting for completion. This external scan side effect requires the separate urlscan.io Live Scanning entitlement; a…
- Create Saved Search Create a reusable scans or hostnames search definition. This operation creates a persistent saved search and requires urlscan Pro; the hostnames datasource may require an additional product entitlement.
- Create Alert Subscription Create a persistent scheduled or live alert subscription for saved searches. This Pro-only operation has external notification side effects: an active subscription can send email, invoke configured channels or webhooks,…
- Delete Scan Result Permanently delete a scan owned by the connected user or team. This destructive operation cannot be reversed and requires urlscan Pro.
- Delete Saved Search Permanently delete a saved search by ID. This destructive operation cannot be undone and requires urlscan Pro saved-search access plus ownership or team write permission. Use it only for a saved search created or explic…
- Delete Alert Subscription Permanently delete an alert subscription by ID. This destructive operation cannot be undone and requires urlscan Pro subscriptions access plus ownership or team write permission. Use it only for a subscription created o…
- Download Captured File Retrieve a captured binary file by its SHA-256 hash as a password-encrypted ZIP archive. This operation requires urlscan Pro access.
- Fork Incident Create a new Pro incident by copying an existing incident's configuration and complete stored state history. This creates a separate persistent incident; history volume and whether monitoring starts immediately are not…
- Get Account Capabilities Get non-sensitive plan, product, feature, visibility, submission, and limit information for the connected urlscan.io API key.
- Get Brand Summary Return detectable brands with detected-page totals and latest hits. This operation requires urlscan Pro access and uses the official contract only; the provider does not document its response fields.
- Get Notification Channel Get one urlscan Pro notification channel by ID while preserving provider-specific metadata and removing webhook destinations or credentials.
- Get Data Dump Download Link Generate a temporary download URL for a path returned by LIST_DATA_DUMPS. Data Dumps require an Enterprise or Ultimate urlscan.io plan.
- Get Scan DOM Return the plain-text DOM snapshot captured for a completed scan.
- Get Hostname History Return one page of historical Pro Hostnames observations for a hostname.
- Get Incident Get one incident's configuration, source, runtime state, and timestamps.
- Get Incident States Retrieve the stored state history for an incident.
- Get Live Scan Resource Retrieve one temporary result, DOM, screenshot, captured response, or download from the separate urlscan.io Live Scanning product. JSON and text are returned inline; binary content is offloaded as a downloadable file.
- Get Deprecated Phishing Feed Retrieve the deprecated urlscan Pro phishing feed in JSON, CSV, or TSV. Prefer SEARCH_SCANS for new workflows, as recommended by urlscan.io.
- Get API Quotas Get current products, features, query capabilities, and per-action minute, hour, and day quota usage.
- Get Captured Response Content Return textual content captured in a scan response, addressed by its SHA-256 hash.
- Get Scan Result Retrieve the complete metadata and captured request data for a completed scan UUID.
- Get Saved Search Results Run a urlscan Pro saved search and return its current Search API results. The provider redirect is followed automatically; this operation does not expose pagination controls.
- Get Scan Screenshot Retrieve a completed urlscan.io scan screenshot as a downloadable PNG file reference.
- Get Similar Scan Results Find one page of scan results structurally similar to a specified scan. Requires urlscan Pro access.
- Get Subscription Results Resolve a urlscan Pro alert subscription and datasource to its current Search API results. The provider redirect is followed automatically; this operation does not expose pagination controls.
- Get Available Brands List brand identifiers and metadata tracked by urlscan.io brand and phishing detection. Requires urlscan Pro brand/phishing access; the exact product and minimum plan are not documented.
- Get Available Scan Countries List scanner country codes currently accepted by the Scan API.
- List Notification Channels List email and webhook notification channels for the current user without returning webhook URLs or embedded credentials. This operation requires urlscan Pro channels access.
- List Data Dumps List available urlscan.io data-dump files for a time window, file type, and date. Requires an Enterprise or Ultimate plan; availability can vary by window and file type.
