{"info":{"name":"EMPEDIAcloud API","description":"REST API of EMPEDIAcloud (website audits, code audits, monitoring, reports).\n\n**Authentication** (always as `Authorization: Bearer <token>`):\n- **OAuth 2.0 Client Credentials** (server to server, recommended for integrations): create a service client under “API access” and obtain short-lived tokens via `POST /oauth/token`.\n- **OAuth 2.0 Authorization Code + PKCE**: for apps where a person signs in (e.g. Claude/ChatGPT connector).\n- Endpoints with `x-auth-note` “Dashboard session” belong to the web interface and cannot be reached with access tokens.\n\nAll responses are JSON with a `success` field unless stated otherwise. Amounts are in cents, times in UTC (ISO 8601).","schema":"https://schema.getpostman.com/json/collection/v2.1.0/collection.json"},"variable":[{"key":"baseUrl","value":"https://empedia.cloud"},{"key":"clientId","value":""},{"key":"clientSecret","value":""},{"key":"accessToken","value":""}],"item":[{"name":"Authentifizierung","item":[{"name":"Token holen (client_credentials)","event":[{"listen":"test","script":{"type":"text/javascript","exec":["const d = pm.response.json();","if (d.access_token) { pm.collectionVariables.set('accessToken', d.access_token); }"]}}],"request":{"method":"POST","header":[{"key":"Content-Type","value":"application/x-www-form-urlencoded"}],"url":{"raw":"{{baseUrl}}/oauth/token","host":["{{baseUrl}}"],"path":["oauth","token"]},"body":{"mode":"urlencoded","urlencoded":[{"key":"grant_type","value":"client_credentials"},{"key":"client_id","value":"{{clientId}}"},{"key":"client_secret","value":"{{clientSecret}}"},{"key":"scope","value":"scan:read scan:write report:read","disabled":true}]},"description":"Zuerst ausführen: speichert den Access-Token in der Variable accessToken (gültig ca. 1 Stunde)."}}]},{"name":"Domains","item":[{"name":"Domains of the organization","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/domains","host":["{{baseUrl}}"],"path":["api","domains"],"query":[],"variable":[]},"description":"Lists the domains with expiry date, nameserver set, auto-renewal and deletion mark. Filters `quick` (expiring, cancelled, nozone), `ns_set`, `renew`; sorting via `sort` (name, ns, expire, renew) and `dir`. The \"Domains\" area must be enabled for the organization, otherwise 404.\n\nScopes (all): scan:read"}},{"name":"Register domain","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domains","host":["{{baseUrl}}"],"path":["api","domains"],"query":[],"variable":[]},"description":"Registers a domain. **Billable:** the amount is deducted from the credit balance in advance (prepayment, no credit limit) and automatically refunded on failure; on success the invoice follows on the same day. The order runs asynchronously (response 202); the result is delivered via webhook `domain.order.completed` or `domain.order.failed`, or via `GET /orders`. With the `Idempotency-Key` header (8–128 characters), a retry within 24 hours is neither executed nor charged twice. TLDs with special rules (proofs, trustee …) are handled via a request (`POST /requests`).\n\nDashboard session (login) only, not available with access tokens","body":{"mode":"raw","raw":"{\n  \"domain\": \"example.com\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Check verification","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/domains/:domain/verify","host":["{{baseUrl}}"],"path":["api","domains",":domain","verify"],"query":[],"variable":[{"key":"domain","value":"","description":"Domain name, e.g. example.com"}]},"description":"Checks DNS TXT record, verification file and meta tag. Returns which method succeeded.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Download verification file","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/domains/:domain/verification-file","host":["{{baseUrl}}"],"path":["api","domains",":domain","verification-file"],"query":[],"variable":[{"key":"domain","value":"","description":"Domain name"}]},"description":"Returns the verification file as a download. Place the file under /.well-known/.\n\nScopes (all): scan:read"}}]},{"name":"Scans","item":[{"name":"Quick Scan","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/audit/short","host":["{{baseUrl}}"],"path":["api","audit","short"],"query":[],"variable":[]},"description":"Quick scan of up to 5 pages. Score + grade + key findings. ~5–15 seconds.\n\nScopes (all): scan:write","body":{"mode":"raw","raw":"{\n  \"url\": \"https://example.com\",\n  \"options\": {\n    \"maxPages\": 5,\n    \"screenshot\": true\n  }\n}","options":{"raw":{"language":"json"}}}}},{"name":"Full Scan","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/audit/scan","host":["{{baseUrl}}"],"path":["api","audit","scan"],"query":[],"variable":[]},"description":"Complete audit. Page limit from plan (20–all pages). All analyzers including Lighthouse and infection check of every page (field `infection`: malware traces in the delivered HTML/JS, cloaking comparison). The field `coverage` lists discovered, checked, unreachable and unchecked pages together with the reason (`limit_reason`: complete | max_pages | time | no_links — `no_links` reports that despite a multi-page scan no further link was found anywhere, usually an unrecognized bot/security interstitial instead of the real website; crawl time limit 30 minutes, the pages checked up to then remain the result). ~60–180 s. Large scans are started automatically as a background job.\n\nScopes (all): scan:write","body":{"mode":"raw","raw":"{\n  \"url\": \"https://example.com\",\n  \"options\": {\n    \"maxPages\": 50,\n    \"maxDepth\": 2,\n    \"concurrency\": 3,\n    \"screenshot\": true,\n    \"lighthouse\": true,\n    \"simulateConsent\": true\n  }\n}","options":{"raw":{"language":"json"}}}}},{"name":"Streaming Scan (SSE)","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/audit/scan/stream","host":["{{baseUrl}}"],"path":["api","audit","scan","stream"],"query":[],"variable":[]},"description":"Like Full Scan, but with real-time progress via Server-Sent Events. Accepts the same request body as Full Scan. The client receives events: progress, start_page, result, done.\n\nScopes (all): scan:write","body":{"mode":"raw","raw":"{\n  \"url\": \"https://example.com\",\n  \"options\": {\n    \"maxPages\": 50,\n    \"maxDepth\": 2,\n    \"concurrency\": 3,\n    \"screenshot\": true,\n    \"lighthouse\": true,\n    \"simulateConsent\": true\n  }\n}","options":{"raw":{"language":"json"}}}}},{"name":"DNS & email security","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/audit/dns-check","host":["{{baseUrl}}"],"path":["api","audit","dns-check"],"query":[],"variable":[]},"description":"SPF, DKIM, DMARC, DNSSEC, MTA-STS, TLSRPT, BIMI. DNSBL checks (Spamhaus, CBL, SpamCop) for IPv4/IPv6. Open relay test. Optional: AbuseIPDB IP reputation.\n\nScopes (all): scan:write","body":{"mode":"raw","raw":"{\n  \"url\": \"https://example.com\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"GDPR single page","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/audit/gdpr","host":["{{baseUrl}}"],"path":["api","audit","gdpr"],"query":[],"variable":[]},"description":"GDPR check on a single page: cookies, consent banner, trackers, dark patterns. No domain verification required.\n\nScopes (all): scan:write","body":{"mode":"raw","raw":"{\n  \"url\": \"https://example.com\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"GDPR full site","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/audit/gdpr-full","host":["{{baseUrl}}"],"path":["api","audit","gdpr-full"],"query":[],"variable":[]},"description":"GDPR scan across all crawled pages including consent rejection test.\n\nScopes (all): scan:write","body":{"mode":"raw","raw":"{\n  \"url\": \"https://example.com\",\n  \"options\": {\n    \"maxPages\": 50\n  }\n}","options":{"raw":{"language":"json"}}}}},{"name":"WP Emergency Check","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/audit/wp-emergency","host":["{{baseUrl}}"],"path":["api","audit","wp-emergency"],"query":[],"variable":[]},"description":"In-depth WordPress check: core version, plugins, themes, exposed files, xmlrpc, REST API, user enumeration, infection check of the start page (malware traces in the delivered HTML/JS, cloaking comparison). With AI action plan. The multi-page emergency check (infection check of every page, WordPress emergency report) runs via the preset `wp-emergency` in `POST /api/audit/start-async`.\n\nScopes (all): scan:write","body":{"mode":"raw","raw":"{\n  \"url\": \"https://example.com\"\n}","options":{"raw":{"language":"json"}}}}}]},{"name":"Code Audit","item":[{"name":"Export code audit as SARIF 2.1.0","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/scans/:id/sarif","host":["{{baseUrl}}"],"path":["api","code","scans",":id","sarif"],"query":[],"variable":[{"key":"id","value":"","description":"Public UUID of the code audit"}]},"description":"Returns the findings of a completed code audit in SARIF format (`application/sarif+json`) — directly usable for GitHub Code Scanning (`github/codeql-action/upload-sarif`), GitLab, Azure DevOps and IDEs. Severities: high → error, medium → warning, low/info → note; `security-severity` for the GitHub display.\n\nScopes (all): code:audit"}},{"name":"Upload ZIP/TAR","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/analyze","host":["{{baseUrl}}"],"path":["api","code","analyze"],"query":[],"variable":[]},"description":"Uploads a ZIP or TAR.GZ and analyzes the source code. Multipart/form-data. Optional: system parameter for framework-specific rules.\n\nScopes (all): code:audit"}},{"name":"Get system SSH public key","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/ssh-public-key","host":["{{baseUrl}}"],"path":["api","code","ssh-public-key"],"query":[],"variable":[]},"description":"Returns the system's public key. Add this key to ~/.ssh/authorized_keys on the target server to enable passwordless SFTP connections.\n\nScopes (all): code:audit"}},{"name":"Remote connection (SFTP/FTP/Git)","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/code/connect","host":["{{baseUrl}}"],"path":["api","code","connect"],"query":[],"variable":[]},"description":"Connects to the server and analyzes the source code directly. Supports SFTP with password, SSH key or the system key (if neither password nor privateKey is given, the system SSH key is used automatically). FTP and Git are also supported.\n\nScopes (all): code:audit","body":{"mode":"raw","raw":"{\n  \"method\": \"sftp\",\n  \"host\": \"server.example.com\",\n  \"port\": 22,\n  \"username\": \"deploy\",\n  \"remotePath\": \"/var/www/html\",\n  \"ai\": true,\n  \"system\": \"wordpress\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Code audit history","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/scans","host":["{{baseUrl}}"],"path":["api","code","scans"],"query":[{"key":"page","value":"","description":"Page (default: 1)","disabled":true},{"key":"limit","value":"","description":"Entries per page (default: 20, max 100)","disabled":true}],"variable":[]},"description":"Lists all code audits of the organization, paginated.\n\nScopes (all): code:audit"}},{"name":"Code audit detail","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/scans/:id","host":["{{baseUrl}}"],"path":["api","code","scans",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Public UUID of the scan"}]},"description":"Returns the complete result of a code audit (findings, WordPress analysis, AI result).\n\nScopes (all): code:audit"}},{"name":"Download code audit PDF","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/scans/:id/pdf","host":["{{baseUrl}}"],"path":["api","code","scans",":id","pdf"],"query":[{"key":"lang","value":"","description":"Language: de (default) | en","disabled":true}],"variable":[{"key":"id","value":"","description":"Public UUID of the scan"}]},"description":"Generates a PDF report for the code audit. With ?lang=en an English report is generated. Contains findings tables by severity, WordPress analysis, file statistics and AI result block.\n\nScopes (all): code:audit"}},{"name":"List scheduled code audits","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/schedules","host":["{{baseUrl}}"],"path":["api","code","schedules"],"query":[],"variable":[]},"description":"Lists all scheduled code audits of the organization. Credentials are not returned — has_credentials (0/1) is set instead.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Create scheduled code audit","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/code/schedules","host":["{{baseUrl}}"],"path":["api","code","schedules"],"query":[],"variable":[]},"description":"Creates a new scheduled code audit. Credentials (token, password, SSH key) are stored AES-256-GCM encrypted. Max. 20 schedules per organization.\n\nDashboard session (login) only, not available with access tokens","body":{"mode":"raw","raw":"{\n  \"label\": \"Nightly Git Audit\",\n  \"method\": \"git\",\n  \"repo_url\": \"https://github.com/org/repo.git\",\n  \"branch\": \"main\",\n  \"token\": \"ghp_...