VULNIX0 / CASE FILEDOCUMENTATION

REST API · OPENAPI 3.0

Vulnix0 API Reference

Start scans, read results, and manage organizations, projects, and scheduled automations - everything the web app does, callable directly. The full interactive reference below is generated straight from Vulnix0's OpenAPI spec.

Quick Start Full Reference Download OpenAPI JSON

Base URLhttps://your-deployment/api/v1

FormatJSON (YAML accepted on scan start)

AuthAPI key or session cookie

What this is

Every action available in the Vulnix0 web app - starting a scan, configuring Advance Scanning modules, reading findings, managing projects and organizations, scheduling Automation workflows - is also a plain REST endpoint. This page documents all of them. If you're integrating Vulnix0 into a CI/CD pipeline, a ticketing system, or your own tooling, this is the reference to work from; if you want an AI agent to drive scans conversationally instead, see the MCP Server page.

Quick start

Create an API key

From Settings → API Keys, generate a key for your account. Keys are scoped to your current organization at the time of each request.

Authenticate requests

Send the key in the api-key header on every request.

Start a scan

POST /api/v1/scan/{target} with a target domain, IP, or URL. Add an Advance Scanning config in the request body to select specific modules.

Poll for results

GET /api/v1/scans/{reqid} until status is completed or failed, then read data.results and data.findings.

Authentication

Two methods are accepted, depending on whether a request comes from a script/service or from a logged-in browser session:

api-key: YOUR_VULNIX0_API_KEY

The web app itself authenticates with a session cookie (jwt) set on login - you won't need this for API integrations, but it's why the same endpoints work for both the UI and direct API calls.

Starting a scan with Advance Scanning

The request body on POST /api/v1/scan/{target} is entirely optional - send nothing (or {}) for a Quick Scan with every standard module and no invasive testing. Everything below is opt-in configuration layered on top of that default. The full schema, every field's type/default, and these same examples are also in the interactive reference.

Field	Type	Controls
`modules`	string[]	Which of `port_scan`, `dns`, `whois`, `geo`, `subdomains`, `fingerprint`, `tls` to run. Omit/empty = all of them.
`custom_ports`	int[]	Overrides the org's default port list for Port Scanning.
`web`	bool	Web Scanning (crawl, security headers, directory/vhost enum) - its own flag, not part of `modules`.
`follow_links`	bool	Within Web Scanning, crawl beyond the homepage.
`fuzzing`	bool	Invasive active testing (injection, default creds, login lockout, account enumeration). Requires `web: true`.
`exclude_paths`	string[]	Paths Web Scanning must never request.
`cookies` / `Authorization` / `proxy_usage`	string	Sent with every Web Scanning / API request - for authenticated crawling.
`custom_headers`	[{name,value}]	Extra headers sent with every Web Scanning / API request.
`openapi_spec` / `api_base_path`	string	Drives the API Security scan against a supplied OpenAPI 2.x/3.x spec.
`testssl_enabled` + `testssl_checks`/`_timeout_seconds`/`_severity`	bool + ...	Deep TLS Scan (testssl.sh) - slower, opt-in.
`stress_test_enabled` + `_concurrency`/`_requests`/`_duration_seconds`	bool + int	Paced sustained load test. Opt-in, invasive - authorized targets only.
`dos_resilience_enabled` + `_concurrency`/`_duration_seconds`	bool + int	Bounded connection-burst check (concurrency capped at 150, duration at 20s server-side). Not a real DoS. Opt-in, invasive - authorized targets only.
`project_id` / `scan_policy_id`	string	Assign the scan to a project / baseline thread-count & port-list policy. Both optional.

Example: every option set (reference)

POST /api/v1/scan/example.com
Content-Type: application/json

{
  "project_id": "",
  "modules": ["port_scan", "dns", "whois", "geo", "subdomains", "fingerprint", "tls"],
  "custom_ports": [21, 22, 80, 443, 3306, 8080, 8443],
  "web": true,
  "follow_links": true,
  "fuzzing": false,
  "exclude_paths": ["/admin", "/logout"],
  "cookies": "",
  "proxy_usage": "",
  "Authorization": "",
  "api_base_path": "/api/v1",
  "openapi_spec": "",
  "testssl_enabled": false,
  "testssl_checks": ["protocols", "cipher_strength", "server_defaults", "server_preference"],
  "testssl_timeout_seconds": 90,
  "testssl_severity": "LOW",
  "custom_headers": [{ "name": "x-api-key", "value": "your-test-api-key" }],
  "stress_test_enabled": false,
  "stress_test_concurrency": 50,
  "stress_test_requests": 500,
  "stress_test_duration_seconds": 30,
  "dos_resilience_enabled": false,
  "dos_resilience_concurrency": 30,
  "dos_resilience_duration_seconds": 10
}

Recon only - no crawl, no port scan

{
  "modules": ["dns", "whois", "geo", "subdomains"],
  "web": false
}

Full authenticated web pentest

{
  "web": true,
  "follow_links": true,
  "fuzzing": true,
  "Authorization": "Bearer eyJhbGciOi..."
}

Stress Test only

{
  "modules": [],
  "web": false,
  "stress_test_enabled": true,
  "stress_test_concurrency": 80,
  "stress_test_requests": 1000,
  "stress_test_duration_seconds": 45
}

DoS Resilience only (bounded, safe)

{
  "modules": [],
  "web": false,
  "dos_resilience_enabled": true,
  "dos_resilience_concurrency": 30,
  "dos_resilience_duration_seconds": 10
}

Response (202 Accepted):

{
  "reqid": "d3a8f6c0-4f87-4e5f-b87c-4e3c899b9f21",
  "message": "Scan initiated for target: example.com ..."
}

Core endpoints

Scans

POST   /scan/{target}
GET    /scans
GET    /scans/{reqid}
DELETE /scans/{reqid}
GET    /scans/{reqid}/subdomain-prioritization.csv

Organizations & Projects

GET    /organizations
POST   /organizations
GET    /organizations/{id}
PUT    /organizations/{id}
GET    /projects
POST   /projects
GET    /projects/{project_id}/report

Automation (scheduled scans)

GET    /automations
POST   /automations
PUT    /automations/{id}
DELETE /automations/{id}

User & API Keys

GET    /user/me
POST   /user/me
GET    /user/apikeys
POST   /user/apikeys
DELETE /user/apikeys/{index_key}

This is a quick orientation, not the full list - every endpoint, request/response schema, and error shape is documented in the full interactive reference below.

Full interactive reference

Every endpoint, request/response schema, and error shape, generated live from Vulnix0's OpenAPI 3.0 specification - browsable, searchable, with real request/response examples for each operation. It gets its own full-page view rather than being squeezed in here, since that's genuinely how it's meant to be used.

Open the Interactive API Reference →

Or grab the raw OpenAPI JSON directly.

The first project out of Velocity Lab — OneFirewall Alliance's R&D team — built with AquilaX Security. AI-driven offensive security, from discovery to continuous exploit validation.