- List Live Scanners List Live Scanning nodes available to the connected account and their current metadata. This requires the separate urlscan.io Live Scanning product; a generic urlscan Pro plan may not include it.
- List Saved Searches List saved searches owned by or shared with the current user. This operation requires urlscan Pro saved-search access.
- List Alert Subscriptions List alert subscriptions configured for the current user. This operation requires urlscan Pro subscriptions access.
- Get Scan User Agents List grouped browser user-agent strings available for scan submission.
- Get Watchable Incident Attributes List attribute values accepted when configuring incident change monitoring. Requires urlscan Pro Incidents capability; the exact minimum plan or product is not documented.
- Lookup Malicious Observable Look up malicious-scan occurrence counts and first/last seen timestamps for an IP, hostname, domain, or exact URL. Requires urlscan Pro malicious-observable access.
- Purge Live Scan Result Permanently delete a temporary result from the separate urlscan.io Live Scanning product before its normal expiration. This destructive operation cannot be undone; only use it to clean up a temporary result created by t…
- Reset Scan Visibility Remove an owned scan's visibility override and restore the visibility originally assigned at submission. This resets an override; it does not delete the scan. Requires urlscan Pro.
- Restart Incident Restart a closed urlscan Pro incident and extend its expiry. This resumes ongoing external monitoring, begins recording new incident states, and can resume alerts through the incident's configured notification channels;…
- Search Scans Search urlscan.io data with Elasticsearch Query String syntax and return one controllable page of results.
- Store Live Scan Result Permanently store an existing temporary Live Scan result with the selected visibility. This updates the temporary result into a durable snapshot and requires the separate urlscan.io Live Scanning entitlement; a generic…
- Submit Scan Submit a URL for asynchronous external scanning, creating persistent result state and consuming quota. Visibility defaults to public, and free accounts have no cleanup operation. Returns the scan UUID for result and ass…
- Update Notification Channel Replace the complete configuration of an existing Pro notification channel. This operation can redirect external effects: active webhook channels send requests to the supplied secret URL, and active email channels send…
- Update Incident Replace an existing incident's monitoring configuration and runtime options. This Pro-only PUT requires observable, visibility, and the complete channel set, not only changed values. Updating it changes ongoing external…
- Update Scan Visibility Change the visibility of a scan owned by the connected user or team. This operation requires a paid urlscan Pro entitlement and is contract-only, not live verified. Use DELETE_RESULT for permanent deletion.
- Update Saved Search Replace the complete definition and metadata of an existing saved search. This PUT operation requires urlscan Pro saved-search access and write permission; the hostnames datasource may require an additional entitlement.
- Update Alert Subscription Replace the complete configuration of an existing alert subscription. This Pro-only PUT requires every mandatory field, not only changed values. It has external notification side effects: activating the subscription or…
Setup
How we connect it
- 1
Connect your account
You create a key in urlscan.io, a key you create and control, and paste it in once. It lives in a secrets store on your server, not with us.
- 2
Set the guardrails
Read-only by default. You choose which write actions the agent may take, and anything outside that policy gets confirmed with you first.
- 3
We keep it running
Health checks on every connection, updates handled for you, and we watch the first week of activity to make sure the work lands.
FAQ
urlscan.io questions, answered.
With a key you create and control. You paste it in once, it is stored in a secrets store on your server, permissions are scoped to the minimum the agent needs, and you can revoke it at any time.
The actions urlscan.io's API allows, the same things a person clicking around the app could do. Connections start read-only by default; write actions are confirmed against the policy you set before the agent takes them.
Connections are priced per tool on top of the base plan. Some are included, some are premium. See pricing for how connection charges work.
Standard tools are ready inside 7 business days of the setup call. We test the connection end to end, walk you through how the agent uses it, and watch the first week of activity.
Ready to put urlscan.io to work?
Tell us what your team runs on. We set up the connection, secure it, and your agent takes it from there.
All product names, logos, and brands are property of their respective owners; used for identification only. ZeroToClaw is not affiliated with or endorsed by urlscan.io.