\",\n  \"cron\": \"0 3 * * *\",\n  \"use_ai\": true,\n  \"system_hint\": \"laravel\",\n  \"notify_on\": \"new_high\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Retry AI analysis","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/code/scans/:id/retry-ai","host":["{{baseUrl}}"],"path":["api","code","scans",":id","retry-ai"],"query":[],"variable":[{"key":"id","value":"","description":"Scan UUID"}]},"description":"Restarts the AI analysis of an existing scan — e.g. after an error or with a different model. Uses code snippets stored with the scan.\n\nScopes (all): code:audit","body":{"mode":"raw","raw":"{\n  \"provider_id\": \"uuid-des-providers\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Get AI retry status","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/scans/:id/retry-ai-status","host":["{{baseUrl}}"],"path":["api","code","scans",":id","retry-ai-status"],"query":[],"variable":[{"key":"id","value":"","description":"Scan UUID"}]},"description":"Polling endpoint for the status of a running AI retry.\n\nScopes (all): code:audit"}},{"name":"Estimate cost of full AI analysis","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/code/estimate-full-scan","host":["{{baseUrl}}"],"path":["api","code","estimate-full-scan"],"query":[],"variable":[]},"description":"Estimates the token cost of a full AI analysis based on file count and selected model.\n\nScopes (all): code:audit","body":{"mode":"raw","raw":"{\n  \"provider_id\": \"uuid\",\n  \"file_count\": 347,\n  \"avg_file_size\": 3000\n}","options":{"raw":{"language":"json"}}}}},{"name":"List remediation jobs","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/scans/:id/remediations","host":["{{baseUrl}}"],"path":["api","code","scans",":id","remediations"],"query":[],"variable":[{"key":"id","value":"","description":"Scan UUID"}]},"description":"Lists all remediation jobs for a scan (max. 10, newest first). Useful for showing the latest job status on the scan detail page.\n\nScopes (all): code:audit"}},{"name":"Start AI remediation","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/code/scans/:id/start-remediation","host":["{{baseUrl}}"],"path":["api","code","scans",":id","start-remediation"],"query":[],"variable":[{"key":"id","value":"","description":"Scan UUID"}]},"description":"Starts an autonomous remediation job. Creates a backup (SFTP/FTP), generates fixes with AI, verifies them adversarially, and applies approved fixes. Three modes: automatic, interactive, review.\n\nScopes (all): code:audit","body":{"mode":"raw","raw":"{\n  \"mode\": \"interactive\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Remediation status","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/remediation/:id","host":["{{baseUrl}}"],"path":["api","code","remediation",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Remediation UUID"}]},"description":"Returns the current status, progress and cost of a remediation job.\n\nScopes (all): code:audit"}},{"name":"Get agent messages","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/remediation/:id/messages","host":["{{baseUrl}}"],"path":["api","code","remediation",":id","messages"],"query":[{"key":"since","value":"","description":"ISO timestamp — only messages after this point in time","disabled":true}],"variable":[{"key":"id","value":"","description":"Remediation UUID"}]},"description":"Returns the message history between agent and user. Supports polling with the since parameter.\n\nScopes (all): code:audit"}},{"name":"Answer agent question","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/code/remediation/:id/respond","host":["{{baseUrl}}"],"path":["api","code","remediation",":id","respond"],"query":[],"variable":[{"key":"id","value":"","description":"Remediation UUID"}]},"description":"Sends a reply to a question from the remediation agent (interactive mode).\n\nScopes (all): code:audit","body":{"mode":"raw","raw":"{\n  \"answer\": \"Anwenden\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"List fix actions","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/remediation/:id/actions","host":["{{baseUrl}}"],"path":["api","code","remediation",":id","actions"],"query":[],"variable":[{"key":"id","value":"","description":"Remediation UUID"}]},"description":"Returns all individual actions of a remediation job with diffs, status and AI assessments.\n\nScopes (all): code:audit"}},{"name":"Apply approved fixes (review mode)","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/code/remediation/:id/approve-fixes","host":["{{baseUrl}}"],"path":["api","code","remediation",":id","approve-fixes"],"query":[],"variable":[{"key":"id","value":"","description":"Remediation UUID"}]},"description":"Applies the fixes approved by the user. Only available in review mode.\n\nScopes (all): code:audit","body":{"mode":"raw","raw":"{\n  \"action_ids\": [\n    \"action-uuid-1\",\n    \"action-uuid-2\"\n  ]\n}","options":{"raw":{"language":"json"}}}}},{"name":"Rollback — revert all changes","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/remediation/:id/rollback","host":["{{baseUrl}}"],"path":["api","code","remediation",":id","rollback"],"query":[],"variable":[{"key":"id","value":"","description":"Remediation UUID"}]},"description":"Restores all files from the backup. Only for SFTP/FTP remediation with an existing backup.\n\nScopes (all): code:audit"}},{"name":"Download archive","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/remediation/:id/download","host":["{{baseUrl}}"],"path":["api","code","remediation",":id","download"],"query":[],"variable":[{"key":"id","value":"","description":"Remediation UUID"}]},"description":"Downloads the backup or patched archive. SFTP/FTP/SSH: pre-remediation backup (backup-*.tar.gz). Upload: patched archive (remediated-*.tar.gz). Requires `has_backup: true` in the status endpoint.\n\nScopes (all): code:audit"}},{"name":"List saved connections","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/connections","host":["{{baseUrl}}"],"path":["api","code","connections"],"query":[],"variable":[]},"description":"Lists all saved code audit connections of the user (Git, SFTP, FTP, SSH). Credentials are not returned — only a `has_credentials` boolean.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Save connection","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/code/connections","host":["{{baseUrl}}"],"path":["api","code","connections"],"query":[],"variable":[]},"description":"Saves a new code audit connection. Credentials (token, password, SSH key) are stored AES-256-GCM encrypted. Max. 50 connections per user.\n\nDashboard session (login) only, not available with access tokens","body":{"mode":"raw","raw":"{\n  \"label\": \"Mein Server\",\n  \"method\": \"sftp\",\n  \"host\": \"server.example.com\",\n  \"username\": \"deploy\",\n  \"password\": \"secret\",\n  \"remote_path\": \"/var/www\",\n  \"system_hint\": \"wordpress\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Update connection","request":{"method":"PATCH","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/code/connections/:id","host":["{{baseUrl}}"],"path":["api","code","connections",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Connection UUID"}]},"description":"Updates a saved connection. Only the submitted fields are changed. New credentials are stored encrypted.\n\nDashboard session (login) only, not available with access tokens","body":{"mode":"raw","raw":"{\n  \"label\": \"Neuer Name\",\n  \"host\": \"new-server.example.com\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Delete connection","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/connections/:id","host":["{{baseUrl}}"],"path":["api","code","connections",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Connection UUID"}]},"description":"Deletes a saved connection and the associated encrypted credentials.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Update scheduled code audit","request":{"method":"PATCH","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/code/schedules/:id","host":["{{baseUrl}}"],"path":["api","code","schedules",":id"],"query":[],"variable":[{"key":"id","value":"","description":"UUID of the schedule"}]},"description":"Updates an existing schedule. Only the fields you send are changed. To delete credentials, send null.\n\nDashboard session (login) only, not available with access tokens","body":{"mode":"raw","raw":"{\n  \"enabled\": false,\n  \"cron\": \"0 4 * * 1\",\n  \"notify_on\": \"always\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Delete scheduled code audit","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/schedules/:id","host":["{{baseUrl}}"],"path":["api","code","schedules",":id"],"query":[],"variable":[{"key":"id","value":"","description":"UUID of the schedule"}]},"description":"Permanently deletes a schedule. Past scan results remain in the history.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Run schedule immediately","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/schedules/:id/run","host":["{{baseUrl}}"],"path":["api","code","schedules",":id","run"],"query":[],"variable":[{"key":"id","value":"","description":"UUID of the schedule"}]},"description":"Triggers a scheduled code audit immediately, regardless of the cron schedule. Useful for testing or manual triggering.\n\nDashboard session (login) only, not available with access tokens"}}]},{"name":"Monitoring","item":[{"name":"List servers","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/monitoring/servers","host":["{{baseUrl}}"],"path":["api","monitoring","servers"],"query":[],"variable":[]},"description":"Returns all registered server agents of the organization, including the latest metrics (CPU, RAM, disk, load).\n\nScopes (all): monitor:read"}},{"name":"Register server","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/monitoring/servers","host":["{{baseUrl}}"],"path":["api","monitoring","servers"],"query":[],"variable":[]},"description":"Registers a new server and returns an installation token. The token is inserted into the curl install command. Fails with **402 limit_reached** if the plan limit is reached.\n\nScopes (all): monitor:write","body":{"mode":"raw","raw":"{\n  \"name\": \"Webserver Produktion\",\n  \"alert_email\": \"ops@example.com\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Remove server","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/monitoring/servers/:id","host":["{{baseUrl}}"],"path":["api","monitoring","servers",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Server ID (UUID)"}]},"description":"Removes the server from monitoring. A server whose agent has reported at least once disappears immediately from the list, queries and quota and no longer triggers alerts; **the agent uninstalls itself on the next heartbeat** (`uninstall.pending: true`, the heartbeat response then contains `uninstall: true`, after which the record is deleted). If the agent no longer reports (server off), it removes itself on its own after more than 24 h and 5 failed attempts (response `401` with `code: invalid_token`); manually: `curl -sL <instance>/api/monitoring/install.sh | sudo bash -s -- --uninstall` or, on Windows, `Uninstall-AuditCollectorAgent`. A server that has never reported is deleted immediately (`uninstall.pending: false`).\n\nScopes (all): monitor:write"}},{"name":"Get server","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/monitoring/servers/:id","host":["{{baseUrl}}"],"path":["api","monitoring","servers",":id"],"query":[],"variable":[{"key":"id","value":"","description":"UUID of the server"}]},"description":"Returns a server with its settings, the last 288 measurements (`metrics`), the linked website monitors (`websites`: id, name, url, status), the last 100 alerts (`alerts`; `resolved_at` is set once the corresponding recovery notice has been sent, per service for services, otherwise `null`; for alerts with `snapshot`: load, RAM, file systems and top processes at the time of the alert) and the known kernel vulnerabilities (`kernel_cves`). `server.extras` contains the latest state of the agent's additional data: `filesystems`, `top_processes`, `services_running`, `gpus`, `cpu_cores` and `updates` (pending updates: `security` counted by security advisories, `total`, `method` = `advisories|packages`, `reboot`, `kernel` with `running`, `available`, `advisories`, `livepatch`, and the list `items`). `server.blacklist_detail` contains the result of the spam list check (`listed`, `unknown`, `results`). The installation token is only included for dashboard sessions.\n\nScopes (all): monitor:read"}},{"name":"Update server settings","request":{"method":"PATCH","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/monitoring/servers/:id","host":["{{baseUrl}}"],"path":["api","monitoring","servers",":id"],"query":[],"variable":[{"key":"id","value":"","description":"UUID of the server"}]},"description":"Changes name, alert channels and thresholds, the offline threshold, the blacklist check (`blacklist`, from Monitor Pro) and the monitored services (`watch_services`, from Monitor Basic) of a server.