---
title: "Scan Site"
method: POST
path: "/v0/site/scan"
tags: ["Site"]
---

# Scan Site

`POST /v0/site/scan`

## Request body

- SiteScanRequest
  - `url` string, required
  - `metadata` ScanRequestMetadata
    - `domain` string — The full URL of the DApp or website that initiated the request, for cross-reference. Must use the https or http scheme and contain a valid hostname. Cannot contain JSON, braces, or other embedded data structures.
    - `non_dapp` boolean — Set to true when the request was not initiated by a dapp. Dapp requests should provide the `domain` field.
    - `account` RoutersChainAgnosticModelsRequestAccount
      - `account_id` string, required — Unique identifier for the account.
      - `account_creation_timestamp` string, date-time — Timestamp when the account was created.
      - `user_age` integer — Age of the user in years
      - `user_country_code` string — ISO country code of the user's location.
      - `account_addresses` string[] — List of all account addresses in different chains based on the CAIPs standard (https://github.com/ChainAgnostic/CAIPs). Ethereum mainnet example: eip155:1:0xab16a96d359ec26a11e2c2b3d8f8b8942d5bfcdb
    - `connection` RoutersChainAgnosticModelsRequestConnection
      - `user_agent` string — User agent string from the client's browser or application.
      - `ip_address` string, ipvanyaddress, required — IP address of the customer making the request. Both IPv4 and IPv6 addresses are supported.
      - `origin` string, uri — The full URL of the website that the request was directed to.
      - `walletconnect_name` string — WalletConnect session name, when the request originates from a WalletConnect session.
      - `walletconnect_description` string — WalletConnect session description, when the request originates from a WalletConnect session.

## Response `200`

Successful Response

- union
  - SiteScanHitResponse
    - `status` 'hit', required
    - `url` string, required
    - `scan_start_time` string, date-time, required
    - `scan_end_time` string, date-time, required
    - `malicious_score` number, required
    - `is_reachable` boolean, required
    - `is_web3_site` boolean, required
    - `is_malicious` boolean, required
    - `attack_types` object, required — Object whose keys are attack type identifiers and values are AttackEntry objects. See the [Attack Type Reference](/api-reference/end-user-protection/dapp-scanning/dapp-scanning-response-reference#attack-type-reference) for possible keys.
    - `network_operations` string[], required
    - `json_rpc_operations` string[], required
    - `contract_write` ContractOperations, required
      - `contract_addresses` string[], required
      - `functions` object, required
    - `contract_read` ContractOperations, required
      - `contract_addresses` string[], required
      - `functions` object, required
  - SiteScanMissResponse
    - `status` 'miss', required

## Other responses

- `422` — Validation Error

## Changes

> 95 revisions in range; 1 not diffed.

- **2026-06-22** `631610b498db` — 2 breaking
  - added `#/components/schemas/ScanRequestMetadata` to the `metadata` request property `allOf` list
  - removed `#/components/schemas/CatalogRequestMetadata, #/components/schemas/WalletRequestMetadata, #/components/schemas/MultipleWalletRequestMetadata` from the `metadata` request property `anyOf` list

[Change history](https://skmtc.dev/blockaid-official/apis/blockaid-api/changes/v0/site/scan/post.md)

---

[API](https://skmtc.dev/blockaid-official/apis/blockaid-api.md) · [All operations](https://skmtc.dev/blockaid-official/apis/blockaid-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/blockaid-official/blockaid-api/revisions/e15b4bf2b25b/schema)