---
title: "Scan Url"
method: POST
path: "/scan"
tags: ["scan"]
---

# Scan Url

`POST /scan`

## Request

- Base URL: `https://api.openproof.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.openproof.io/scan`
- Auth: none declared

Public URL scan. Rate-limited tighter than any other public
endpoint in this app (10/hour, vs 20-60/hour elsewhere) since each
call now costs real compute (headless browser render + up to two more
HTTP fetches + one Haiku call), not just a database read.

Results are cached for FINDINGS_CACHE_MINUTES per URL -- this is the
primary defense against someone deliberately flooding one target with
repeated scans (from one IP or many): after the first real scan,
every subsequent request for the same URL within the window is an
instant, free cache hit, not additional render/SSL/AI cost.

## Request body

- ScanRequest
  - `url` string, uri, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/openproof/apis/openproof-api.md) · [All operations](https://skmtc.dev/openproof/apis/openproof-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openproof/apis/openproof-api/revisions/ddd0cac7c37e?raw)