\n\nScopes (all): monitor:write","body":{"mode":"raw","raw":"{\n  \"name\": \"web-01\",\n  \"offline_threshold_min\": 10,\n  \"blacklist\": true\n}","options":{"raw":{"language":"json"}}}}},{"name":"Server metrics (time series)","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/monitoring/servers/:id/metrics","host":["{{baseUrl}}"],"path":["api","monitoring","servers",":id","metrics"],"query":[{"key":"range","value":"","description":"1h | 6h | 24h | 7d | 30d (default: 24h)","disabled":true}],"variable":[{"key":"id","value":"","description":"Server ID (UUID)"}]},"description":"Returns historical CPU/RAM/disk/load metrics as a time series. The time range can be selected via query parameter. If the server has GPUs (NVIDIA/AMD), each data row contains `gpus`: `[{ \"i\": 0, \"util\": 83, \"mem\": 61.2, \"temp\": 71, \"power_w\": 312 }]` (utilization %, VRAM usage %, °C, watts; otherwise `null`). The detail endpoint `GET /servers/:id` additionally returns the latest state with names and VRAM size in `server.extras.gpus`.\n\nScopes (all): monitor:read"}},{"name":"List websites","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/monitoring/websites","host":["{{baseUrl}}"],"path":["api","monitoring","websites"],"query":[{"key":"kind","value":"","description":"`heartbeat` = heartbeat monitors only (together with `limit`)","disabled":true},{"key":"limit","value":"","description":"Entries per page (1–200); only with `kind=heartbeat`","disabled":true},{"key":"offset","value":"","description":"Start position","disabled":true},{"key":"q","value":"","description":"Search in name","disabled":true},{"key":"state","value":"","description":"Filter: `ok`, `late`, `failed`, `wait`","disabled":true},{"key":"sort","value":"","description":"Sort: `state`, `name`, `every`, `last`, `due`","disabled":true},{"key":"dir","value":"","description":"`asc` or `desc`","disabled":true}],"variable":[]},"description":"Returns all monitored websites of the organization, including current status, last response time and SSL expiry date. With `kind=heartbeat` and `limit`, only heartbeat monitors are returned, paginated (plus `total` and `used` = all monitors of the organization).\n\nScopes (all): monitor:read"}},{"name":"Add website","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/monitoring/websites","host":["{{baseUrl}}"],"path":["api","monitoring","websites"],"query":[],"variable":[]},"description":"Adds a website to monitoring. The check interval is limited to the plan minimum (Monitor Free: 900 s, Basic: 300 s, Pro and higher: 60 s; websites are checked at most once per minute). Fails with **402 limit_reached** if the plan limit is reached.\n\nScopes (all): monitor:write","body":{"mode":"raw","raw":"{\n  \"url\": \"https://example.com\",\n  \"name\": \"Produktiv-Website\",\n  \"check_interval_sec\": 60,\n  \"check_types\": [\n    \"uptime\",\n    \"ssl\",\n    \"response-time\",\n    \"dns\"\n  ]\n}","options":{"raw":{"language":"json"}}}}},{"name":"Update website","request":{"method":"PATCH","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/monitoring/websites/:id","host":["{{baseUrl}}"],"path":["api","monitoring","websites",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Website ID (UUID)"}]},"description":"Updates name, check interval, check types or alert configuration of a monitored website. Only the fields you send are overwritten.\n\nScopes (all): monitor:write","body":{"mode":"raw","raw":"{\n  \"check_interval_sec\": 30,\n  \"alert_channels\": {\n    \"slack_webhook\": \"https://hooks.slack.com/...\"\n  }\n}","options":{"raw":{"language":"json"}}}}},{"name":"Remove website","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/monitoring/websites/:id","host":["{{baseUrl}}"],"path":["api","monitoring","websites",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Website ID (UUID)"}]},"description":"Removes a website from monitoring. The entire check history is deleted.\n\nScopes (all): monitor:write"}},{"name":"Get website monitor","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/monitoring/websites/:id","host":["{{baseUrl}}"],"path":["api","monitoring","websites",":id"],"query":[],"variable":[{"key":"id","value":"","description":"UUID of the monitor"}]},"description":"Returns a monitor with its latest results per check type (`uptime`, `ssl`, `dns`, `blacklist`, `mail-auth` …), availability over the last 30 days (`uptimeDays`) and, for heartbeat monitors, the ping history including `next_due_at`. For the `mail-auth` check, `detail` contains the score (0–100) and findings `{ id, severity, title, fix, params }` (texts in German; `id` + `params` are suitable for your own translations). For the `blacklist` check, `detail` contains `listed`, `unknown` and `results` (per query `list`, `target`, `state` = `clean|listed|unknown`). For the `domain-expiry` check, `detail.unavailable: true` is set if the registry of the TLD (e.g. .de) does not publish an expiry date.\n\nScopes (all): monitor:read"}},{"name":"Get heartbeat history","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/monitoring/websites/:id/ping-stats","host":["{{baseUrl}}"],"path":["api","monitoring","websites",":id","ping-stats"],"query":[{"key":"range","value":"","description":"`day`, `week` (default), `month` or `year`","disabled":true},{"key":"tz","value":"","description":"Time zone offset in minutes as in `Date.getTimezoneOffset()` (Berlin in summer: -120)","disabled":true}],"variable":[{"key":"id","value":"","description":"UUID of the heartbeat monitor"}]},"description":"Reports of a heartbeat monitor per time bucket. `day` = 24 hours, `week` = 7 days, `month` = 30 days (from the individual reports, day boundaries in the time zone passed with `tz`), `year` = 365 days (UTC daily values). Buckets without a report are missing from `buckets` (count and grid are given in `from`, `size`, `count`).\n\nScopes (all): monitor:read"}},{"name":"Check log of a website","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/monitoring/websites/:id/log","host":["{{baseUrl}}"],"path":["api","monitoring","websites",":id","log"],"query":[{"key":"grouped","value":"","description":"`1` = combined per check run (returns `runs`, `total`)","disabled":true},{"key":"limit","value":"","description":"Entries per page (grouped: 1–200, default 25; otherwise 10–500, default 100)","disabled":true},{"key":"offset","value":"","description":"Start position (grouped only)","disabled":true},{"key":"page","value":"","description":"Page number (without grouped only)","disabled":true},{"key":"q","value":"","description":"Search text in status, check type and detail (grouped only)","disabled":true},{"key":"sort","value":"","description":"Sort (grouped): `time`, `status`, `response`, `code`","disabled":true},{"key":"dir","value":"","description":"`asc` or `desc`","disabled":true}],"variable":[{"key":"id","value":"","description":"UUID of the monitor"}]},"description":"Individual check results (uptime, SSL, domain expiry, blacklist …), newest first, paginated. With `grouped=1`, results are combined per check run (status, response time, status code) and filtered/sorted server-side.\n\nScopes (all): monitor:read"}},{"name":"History of a website (chart data)","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/monitoring/websites/:id/history","host":["{{baseUrl}}"],"path":["api","monitoring","websites",":id","history"],"query":[{"key":"hours","value":"","description":"Time range in hours (1–720, default 24)","disabled":true}],"variable":[{"key":"id","value":"","description":"UUID of the monitor"}]},"description":"Check results of the last hours, per check type as series `timestamps`, `values` (response time in ms) and `statuses`, ascending by time — basis for response time charts.\n\nScopes (all): monitor:read"}},{"name":"DNS records of the website domain","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/monitoring/websites/:id/dns","host":["{{baseUrl}}"],"path":["api","monitoring","websites",":id","dns"],"query":[],"variable":[{"key":"id","value":"","description":"UUID of the monitor"}]},"description":"Reads the current DNS records (A, AAAA, MX, NS) of the monitor's domain; types that cannot be resolved are returned as an empty list.\n\nScopes (all): monitor:read"}},{"name":"List heartbeat reports","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/monitoring/websites/:id/pings","host":["{{baseUrl}}"],"path":["api","monitoring","websites",":id","pings"],"query":[{"key":"limit","value":"","description":"Entries per page (1–200, default 25)","disabled":true},{"key":"offset","value":"","description":"Start position","disabled":true},{"key":"result","value":"","description":"Filter: `ok` or `fail`","disabled":true},{"key":"sort","value":"","description":"Sort: `time` or `result`","disabled":true},{"key":"dir","value":"","description":"`asc` or `desc`","disabled":true}],"variable":[{"key":"id","value":"","description":"UUID of the heartbeat monitor"}]},"description":"Report log of a heartbeat monitor (30 days), paginated. The per-day history is available as `ping_days` in `GET /api/monitoring/websites/:id`.\n\nScopes (all): monitor:read"}},{"name":"Report heartbeat (backup, cron job, script)","request":{"method":"POST","header":[],"url":{"raw":"{{baseUrl}}/api/monitoring/heartbeat/:token","host":["{{baseUrl}}"],"path":["api","monitoring","heartbeat",":token"],"query":[{"key":"msg","value":"","description":"Short message from the job (at most 300 characters)","disabled":true},{"key":"status","value":"","description":"fail = report a failure","disabled":true},{"key":"code","value":"","description":"Exit code of the job (0 = ok, otherwise failure)","disabled":true}],"variable":[{"key":"token","value":"","description":"Heartbeat token of the monitor"}]},"description":"Public endpoint for heartbeat monitors: the job calls the URL after each run (GET or POST, e.g. `curl -fsS https://…/api/monitoring/heartbeat/TOKEN`). With the suffix `/fail` (or `?status=fail` or `?code=<exit code>` with a value ≠ 0), the job reports a failure. Optionally, a short message can be sent along (`?msg=…`, as form field `msg` or as text in the body, at most 300 characters); it appears in the report log and in the alert for a reported failure. If the call fails to arrive for longer than interval + grace period, an alert is raised. The token is part of the monitor's URL."}}]},{"name":"Jobs","item":[{"name":"List jobs","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/jobs","host":["{{baseUrl}}"],"path":["api","jobs"],"query":[],"variable":[]},"description":"Returns all of your own background jobs (max. 50, newest first).\n\nScopes (any of): scan:read, scan:write, code:audit"}},{"name":"Job status","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/jobs/:id","host":["{{baseUrl}}"],"path":["api","jobs",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Job UUID"}]},"description":"Status, progress and result of a job.\n\nScopes (any of): scan:read, scan:write, code:audit"}},{"name":"SSE progress","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/jobs/:id/stream","host":["{{baseUrl}}"],"path":["api","jobs",":id","stream"],"query":[],"variable":[{"key":"id","value":"","description":"Job UUID"}]},"description":"Server-Sent Events stream for real-time progress. Sends progress events until the job is complete.\n\nScopes (any of): scan:read, scan:write, code:audit"}}]},{"name":"Reports & AI","item":[{"name":"Summary of the latest check of a domain","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/scans/summary","host":["{{baseUrl}}"],"path":["api","user","scans","summary"],"query":[{"key":"domain","value":"","description":"Domain, e.g. example.com (with or without https:// / www.)","disabled":false}],"variable":[]},"description":"Compact overview for widgets, plugins and dashboards: overall grade, trend compared to the previous audit, findings, **category index** per area (`gdpr` privacy, `a11y` accessibility, `seo` SEO & GEO, `security` security; 100 minus weighted findings, only for areas the audit checked), link to the online report and to the PDF. Uses the domain's latest completed audit.\n\nScopes (all): scan:read"}},{"name":"PDF report from scan result","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/audit/report","host":["{{baseUrl}}"],"path":["api","audit","report"],"query":[],"variable":[]},"description":"Creates a branded PDF report from an existing scan JSON. No new scan — ideal if the result is already available. Optional aiAnalysis field for an AI-assisted section.\n\nScopes (all): scan:write"}},{"name":"HTML report from scan result","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/audit/report/html","host":["{{baseUrl}}"],"path":["api","audit","report","html"],"query":[],"variable":[]},"description":"Like /report, but as a complete HTML document with embedded CSS. For direct display in the browser or embedding in your own portals.\n\nScopes (all): scan:write"}},{"name":"Scan + PDF in one call","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/audit/scan-and-report","host":["{{baseUrl}}"],"path":["api","audit","scan-and-report"],"query":[],"variable":[]},"description":"Runs a complete scan and returns the PDF report directly. With \"ai\":true, an AI analysis report is also included (takes longer, ~30–60 s extra).\n\nScopes (all): scan:write","body":{"mode":"raw","raw":"{\n  \"url\": \"https://example.com\",\n  \"options\": {\n    \"ai\": false,\n    \"customerName\": \"Musterfirma GmbH\",\n    \"language\": \"de\",\n    \"screenshot\": true\n  }\n}","options":{"raw":{"language":"json"}}}}},{"name":"Scan + HTML report in one call","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/audit/scan-and-report/html","host":["{{baseUrl}}"],"path":["api","audit","scan-and-report","html"],"query":[],"variable":[]},"description":"Like scan-and-report, but returns an HTML document instead of a PDF. Useful for web display or email integration.