Scan a target and return a verdict bound to its content hash.

Auth: X-API-Key, OR x402 payment (when enabled). Without valid auth the paid path returns 402 with payment requirements. An error verdict returns HTTP 422 and is never billed (§9.5).

post/v1/scan

Request

  • Base URL: https://lazaretto.dev
  • URL: https://lazaretto.dev/v1/scan
  • Auth: one of:
    • API key in header X-API-Key
    • HTTP x402

Request body

depth'lookup' | 'full'

lookup = hash + IOC match only; full = + behavioral rules.

Response

A verdict (clear/flagged/malicious). x402 only: the signed attestation comes back, and is published, only when the payment settled. When the payment facilitator did not answer clearly, the result still comes back, with no attestation and a payment block {outcome:"unknown", detail, contact, time}. Whether that payment settled is unknown (settlement_outcome_unknown). Do not pay again for the scan; if you were charged, nothing more is owed. Email contact@lazaretto.dev with the paying wallet address and the time if in doubt.

scan_idstring
target_hashstring

Hash of exactly what was analyzed. EMPTY STRING when no bytes were read: an npm package that was taken down from the registry is still reported malicious on package IDENTITY, and there is no content to bind that claim to. Check for the empty string before using this in a /report/ or badge URL.

verdict'clear' | 'flagged' | 'malicious' | 'error'
confidence'high' | 'medium' | 'low'
risk'critical' | 'high' | 'medium' | 'low' | 'none'

How serious the concern is, and the field to gate on. verdict only says whether anything fired, so a credential stealer and a bundler that uses Function() are both flagged. risk separates them: reading secrets AND being able to ship them is critical; constructing code at run time is medium.

risk_summarystring

One plain sentence naming the concern.

rules_versionstring
scanned_atstring date-time
disclaimerstring
attestationstring

Compact JWS (EdDSA) over the verdict core, present on non-error verdicts. Verify it against /.well-known/jwks.json (offline) or POST /v1/verify. Its sub claim binds it to this artifact, so an agent can share the verdict and any recipient can trust it without re-scanning. Left out when the payment outcome is unknown (see payment).

Changes

No recorded changes to this operation across all 1 revision of this API.