\n\nScopes (all): scan:write","body":{"mode":"raw","raw":"{\n  \"url\": \"https://example.com\",\n  \"options\": {\n    \"ai\": false,\n    \"customerName\": \"Musterfirma GmbH\",\n    \"language\": \"de\"\n  }\n}","options":{"raw":{"language":"json"}}}}},{"name":"Start AI analysis","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/scans/:id/analyze","host":["{{baseUrl}}"],"path":["api","user","scans",":id","analyze"],"query":[],"variable":[{"key":"id","value":"","description":"Scan ID (UUID) from the scan history"}]},"description":"Starts the AI-assisted evaluation of a stored scan asynchronously. Immediate response — poll the status via /analyze-status. Returns \"ready\" directly if an analysis already exists.\n\nScopes (all): scan:write"}},{"name":"AI analysis status","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/scans/:id/analyze-status","host":["{{baseUrl}}"],"path":["api","user","scans",":id","analyze-status"],"query":[],"variable":[{"key":"id","value":"","description":"Scan ID (UUID)"}]},"description":"Polls the status of the running AI analysis. Status: \"generating\" (in progress), \"ready\" (done), \"idle\" (not started yet), \"error\" (failed).\n\nScopes (all): scan:read"}},{"name":"Download PDF report (8 types)","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/scans/:id/pdf","host":["{{baseUrl}}"],"path":["api","user","scans",":id","pdf"],"query":[{"key":"type","value":"","description":"full (default) | security | gdpr | accessibility | seo_geo | wordpress | individual | nis2 | dora — wordpress (WordPress emergency report) is used automatically for WP Emergency Check scans, individual is used automatically for scans with several, but not all, topic areas","disabled":true}],"variable":[{"key":"id","value":"","description":"Scan ID (UUID)"}]},"description":"Downloads a specialized PDF report. The query parameter `type` determines which sections are included. If an AI analysis exists, it is embedded automatically. For `nis2` and `dora`, the compliance mappers are run on the fly (including the latest questionnaire context). **Scoped scans:** If only a subset of modules was scanned (purchased single product such as `seo-geo-audit`/`bfsg-audit`, or manually deselected modules), the server enforces the report type matching the scan — the `type` parameter is then ignored, so `?type=full` cannot unlock areas that were not scanned.\n\nScopes (all): report:read"}},{"name":"Export findings (JSON, CSV, SARIF)","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/scans/:id/findings","host":["{{baseUrl}}"],"path":["api","user","scans",":id","findings"],"query":[{"key":"format","value":"","description":"json (default) | csv | sarif","disabled":true}],"variable":[{"key":"id","value":"","description":"Scan ID (UUID)"}]},"description":"Machine-readable export of all findings of a website scan with the **location per page and element** (page URL, CSS path of the element, text, detail, HTML snippet). Accessibility and SEO findings are merged per rule for the whole website: `pages_affected`/`pages_checked`/`count_total`, `pages[]` (affected pages with elements) and `template_elements[]` (elements that occur identically on a large share of the pages – header, footer, navigation – and need to be fixed once in the template). `format=json` returns the schema `auditcollector.findings/1` including area grades (`scan.scores`) and coverage; `format=csv` one row per location (UTF-8 with BOM, formula characters are neutralized); `format=sarif` SARIF 2.1.0 for developer tools. For a restricted scope (single audit), the export contains only the findings of the scanned area.\n\nScopes (all): report:read"}},{"name":"Get AI consent","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/ai-consent","host":["{{baseUrl}}"],"path":["api","user","ai-consent"],"query":[],"variable":[]},"description":"Returns whether the user has permanently consented to AI data sharing (remember=true) and when the consent was given.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Save AI consent","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/ai-consent","host":["{{baseUrl}}"],"path":["api","user","ai-consent"],"query":[],"variable":[]},"description":"Saves the permanent consent to AI data sharing. After that, the consent dialog no longer appears before AI analyses.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Revoke AI consent","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/ai-consent","host":["{{baseUrl}}"],"path":["api","user","ai-consent"],"query":[],"variable":[]},"description":"Revokes the stored AI consent. The consent dialog appears again before the next AI analysis.\n\nDashboard session (login) only, not available with access tokens"}}]},{"name":"Compliance","item":[{"name":"GDPR and accessibility status per domain","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/compliance/overview","host":["{{baseUrl}}"],"path":["api","compliance","overview"],"query":[],"variable":[]},"description":"Summarizes, per domain (without www, across all spellings of the target URL), the latest GDPR and BFSG status from all scans of the organization that include the area: full scans, scheduled scans and GDPR/BFSG audits. Quick checks, WordPress and consent watchers are not counted. The value is the GDPR score of a GDPR scan, otherwise an index derived from the area's findings (100 − 8 per high, 3 per medium, 1 per low). Levels: ok ≥ 90, partial ≥ 70, otherwise critical.\n\nScopes (all): scan:read"}}]},{"name":"OIDC Provider","item":[{"name":"Discovery document","request":{"method":"GET","header":[],"url":{"raw":"{{baseUrl}}/.well-known/openid-configuration","host":["{{baseUrl}}"],"path":[".well-known","openid-configuration"],"query":[],"variable":[]},"description":"OpenID Connect discovery document with all endpoint URLs, supported scopes, algorithms and claims."}},{"name":"JWKS (public keys)","request":{"method":"GET","header":[],"url":{"raw":"{{baseUrl}}/.well-known/jwks.json","host":["{{baseUrl}}"],"path":[".well-known","jwks.json"],"query":[],"variable":[]},"description":"JSON Web Key Set — public RSA-2048 keys for verifying ID tokens (RS256)."}},{"name":"Token exchange","request":{"method":"POST","header":[{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/oauth/token","host":["{{baseUrl}}"],"path":["oauth","token"],"query":[],"variable":[]},"description":"Issues access tokens. **`grant_type=client_credentials`** (server-to-server, recommended for integrations): exchange the client ID and secret of a service client (Settings → API access) for a short-lived access token (default 1 hour, no refresh token); optional `scope` (space-separated, subset of the allowed scopes). **`authorization_code`**: exchanges an authorization code for access token + ID token + (optional) refresh token; PKCE (`code_verifier`) for public clients. **`refresh_token`**: renews tokens. Client authentication via HTTP Basic (`client_secret_basic`) or in the body (`client_secret_post`). Body: application/x-www-form-urlencoded."}},{"name":"Userinfo","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/oauth/userinfo","host":["{{baseUrl}}"],"path":["oauth","userinfo"],"query":[],"variable":[]},"description":"Returns user info (depending on the granted scopes: `email`, `profile`). Requires an OIDC access token in the `Authorization: Bearer` header.\n\nScopes (all): openid"}},{"name":"Revoke token","request":{"method":"POST","header":[{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/oauth/revoke","host":["{{baseUrl}}"],"path":["oauth","revoke"],"query":[],"variable":[]},"description":"Immediately revokes an access token or refresh token. Afterwards, all API calls with this token are rejected with 401."}},{"name":"Token introspection","request":{"method":"POST","header":[{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/oauth/introspect","host":["{{baseUrl}}"],"path":["oauth","introspect"],"query":[],"variable":[]},"description":"Checks whether an access token is active and returns metadata (sub, scope, exp). Useful for server-to-server communication."}},{"name":"Dynamic Client Registration (RFC 7591)","request":{"method":"POST","header":[{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/oauth/register","host":["{{baseUrl}}"],"path":["oauth","register"],"query":[],"variable":[]},"description":"Space-separated; trimmed to the allowlist: openid, profile, email, offline_access, scan:read, scan:write, report:read, monitor:read (excludes code:audit, monitor:write and domain:*)","body":{"mode":"raw","raw":"{\n  \"client_name\": \"Claude\",\n  \"redirect_uris\": [\n    \"https://claude.ai/api/mcp/auth_callback\"\n  ],\n  \"scope\": \"openid profile scan:read scan:write report:read\",\n  \"token_endpoint_auth_method\": \"none\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Protected Resource Metadata (for /mcp)","request":{"method":"GET","header":[],"url":{"raw":"{{baseUrl}}/.well-known/oauth-protected-resource","host":["{{baseUrl}}"],"path":[".well-known","oauth-protected-resource"],"query":[],"variable":[]},"description":"Tells MCP clients which authorization server is responsible for the `/mcp` endpoint — referenced by a `401` response on `/mcp` via the `WWW-Authenticate` header so that the client can start the OAuth flow automatically."}},{"name":"MCP endpoint (Model Context Protocol)","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/mcp","host":["{{baseUrl}}"],"path":["mcp"],"query":[],"variable":[]},"description":"Not a regular REST/JSON endpoint, but an MCP server over the Streamable HTTP transport (JSON-RPC 2.0) — intended for AI agents such as Claude or ChatGPT, not for direct calls from your own code. Auth via OAuth access token (`Authorization: Bearer`), no API key. Provides 8 tools: start_scan, get_job_status, list_scans, get_scan, get_scan_pdf, generate_ai_report, get_ai_report_status, list_available_presets. Setup details: see `mcp-server/README.md` (repo) or the guide \"Connect EMPEDIAcloud to Claude/ChatGPT\".\n\nScopes (all): scan:read, scan:write, report:read"}},{"name":"List OIDC clients","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/oidc-clients","host":["{{baseUrl}}"],"path":["api","user","oidc-clients"],"query":[],"variable":[]},"description":"Lists all OIDC client apps of your own organization.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Register OIDC client","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/user/oidc-clients","host":["{{baseUrl}}"],"path":["api","user","oidc-clients"],"query":[],"variable":[]},"description":"Registers a new OIDC app. The `client_secret` is returned **once** in the response — it cannot be retrieved afterwards. For public clients (SPAs, mobile), set `is_public: true` — then there is no secret and PKCE is required instead. For **server-to-server integrations**, set `service_client: true` (no `redirect_uris` needed, API scopes only): the client obtains short-lived tokens via `client_credentials`. The token acts on behalf of the user who created the client.\n\nDashboard session (login) only, not available with access tokens","body":{"mode":"raw","raw":"{\n  \"name\": \"My Integration\",\n  \"redirect_uris\": [\n    \"https://myapp.example.com/callback\"\n  ],\n  \"is_public\": false,\n  \"allowed_scopes\": [\n    \"openid\",\n    \"email\",\n    \"scan:read\"\n  ]\n}","options":{"raw":{"language":"json"}}}}},{"name":"Rotate client secret","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/oidc-clients/:id/rotate-secret","host":["{{baseUrl}}"],"path":["api","user","oidc-clients",":id","rotate-secret"],"query":[],"variable":[{"key":"id","value":"","description":"Client ID (UUID) from the list"}]},"description":"Generates a new client secret. The old secret becomes invalid immediately. Confidential clients only (not public).\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Delete OIDC client","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/oidc-clients/:id","host":["{{baseUrl}}"],"path":["api","user","oidc-clients",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Client ID (UUID) from the list"}]},"description":"Deletes the app registration. All issued tokens become invalid.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"List connected apps","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/connected-apps","host":["{{baseUrl}}"],"path":["api","user","connected-apps"],"query":[],"variable":[]},"description":"Consumer view (counterpart to the oidc-clients endpoints above, which manage the apps provided by your own account): lists third-party apps to which the current user has granted access via the OAuth consent screen — e.g. an MCP connector such as Claude or ChatGPT. Reachable only via a dashboard session (JWT), not via API keys or OAuth tokens themselves.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Revoke access of a connected app","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/connected-apps/:clientId","host":["{{baseUrl}}"],"path":["api","user","connected-apps",":clientId"],"query":[],"variable":[{"key":"clientId","value":"","description":"The OAuth client_id string (not the internal app UUID) from the connected-apps list"}]},"description":"Deletes the granted consent (oidc_consents) and immediately revokes all still-valid access/refresh tokens of this app for the current user. The app must then go through the full OAuth flow (including the consent screen) again to regain access.\n\nDashboard session (login) only, not available with access tokens"}}]},{"name":"Async jobs","item":[{"name":"Start scan as background job","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/audit/start-async","host":["{{baseUrl}}"],"path":["api","audit","start-async"],"query":[],"variable":[]},"description":"Starts a (possibly multi-step) scan asynchronously and returns a job_id. Progress via GET /api/jobs/:id/stream (SSE). Requires the scan:write scope and a verified domain. **Safely retryable:** with the `Idempotency-Key` header (8–128 characters, e.g. a UUID), a repeated request within 24 hours returns the same response (header `Idempotent-Replayed: true`) without starting a second scan or consuming quota. Different body with the same key → 422, request still in progress → 409.\n\nScopes (all): scan:write","body":{"mode":"raw","raw":"{\n  \"url\": \"https://example.com\",\n  \"checks\": {\n    \"security\": [],\n    \"dns\": []\n  },\n  \"maxPages\": 20\n}","options":{"raw":{"language":"json"}}}}},{"name":"Code audit (upload) as job","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/code/analyze-async","host":["{{baseUrl}}"],"path":["api","code","analyze-async"],"query":[],"variable":[]},"description":"Uploads an archive (.zip/.tar/.tar.gz, multipart/form-data field \"file\") and starts the analysis as a background job. Optional fullAiScan=true.\n\nScopes (all): code:audit"}},{"name":"Code audit (Git/SFTP/FTP) as job","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/code/connect-async","host":["{{baseUrl}}"],"path":["api","code","connect-async"],"query":[],"variable":[]},"description":"Fetches source code via Git/SFTP/FTP and starts the analysis as a background job. Target hosts are checked against private/internal addresses (SSRF).\n\nScopes (all): code:audit","body":{"mode":"raw","raw":"{\n  \"method\": \"git\",\n  \"repoUrl\": \"https://github.com/org/repo.git\",\n  \"branch\": \"main\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Test connection","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/code/test-connection","host":["{{baseUrl}}"],"path":["api","code","test-connection"],"query":[],"variable":[]},"description":"Checks Git/SFTP/FTP reachability (rate-limited). On failure, HTTP 500 with {success:false} is returned.\n\nScopes (all): code:audit","body":{"mode":"raw","raw":"{\n  \"method\": \"sftp\",\n  \"host\": \"sftp.example.com\",\n  \"port\": 22,\n  \"username\": \"user\",\n  \"password\": \"...\"\n}","options":{"raw":{"language":"json"}}}}}]},{"name":"Webhooks & Badges","item":[{"name":"List webhooks","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/webhooks","host":["{{baseUrl}}"],"path":["api","webhooks"],"query":[],"variable":[]},"description":"All webhook endpoints of the organization and the available event types. The signing secrets cannot be retrieved.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Create webhook","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/webhooks","host":["{{baseUrl}}"],"path":["api","webhooks"],"query":[],"variable":[]},"description":"Creates an endpoint (https only, no internal addresses; at most 10). The signing secret (`secret`, prefix `whsec_`) is returned **only once**. Empty `events` list = all events. Delivery, signature and retries: see the \"Webhooks\" guide.\n\nDashboard session (login) only, not available with access tokens","body":{"mode":"raw","raw":"{\n  \"url\": \"https://example.com/hooks/auditcollector\",\n  \"events\": [\n    \"scan.completed\",\n    \"score.degraded\",\n    \"monitor.down\"\n  ]\n}","options":{"raw":{"language":"json"}}}}},{"name":"Update webhook","request":{"method":"PATCH","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/webhooks/:id","host":["{{baseUrl}}"],"path":["api","webhooks",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Webhook UUID"}]},"description":"Changes the URL, events, or enables/disables the endpoint. Re-enabling resets the failure counter.\n\nDashboard session (login) only, not available with access tokens","body":{"mode":"raw","raw":"{\n  \"enabled\": true\n}","options":{"raw":{"language":"json"}}}}},{"name":"Delete webhook","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/webhooks/:id","host":["{{baseUrl}}"],"path":["api","webhooks",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Webhook UUID"}]},"description":"Removes the endpoint including its delivery log.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Rotate signing secret","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/webhooks/:id/rotate-secret","host":["{{baseUrl}}"],"path":["api","webhooks",":id","rotate-secret"],"query":[],"variable":[{"key":"id","value":"","description":"Webhook UUID"}]},"description":"Generates a new secret (visible only once); the old one becomes invalid immediately.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Send test event","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/webhooks/:id/test","host":["{{baseUrl}}"],"path":["api","webhooks",":id","test"],"query":[],"variable":[{"key":"id","value":"","description":"Webhook UUID"}]},"description":"Synchronously sends a signed `ping` event and returns the HTTP status of your server.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Delivery log","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/webhooks/:id/deliveries","host":["{{baseUrl}}"],"path":["api","webhooks",":id","deliveries"],"query":[],"variable":[{"key":"id","value":"","description":"Webhook UUID"}]},"description":"The last 30 deliveries with status (`pending`, `delivered`, `failed`), attempts and response code.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"List badges","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/badges","host":["{{baseUrl}}"],"path":["api","user","badges"],"query":[],"variable":[]},"description":"All badges of the organization with embed code.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Create badge for a domain","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/user/badges","host":["{{baseUrl}}"],"path":["api","user","badges"],"query":[],"variable":[]},"description":"Creates a public badge, revocable at any time, for a **verified** domain of your organization. It shows the grade of the latest check; after 35 days without a new check it shows \"Check expired\".\n\nDashboard session (login) only, not available with access tokens","body":{"mode":"raw","raw":"{\n  \"domain\": \"example.com\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Delete badge","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/user/badges/:id","host":["{{baseUrl}}"],"path":["api","user","badges",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Badge UUID"}]},"description":"Revokes the badge immediately; embedded images show nothing afterwards.\n\nDashboard session (login) only, not available with access tokens"}},{"name":"Get badge (SVG)","request":{"method":"GET","header":[],"url":{"raw":"{{baseUrl}}/api/public/badge/:token.svg","host":["{{baseUrl}}"],"path":["api","public","badge","{token}.svg"],"query":[],"variable":[{"key":"token","value":"","description":"Badge token"}]},"description":"Public image for websites (`<img>`); cached for 15 minutes. With `.json` instead of `.svg`, the raw data is returned: `domain`, `grade`, `score`, `scanned_at`, `valid`."}}]},{"name":"Email security (DMARC and TLS-RPT)","item":[{"name":"Domains with email reports (DMARC, TLS-RPT)","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/email-security","host":["{{baseUrl}}"],"path":["api","email-security"],"query":[],"variable":[]},"description":"Lists the organization's domains with their report address (applies to DMARC and TLS-RPT), quota, and metrics for the last 30 days (DMARC emails, TLS sessions, status of both setups). Report reception is a server feature (`enabled`); the quota comes from the plan (Monitor Pro 1, Business 3, Agency 5, Agency Pro 15, more via add-on).\n\nScopes (all): monitor:read"}},{"name":"Add domain","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/email-security","host":["{{baseUrl}}"],"path":["api","email-security"],"query":[],"variable":[]},"description":"Creates a domain and generates the report address `r-<token>@<rua-domain>`. Enter this address in the domain's DMARC record under `rua=` (append to existing addresses with a comma). Reports usually arrive after 24–48 hours.\n\nScopes (all): monitor:write","body":{"mode":"raw","raw":"{\n  \"domain\": \"kunde.de\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Domain analysis","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/email-security/:id/summary","host":["{{baseUrl}}"],"path":["api","email-security",":id","summary"],"query":[{"key":"days","value":"","description":"7 | 30 | 90 | 365 (default 30)","disabled":true}],"variable":[{"key":"id","value":"","description":"Domain UUID"}]},"description":"Totals, daily trend, and sender sources (with reverse DNS name; `is_new` marks sources that did not appear before the period). \"Passed\" means SPF or DKIM passed and aligned with the domain.\n\nScopes (all): monitor:read"}},{"name":"Domain with setup and settings","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/email-security/:id","host":["{{baseUrl}}"],"path":["api","email-security",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Domain UUID"}]},"description":"Master data, report address (`rua`), setup status (`setup`: status, last checked, existing record, other `rua` recipients, ready-made suggestion), alert thresholds, and notification channels.\n\nScopes (all): monitor:read"}},{"name":"Configure alerting and notifications","request":{"method":"PATCH","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/email-security/:id","host":["{{baseUrl}}"],"path":["api","email-security",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Domain UUID"}]},"description":"Enables or disables alerting per domain and sets the thresholds. Alerts on a new source without passing SPF/DKIM (from `alert_min_mails` emails; the first three reports of a domain do not trigger an alert) and on a daily pass rate below `alert_pass_below` percent (from 20 emails per day).\n\nScopes (all): monitor:write","body":{"mode":"raw","raw":"{\n  \"alert_enabled\": true,\n  \"alert_min_mails\": 10,\n  \"alert_pass_below\": 90\n}","options":{"raw":{"language":"json"}}}}},{"name":"Remove domain","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/email-security/:id","host":["{{baseUrl}}"],"path":["api","email-security",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Domain UUID"}]},"description":"Removes the domain including all stored reports.\n\nScopes (all): monitor:write"}},{"name":"Report log","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/email-security/:id/reports","host":["{{baseUrl}}"],"path":["api","email-security",":id","reports"],"query":[{"key":"page","value":"","description":"Page (default 1)","disabled":true},{"key":"per_page","value":"","description":"5–100 (default 20)","disabled":true}],"variable":[{"key":"id","value":"","description":"Domain UUID"}]},"description":"Received aggregate reports, newest first: reporter (e.g. google.com), period, emails, of which passed, policy.\n\nScopes (all): monitor:read"}},{"name":"Single report","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/email-security/:id/reports/:rid","host":["{{baseUrl}}"],"path":["api","email-security",":id","reports",":rid"],"query":[],"variable":[{"key":"id","value":"","description":"Domain UUID"},{"key":"rid","value":"","description":"Report UUID"}]},"description":"All rows (sources) of a report with hostname, emails, disposition, DKIM/SPF alignment, and domains.\n\nScopes (all): monitor:read"}},{"name":"TLS-RPT: domain analysis","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/email-security/:id/tlsrpt/summary","host":["{{baseUrl}}"],"path":["api","email-security",":id","tlsrpt","summary"],"query":[{"key":"days","value":"","description":"7 | 30 | 90 | 365 (default 30)","disabled":true}],"variable":[{"key":"id","value":"","description":"Domain UUID"}]},"description":"TLS-RPT reports (RFC 8460): total sessions, daily trend, failure types (`result_type` with hint text), affected mail servers (MX), policy types (MTA-STS, DANE, none), and reporters. Same report address as for DMARC; the TXT record `_smtp._tls.<domain>` is available with status and suggestion in `GET /api/email-security/:id` under `tlsrpt`.\n\nScopes (all): monitor:read"}},{"name":"TLS-RPT: report log","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/email-security/:id/tlsrpt/reports","host":["{{baseUrl}}"],"path":["api","email-security",":id","tlsrpt","reports"],"query":[{"key":"limit","value":"","description":"1–200 (default 25)","disabled":true},{"key":"offset","value":"","description":"Default 0","disabled":true},{"key":"q","value":"","description":"Search in reporter and report ID","disabled":true},{"key":"result","value":"","description":"`failed` = only reports with failures, `ok` = without failures","disabled":true},{"key":"sort","value":"","description":"`from`, `period`, `sessions`, `failed`","disabled":true},{"key":"dir","value":"","description":"`asc` or `desc`","disabled":true}],"variable":[{"key":"id","value":"","description":"Domain UUID"}]},"description":"Received TLS-RPT reports, paginated (newest first).\n\nScopes (all): monitor:read"}},{"name":"TLS-RPT: single report","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/email-security/:id/tlsrpt/reports/:rid","host":["{{baseUrl}}"],"path":["api","email-security",":id","tlsrpt","reports",":rid"],"query":[],"variable":[{"key":"id","value":"","description":"Domain UUID"},{"key":"rid","value":"","description":"Report UUID"}]},"description":"One report with policies (type, domain, sessions) and failure rows (failure type, sending IP, receiving MX, count, reason).\n\nScopes (all): monitor:read"}},{"name":"CSV export","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/email-security/:id/export.csv","host":["{{baseUrl}}"],"path":["api","email-security",":id","export.csv"],"query":[{"key":"kind","value":"","description":"sources (default) | reports","disabled":true},{"key":"days","value":"","description":"7 | 30 | 90 | 365 (sources only)","disabled":true}],"variable":[{"key":"id","value":"","description":"Domain UUID"}]},"description":"Sources (`kind=sources`, with `days`) or report log (`kind=reports`) as CSV (semicolon, UTF-8 with BOM, cells protected against formula injection).\n\nScopes (all): monitor:read"}},{"name":"Check setup","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/email-security/:id/check","host":["{{baseUrl}}"],"path":["api","email-security",":id","check"],"query":[],"variable":[{"key":"id","value":"","description":"Domain UUID"}]},"description":"Checks live via DNS (the check otherwise runs automatically: hourly until setup is complete, daily afterwards; calls within 20 seconds return the stored result). `status`: ok | waiting (set up, no report yet) | record_missing | rua_missing | unauthorized | unknown. `setup.suggested_record` is the ready-made TXT value for `_dmarc.<domain>`: for an existing record, our address is added to `rua=`, never replaced. Additionally, the rest of the previous description: checks live via DNS whether the domain's DMARC record contains the report address and whether the authorization of the report domain is reachable.\n\nScopes (all): monitor:read"}},{"name":"Renew report address","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/email-security/:id/token","host":["{{baseUrl}}"],"path":["api","email-security",":id","token"],"query":[],"variable":[{"key":"id","value":"","description":"Domain UUID"}]},"description":"Generates a new report address. The old one becomes invalid immediately (emails to it are rejected) — the `rua=` record in DNS must be changed afterwards, otherwise no more reports will arrive. Stored reports are retained.\n\nScopes (all): monitor:write"}}]},{"name":"Domain management (domains, DNS, certificates)","item":[{"name":"Domains of the organization","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/domains","host":["{{baseUrl}}"],"path":["api","domain-portfolio","domains"],"query":[{"key":"limit","value":"","description":"1–200","disabled":true},{"key":"offset","value":"","description":"Start offset","disabled":true},{"key":"q","value":"","description":"Search","disabled":true}],"variable":[]},"description":"Lists the domains with expiry date, nameserver set, auto-renewal and deletion mark. Filters `quick` (expiring, cancelled, nozone), `ns_set`, `renew`; sorting via `sort` (name, ns, expire, renew) and `dir`. The \"Domains\" area must be enabled for the organization, otherwise 404.\n\nScopes (all): domain:read","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Domain details","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/domains/:id","host":["{{baseUrl}}"],"path":["api","domain-portfolio","domains",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Shows contacts (handles), name servers, DNSSEC state, and zone of a domain belonging to the own organization.\n\nScopes (all): domain:read","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Change domain","request":{"method":"PATCH","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/domains/:id","host":["{{baseUrl}}"],"path":["api","domain-portfolio","domains",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Changes auto-renewal (`auto_renew`), name servers (`ns_profile` or `nameservers`, 2–13), and owner/admin contact. For TLDs that charge for changes (e.g. owner change), the fee is deducted from the credit balance in advance. Changes are only possible when write access is enabled by the operator (otherwise 409).\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"{\n  \"auto_renew\": \"TRUE\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Price and availability of a registration","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/orders/quote","host":["{{baseUrl}}"],"path":["api","domain-portfolio","orders","quote"],"query":[{"key":"domain","value":"","description":"Domain name","disabled":false},{"key":"years","value":"","description":"Term in years","disabled":true}],"variable":[]},"description":"Returns the current net price (from the price list, never from memory), the minimum term, and the credit balance. Pass the price as `expect_net_cents` when ordering; if it has changed, the order is rejected with `price_changed`.\n\nScopes (all): domain:read","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Register domain","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/orders/register","host":["{{baseUrl}}"],"path":["api","domain-portfolio","orders","register"],"query":[],"variable":[]},"description":"Registers a domain. **Billable:** the amount is deducted from the credit balance in advance (prepayment, no credit limit) and automatically refunded on failure; on success the invoice follows on the same day. The order runs asynchronously (response 202); the result is delivered via webhook `domain.order.completed` or `domain.order.failed`, or via `GET /orders`. With the `Idempotency-Key` header (8–128 characters), a retry within 24 hours is neither executed nor charged twice. TLDs with special rules (proofs, trustee …) are handled via a request (`POST /requests`).\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"{\n  \"domain\": \"kunde.de\",\n  \"years\": 1,\n  \"expect_net_cents\": 1290,\n  \"contacts\": {\n    \"owner\": {}\n  }\n}","options":{"raw":{"language":"json"}}}}},{"name":"Orders","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/orders","host":["{{baseUrl}}"],"path":["api","domain-portfolio","orders"],"query":[{"key":"status","value":"","description":"processing | completed | failed | simulated","disabled":true},{"key":"limit","value":"","description":"1–200","disabled":true},{"key":"offset","value":"","description":"Start offset","disabled":true}],"variable":[]},"description":"Lists orders (registration, renewal, restoration, transfer, paid change) with status `processing`, `completed`, `failed`, or `simulated`, amount, and refund.\n\nScopes (all): domain:read","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Renew domain","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/domains/:id/renew","host":["{{baseUrl}}"],"path":["api","domain-portfolio","domains",":id","renew"],"query":[],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Renews the domain at the current list price, charged to the credit balance. With the `Idempotency-Key` header (8–128 characters), a retry within 24 hours is neither executed nor charged twice. \n\nScopes (all): domain:write","body":{"mode":"raw","raw":"{\n  \"years\": 1\n}","options":{"raw":{"language":"json"}}}}},{"name":"Restore deleted domain","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/domains/:id/restore","host":["{{baseUrl}}"],"path":["api","domain-portfolio","domains",":id","restore"],"query":[],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Restores a domain in its deletion grace period (restoration fee, plus renewal depending on the TLD), charged to the credit balance. With the `Idempotency-Key` header (8–128 characters), a retry within 24 hours is neither executed nor charged twice. \n\nScopes (all): domain:write","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Cancel at expiry","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/domains/:id/cancel","host":["{{baseUrl}}"],"path":["api","domain-portfolio","domains",":id","cancel"],"query":[],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Marks the domain for deletion at its expiry date (free of charge). Requires `confirm: true`. The cancellation can be revoked at any time until then (`/uncancel`). Immediate deletion is not available.\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"{\n  \"confirm\": true\n}","options":{"raw":{"language":"json"}}}}},{"name":"Revoke cancellation","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/domains/:id/uncancel","host":["{{baseUrl}}"],"path":["api","domain-portfolio","domains",":id","uncancel"],"query":[],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Revokes the deletion mark.\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Records of a zone","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/zones/:id/records","host":["{{baseUrl}}"],"path":["api","domain-portfolio","zones",":id","records"],"query":[{"key":"quick","value":"","description":"Type, e.g. MX","disabled":true},{"key":"limit","value":"","description":"1–200","disabled":true},{"key":"offset","value":"","description":"Start offset","disabled":true}],"variable":[{"key":"id","value":"","description":"Zone ID"}]},"description":"Reads the resource records live. Filter `q`, `quick` (type), sorting `sort`, `dir`. Zones exist only for domains on our name servers.\n\nScopes (all): domain:read","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Change zone","request":{"method":"PATCH","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/zones/:id/records","host":["{{baseUrl}}"],"path":["api","domain-portfolio","zones",":id","records"],"query":[],"variable":[{"key":"id","value":"","description":"Zone ID"}]},"description":"Adds and removes records in a single step; everything is validated before writing (CNAME conflicts, structure of SRV/CAA/TXT, protected NS at the apex). Warnings (e.g. last MX removed) are returned with the response. Every change is recorded in the change log and can be reverted.\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"{\n  \"add\": [\n    {\n      \"name\": \"www\",\n      \"type\": \"CNAME\",\n      \"value\": \"kunde.de.\",\n      \"ttl\": 3600\n    }\n  ],\n  \"remove\": []\n}","options":{"raw":{"language":"json"}}}}},{"name":"Zone change log","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/zones/:id/changes","host":["{{baseUrl}}"],"path":["api","domain-portfolio","zones",":id","changes"],"query":[],"variable":[{"key":"id","value":"","description":"Zone ID"}]},"description":"Lists the changes with timestamp, author, source, and affected records.\n\nScopes (all): domain:read","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Revert zone change","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/zones/:id/changes/:cid/rollback","host":["{{baseUrl}}"],"path":["api","domain-portfolio","zones",":id","changes",":cid","rollback"],"query":[],"variable":[{"key":"id","value":"","description":"Zone ID"},{"key":"cid","value":"","description":"Change ID"}]},"description":"Reverts a change as far as the current state allows; skipped records are reported.\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Zone as BIND file","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/zones/:id/export","host":["{{baseUrl}}"],"path":["api","domain-portfolio","zones",":id","export"],"query":[],"variable":[{"key":"id","value":"","description":"Zone ID"}]},"description":"Returns the zone in BIND zone file format (backup).\n\nScopes (all): domain:read","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Orderable certificates","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/certificates/catalog","host":["{{baseUrl}}"],"path":["api","domain-portfolio","certificates","catalog"],"query":[],"variable":[]},"description":"Lists the orderable products (DV single and wildcard) with terms and net prices. OV, EV, S/MIME, code signing, and other types are handled via a request.\n\nScopes (all): domain:read","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Prepare certificate order","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/certificates/prepare","host":["{{baseUrl}}"],"path":["api","domain-portfolio","certificates","prepare"],"query":[],"variable":[]},"description":"Validates the **CSR** (Certificate Signing Request) and returns the name, price, and available validation methods (DNS, email). **Private keys are never accepted or stored** – a private key in the field is rejected with `private_key_rejected`.\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"{\n  \"product_id\": 12,\n  \"months\": 12,\n  \"csr\": \"-----BEGIN CERTIFICATE REQUEST-----…\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Order certificate","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/certificates/orders","host":["{{baseUrl}}"],"path":["api","domain-portfolio","certificates","orders"],"query":[],"variable":[]},"description":"Orders the prepared certificate (method `DNS` or `EMAIL`, `confirm: true`; the price comes from the preparation step). Contact: either `contact_id` of a stored certificate contact or `contact` with the details (for this order only). **Chargeable:** prepayment from the credit balance, refunded on failure. If the zone is on our name servers, the validation record is set automatically. Result via webhook `certificate.issued` or `certificate.failed`. With the `Idempotency-Key` header (8–128 characters), a retry within 24 hours is neither executed nor charged twice. \n\nScopes (all): domain:write","body":{"mode":"raw","raw":"{\n  \"order_id\": \"uuid\",\n  \"method\": \"DNS\",\n  \"confirm\": true,\n  \"contact\": {\n    \"fname\": \"Max\",\n    \"lname\": \"Muster\",\n    \"email\": \"max@kunde.de\",\n    \"phone\": \"+49301234567\",\n    \"address\": \"Musterstr. 1\",\n    \"pcode\": \"10115\",\n    \"city\": \"Berlin\",\n    \"country\": \"DE\"\n  },\n  \"expect_net_cents\": 1990\n}","options":{"raw":{"language":"json"}}}}},{"name":"Certificate orders","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/certificates/orders","host":["{{baseUrl}}"],"path":["api","domain-portfolio","certificates","orders"],"query":[],"variable":[]},"description":"Lists the orders with status and validation hints.\n\nScopes (all): domain:read","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Order email certificate (S/MIME)","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/certificates/smime","host":["{{baseUrl}}"],"path":["api","domain-portfolio","certificates","smime"],"query":[],"variable":[]},"description":"Orders an email certificate without a CSR. **Chargeable:** prepayment from the credit balance, refunded on failure. The certificate authority confirms the email address by email and then makes the certificate available for download (password `password`, only forwarded to the certificate authority, never stored). Result via webhook `certificate.issued` or `certificate.failed`. With `Idempotency-Key`. Contact: `contact_id` or `contact`.\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"{\n  \"product_id\": 42,\n  \"months\": 12,\n  \"email\": \"max.muster@kunde.de\",\n  \"firstname\": \"Max\",\n  \"lastname\": \"Muster\",\n  \"organization_unit\": \"Vertrieb\",\n  \"password\": \"Geheim Wort 12\",\n  \"contact_id\": \"uuid\",\n  \"confirm\": true,\n  \"expect_net_cents\": 1990\n}","options":{"raw":{"language":"json"}}}}},{"name":"Download certificate","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/certificates/:id/download","host":["{{baseUrl}}"],"path":["api","domain-portfolio","certificates",":id","download"],"query":[],"variable":[{"key":"id","value":"","description":"Certificate ID"}]},"description":"Returns the certificate and chain (never a key).\n\nScopes (all): domain:read","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Purchase price of a domain for sale","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/orders/aftermarket/quote","host":["{{baseUrl}}"],"path":["api","domain-portfolio","orders","aftermarket","quote"],"query":[{"key":"domain","value":"","description":"Domain name","disabled":false}],"variable":[]},"description":"Returns the purchase price (net and gross) of a domain offered on the sales platform, and whether the purchase requires prior approval (`requires_approval`, from the organization's threshold). The purchase price is already included in the search results (`aftermarket: true`, `price_cents`).\n\nScopes (all): domain:read","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Buy a domain on the aftermarket","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/orders/aftermarket","host":["{{baseUrl}}"],"path":["api","domain-portfolio","orders","aftermarket"],"query":[],"variable":[]},"description":"Starts the purchase. **Payment is made in advance by card (Stripe)**: without an approval requirement, the response contains `order.checkout_url`; the domain is only bought after payment is received. From the threshold (global, overridable per organization), our approval is required first (`status: awaiting_approval`, notification on decision); then `POST …/:id/pay`. If the price changes, the domain is not bought. The result is delivered via webhook `domain.order.completed` or `domain.order.failed` (type `buy`). With `Idempotency-Key`.\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"{\n  \"domain\": \"beispiel.de\",\n  \"expect_net_cents\": 6590,\n  \"confirm\": true,\n  \"owner\": {\n    \"handle\": \"uuid\"\n  },\n  \"ns_profile\": \"urbandomains\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Organization's domain purchases","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/orders/aftermarket","host":["{{baseUrl}}"],"path":["api","domain-portfolio","orders","aftermarket"],"query":[{"key":"limit","value":"","description":"1–200","disabled":true},{"key":"offset","value":"","description":"Start offset","disabled":true}],"variable":[]},"description":"Lists the purchases with status `awaiting_approval`, `awaiting_payment`, `paid`, `processing`, `completed`, `failed`, `declined`, `expired`, `cancelled`.\n\nScopes (all): domain:read","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Pay an approved purchase","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/orders/aftermarket/:id/pay","host":["{{baseUrl}}"],"path":["api","domain-portfolio","orders","aftermarket",":id","pay"],"query":[],"variable":[{"key":"id","value":"","description":"Purchase ID"}]},"description":"Creates the payment link (Stripe, card) for an approved purchase. The price is re-checked beforehand; if it has changed, nothing is charged.\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Cancel purchase","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/orders/aftermarket/:id/cancel","host":["{{baseUrl}}"],"path":["api","domain-portfolio","orders","aftermarket",":id","cancel"],"query":[],"variable":[{"key":"id","value":"","description":"Purchase ID"}]},"description":"Cancels a purchase that has not been paid yet.\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Certificate contacts","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/certificate-contacts","host":["{{baseUrl}}"],"path":["api","domain-portfolio","certificate-contacts"],"query":[],"variable":[]},"description":"Lists the stored contacts for certificates.\n\nScopes (all): domain:read","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Create certificate contact","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/certificate-contacts","host":["{{baseUrl}}"],"path":["api","domain-portfolio","certificate-contacts"],"query":[],"variable":[]},"description":"Creates a contact for certificates (at the provider and on our side). Usable as `contact_id` when ordering a certificate.\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"{\n  \"fname\": \"Erika\",\n  \"lname\": \"Muster\",\n  \"organization\": \"Muster GmbH\",\n  \"address\": \"Weg 1\",\n  \"pcode\": \"10115\",\n  \"city\": \"Berlin\",\n  \"country\": \"DE\",\n  \"email\": \"e@example.com\",\n  \"phone\": \"+49 30 123456\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Update certificate contact","request":{"method":"PUT","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/certificate-contacts/:id","host":["{{baseUrl}}"],"path":["api","domain-portfolio","certificate-contacts",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Contact ID"}]},"description":"Updates a stored contact (at the provider and on our side).\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"{\n  \"fname\": \"Erika\",\n  \"lname\": \"Muster\",\n  \"address\": \"Weg 1\",\n  \"pcode\": \"10115\",\n  \"city\": \"Berlin\",\n  \"country\": \"DE\",\n  \"email\": \"e@example.com\",\n  \"phone\": \"+49 30 999999\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Delete certificate contact","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/certificate-contacts/:id","host":["{{baseUrl}}"],"path":["api","domain-portfolio","certificate-contacts",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Contact ID"}]},"description":"Deletes the contact. Certificates already issued remain unaffected.\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"null","options":{"raw":{"language":"json"}}}}},{"name":"Submit request","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/domain-portfolio/requests","host":["{{baseUrl}}"],"path":["api","domain-portfolio","requests"],"query":[],"variable":[]},"description":"For TLDs and certificates with special rules: the request goes to the operator, who will get in touch.\n\nScopes (all): domain:write","body":{"mode":"raw","raw":"{\n  \"kind\": \"domain\",\n  \"subject\": \"kunde.es\",\n  \"message\": \"…\"\n}","options":{"raw":{"language":"json"}}}}}]},{"name":"Search engines (Search Console, Bing, CrUX)","item":[{"name":"Availability and service account address","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/search-console/config","host":["{{baseUrl}}"],"path":["api","search-console","config"],"query":[],"variable":[]},"description":"Shows whether the plan includes the integration (`feature`), whether the Google integration is set up on the server, and which **service account address** the customer must add as a user in their Search Console (the \"Restricted\" permission is sufficient). Bing needs no address (customer's API key); `crux.enabled` shows whether field measurement (Chrome UX Report) is available.\n\nScopes (all): monitor:read"}},{"name":"Connected domains","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/search-console/links","host":["{{baseUrl}}"],"path":["api","search-console","links"],"query":[{"key":"limit","value":"","description":"1–200","disabled":true},{"key":"offset","value":"","description":"Start offset","disabled":true},{"key":"q","value":"","description":"Search in the domain","disabled":true},{"key":"provider","value":"","description":"google | bing","disabled":true},{"key":"status","value":"","description":"ok | pending | no_access | error","disabled":true}],"variable":[]},"description":"Lists the connections (per domain and search engine) with status (`ok`, `pending`, `no_access`, `error`) and the clicks/impressions of the last 28 days together with the comparison value of the preceding 28 days. Paginated with `limit`/`offset`, search `q`, sorting `sort` (domain, provider, status, clicks, impressions, sync) and `dir`.\n\nScopes (all): monitor:read"}},{"name":"Connect domain","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/search-console/links","host":["{{baseUrl}}"],"path":["api","search-console","links"],"query":[],"variable":[]},"description":"Connects a **verified** domain to Google Search Console or Bing Webmaster Tools and checks access immediately. Google: the service account address (see `config`) must be added in the domain's Search Console; a matching property (domain property `sc-domain:` preferred, otherwise URL prefix) is selected automatically. Bing: `api_key` is the Bing Webmaster Tools API key (stored encrypted, never returned). Afterwards the server fetches the data in the background (up to 16 months back) and refreshes it daily.\n\nScopes (all): monitor:write","body":{"mode":"raw","raw":"{\n  \"provider\": \"google\",\n  \"domain\": \"kunde.de\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Connection with metrics","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/search-console/links/:id","host":["{{baseUrl}}"],"path":["api","search-console","links",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Connection UUID"}]},"description":"Master data, alert settings, weekly comparison (`compare`, 7 days against the preceding 7) and 28-day comparison (`compare28`), number of checked pages per index status (`index`: PASS, FAIL, PARTIAL, NEUTRAL), sitemap errors, and for Bing the latest crawl statistics and the cached field measurement (`crux`).\n\nScopes (all): monitor:read"}},{"name":"Alert settings, channels, Bing key","request":{"method":"PATCH","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/search-console/links/:id","host":["{{baseUrl}}"],"path":["api","search-console","links",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Connection UUID"}]},"description":"Thresholds for alerts (click drop in percent compared to the previous week, minimum clicks, index loss) and notification channels (same format as for monitors). For Bing, the API key can be replaced. The server also reports: click drop, pages dropping out of the Google index, sitemap errors, loss of access, malware notice (Bing), and poor Core Web Vitals.\n\nScopes (all): monitor:write","body":{"mode":"raw","raw":"{\n  \"alert_clicks_drop_pct\": 40,\n  \"alert_min_clicks\": 200\n}","options":{"raw":{"language":"json"}}}}},{"name":"Remove connection","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/search-console/links/:id","host":["{{baseUrl}}"],"path":["api","search-console","links",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Connection UUID"}]},"description":"Deletes the connection including all stored search data (and the encrypted Bing key). The customer's Search Console remains unchanged.\n\nScopes (all): monitor:write"}},{"name":"Daily trend","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/search-console/links/:id/daily","host":["{{baseUrl}}"],"path":["api","search-console","links",":id","daily"],"query":[{"key":"days","value":"","description":"30 | 90 | 180 | 365 | 480 (default 90)","disabled":true}],"variable":[{"key":"id","value":"","description":"Connection UUID"}]},"description":"Clicks, impressions, and (Google) average position per day. Retention 16 months.\n\nScopes (all): monitor:read"}},{"name":"Search queries or pages","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/search-console/links/:id/top","host":["{{baseUrl}}"],"path":["api","search-console","links",":id","top"],"query":[{"key":"kind","value":"","description":"query (default) | page","disabled":true},{"key":"limit","value":"","description":"1–200","disabled":true},{"key":"offset","value":"","description":"Start offset","disabled":true},{"key":"q","value":"","description":"Search","disabled":true}],"variable":[{"key":"id","value":"","description":"Connection UUID"}]},"description":"Top list of the last 28 days with the values of the preceding 28 days (`prev_*`; `null` = new). `kind=query` or `kind=page`; paginated, search `q`, sorting `sort` (item, clicks, impressions, position, change).\n\nScopes (all): monitor:read"}},{"name":"Tracked keywords","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/search-console/links/:id/keywords","host":["{{baseUrl}}"],"path":["api","search-console","links",":id","keywords"],"query":[],"variable":[{"key":"id","value":"","description":"Connection UUID"}]},"description":"Tracked keywords of a Google connection with the values of the last 28 days (`position` = average weighted by impressions) and the change compared to the preceding 28 days (`position_change` = before − now, positive = better). Empty for Bing.\n\nScopes (all): monitor:read"}},{"name":"Track keyword","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/search-console/links/:id/keywords","host":["{{baseUrl}}"],"path":["api","search-console","links",":id","keywords"],"query":[],"variable":[{"key":"id","value":"","description":"Connection UUID"}]},"description":"Adds a keyword (Google only, at most 25 per domain; whitespace is collapsed, lowercase). The history is fetched retroactively in the background. Management requires the \"Manage domains\" permission.\n\nScopes (all): monitor:write"}},{"name":"Remove keyword","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/search-console/links/:id/keywords/:keywordId","host":["{{baseUrl}}"],"path":["api","search-console","links",":id","keywords",":keywordId"],"query":[],"variable":[{"key":"id","value":"","description":"Connection UUID"},{"key":"keywordId","value":"","description":"Keyword UUID"}]},"description":"Stops tracking and deletes the keyword's stored history.\n\nScopes (all): monitor:write"}},{"name":"Keyword history","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/search-console/links/:id/keywords/:keywordId/daily","host":["{{baseUrl}}"],"path":["api","search-console","links",":id","keywords",":keywordId","daily"],"query":[{"key":"days","value":"","description":"30 | 90 | 180 | 365 | 480","disabled":true}],"variable":[{"key":"id","value":"","description":"Connection UUID"},{"key":"keywordId","value":"","description":"Keyword UUID"}]},"description":"Daily values (clicks, impressions, average position) of a tracked keyword; `days` = 30, 90 (default), 180, 365, or 480.\n\nScopes (all): monitor:read"}},{"name":"Index status of checked pages (Google)","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/search-console/links/:id/index","host":["{{baseUrl}}"],"path":["api","search-console","links",":id","index"],"query":[{"key":"verdict","value":"","description":"PASS | FAIL | PARTIAL | NEUTRAL","disabled":true},{"key":"limit","value":"","description":"1–200","disabled":true},{"key":"offset","value":"","description":"Start offset","disabled":true}],"variable":[{"key":"id","value":"","description":"Connection UUID"}]},"description":"Result of the URL inspection: Google checks up to 25 pages per day (home page and top-click pages that have gone unchecked the longest). `verdict`: PASS (indexed), FAIL (problem), PARTIAL, NEUTRAL (excluded, e.g. noindex). Filter `verdict`, search `q`.\n\nScopes (all): monitor:read"}},{"name":"Sitemaps","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/search-console/links/:id/sitemaps","host":["{{baseUrl}}"],"path":["api","search-console","links",":id","sitemaps"],"query":[],"variable":[{"key":"id","value":"","description":"Connection UUID"}]},"description":"Submitted sitemaps with errors, warnings, URLs, and number of indexed URLs (Google).\n\nScopes (all): monitor:read"}},{"name":"Crawl statistics (Bing)","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/search-console/links/:id/crawl","host":["{{baseUrl}}"],"path":["api","search-console","links",":id","crawl"],"query":[],"variable":[{"key":"id","value":"","description":"Connection UUID"}]},"description":"Per day: crawled pages, crawl errors, pages blocked by robots.txt, 4xx/5xx, malware notices from Bing, and pages in the index (last 90 days).\n\nScopes (all): monitor:read"}},{"name":"Sync now","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/search-console/links/:id/sync","host":["{{baseUrl}}"],"path":["api","search-console","links",":id","sync"],"query":[],"variable":[{"key":"id","value":"","description":"Connection UUID"}]},"description":"Checks access and fetches the data immediately (otherwise daily in the background). At most 6 syncs per 10 minutes per connection.\n\nScopes (all): monitor:write"}},{"name":"Core Web Vitals of real visitors (CrUX)","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/search-console/crux","host":["{{baseUrl}}"],"path":["api","search-console","crux"],"query":[{"key":"domain","value":"","description":"Verified domain","disabled":false},{"key":"refresh","value":"","description":"1 = force fetch (at most every 20 hours)","disabled":true}],"variable":[]},"description":"Field measurement from the Chrome UX Report for an own, verified domain: LCP, INP, CLS, FCP, and TTFB for mobile and desktop (75th percentile of the last 28 days, rating `good | needs-improvement | poor`, share of visits per rating, weekly trend). No linking by the customer required; `no_data: true` if there are too few Chrome visits. Cache 20 hours.\n\nScopes (all): monitor:read"}}]},{"name":"EMPEDIAcaptcha (domains, rules, statistics)","item":[{"name":"EMPEDIAcaptcha domains","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/captcha/sites","host":["{{baseUrl}}"],"path":["api","captcha","sites"],"query":[],"variable":[]},"description":"Lists the organization's domains (a registrable domain with all its subdomains) with site key, hosts, mode, status and the key figures of the last 30 days. The secret is never returned.\n\nScopes (all): captcha:read"}},{"name":"Create a domain","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/captcha/sites","host":["{{baseUrl}}"],"path":["api","captcha","sites"],"query":[],"variable":[]},"description":"Creates a domain. All hosts must belong to the same registrable domain (`example.com`, `*.example.com`). The secret appears **only in this response**.\n\nScopes (all): captcha:write","body":{"mode":"raw","raw":"{\n  \"name\": \"urbanstudio.de\",\n  \"hosts\": [\n    \"urbanstudio.de\",\n    \"*.urbanstudio.de\"\n  ],\n  \"mode\": \"balanced\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Create many domains at once","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/captcha/sites/bulk","host":["{{baseUrl}}"],"path":["api","captcha","sites","bulk"],"query":[],"variable":[]},"description":"Creates up to 100 domains in one call (e.g. for agencies). Each entry is validated individually; the response (207) reports success or error per entry. Secrets appear only here.\n\nScopes (all): captcha:write","body":{"mode":"raw","raw":"{\n  \"sites\": [\n    {\n      \"name\": \"kunde-a.de\",\n      \"hosts\": [\n        \"kunde-a.de\",\n        \"*.kunde-a.de\"\n      ]\n    },\n    {\n      \"name\": \"kunde-b.de\",\n      \"hosts\": [\n        \"kunde-b.de\"\n      ]\n    }\n  ]\n}","options":{"raw":{"language":"json"}}}}},{"name":"Domain details","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/captcha/sites/:id","host":["{{baseUrl}}"],"path":["api","captcha","sites",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Settings of a domain including page protection and observe mode.\n\nScopes (all): captcha:read"}},{"name":"Update a domain","request":{"method":"PATCH","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/captcha/sites/:id","host":["{{baseUrl}}"],"path":["api","captcha","sites",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Changes name, hosts, mode, token lifetime, pausing, **observe mode** (`observe`: assess and count but never block) and page protection (`gate`). Every change appears in the activity log.\n\nScopes (all): captcha:write","body":{"mode":"raw","raw":"{\n  \"observe\": true\n}","options":{"raw":{"language":"json"}}}}},{"name":"Delete a domain","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/captcha/sites/:id","host":["{{baseUrl}}"],"path":["api","captcha","sites",":id"],"query":[],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Deletes the domain including keys, rules and statistics.\n\nScopes (all): captcha:write"}},{"name":"Renew secret","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/captcha/sites/:id/rotate-secret","host":["{{baseUrl}}"],"path":["api","captcha","sites",":id","rotate-secret"],"query":[],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Creates a new secret; the old one stays valid for one more hour.\n\nScopes (all): captcha:write"}},{"name":"Domain statistics","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/captcha/sites/:id/stats","host":["{{baseUrl}}"],"path":["api","captcha","sites",":id","stats"],"query":[{"key":"days","value":"","description":"1–90, default 30","disabled":true}],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Counters per day and metric (challenge, solved, verify_ok, rejected, verify_fail, form_allow/review/block, gate_view/pass, observed_block, form_observed).\n\nScopes (all): captcha:read"}},{"name":"Statistics as CSV","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/captcha/sites/:id/export.csv","host":["{{baseUrl}}"],"path":["api","captcha","sites",":id","export.csv"],"query":[{"key":"days","value":"","description":"1–400, default 90","disabled":true}],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Daily values as CSV (semicolon separated, UTF-8 with BOM).\n\nScopes (all): captcha:read"}},{"name":"Activity log","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/captcha/sites/:id/activity","host":["{{baseUrl}}"],"path":["api","captcha","sites",":id","activity"],"query":[{"key":"limit","value":"","description":"1–100","disabled":true},{"key":"offset","value":"","description":"Start offset","disabled":true}],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Who changed what and when (create, settings, secret, rules). Without IP addresses and without values.\n\nScopes (all): captcha:read"}},{"name":"Own rules","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/captcha/sites/:id/rules","host":["{{baseUrl}}"],"path":["api","captcha","sites",":id","rules"],"query":[],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Blocks and allows of the content check (IP, network, email, domain, username, text fragment) and learned entries.\n\nScopes (all): captcha:read"}},{"name":"Add a rule","request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"},{"key":"Content-Type","value":"application/json"}],"url":{"raw":"{{baseUrl}}/api/captcha/sites/:id/rules","host":["{{baseUrl}}"],"path":["api","captcha","sites",":id","rules"],"query":[],"variable":[{"key":"id","value":"","description":"Domain ID"}]},"description":"Creates a block or allow. Allows take precedence.\n\nScopes (all): captcha:write","body":{"mode":"raw","raw":"{\n  \"kind\": \"ip\",\n  \"action\": \"block\",\n  \"value\": \"203.0.113.9\",\n  \"note\": \"Spam-Welle\"\n}","options":{"raw":{"language":"json"}}}}},{"name":"Delete a rule","request":{"method":"DELETE","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/captcha/sites/:id/rules/:rid","host":["{{baseUrl}}"],"path":["api","captcha","sites",":id","rules",":rid"],"query":[],"variable":[{"key":"id","value":"","description":"Domain ID"},{"key":"rid","value":"","description":"Rule ID"}]},"description":"Removes an own rule.\n\nScopes (all): captcha:write"}},{"name":"Plan and usage","request":{"method":"GET","header":[{"key":"Authorization","value":"Bearer {{accessToken}}"}],"url":{"raw":"{{baseUrl}}/api/captcha/plan","host":["{{baseUrl}}"],"path":["api","captcha","plan"],"query":[],"variable":[]},"description":"Domain limit, included and used checks of the month and the resulting overage.\n\nScopes (all): captcha:read"}}]}]}