API documentation

Checkvanta has an open REST API. Start scans, fetch results, read history — free forever for the core features.

Authentication

The public endpoints (start scan, result, history, badge) work without a key and are rate-limited. For higher limits, create an API key in your account and send it as a Bearer token.

Authorization: Bearer <API-KEY>

Endpoints

POST/api/v1/scans

Starts a scan and returns a jobId. Optional: modules[], dkimSelector.

curl -X POST https://checkvanta.com/api/v1/scans \
  -H "Content-Type: application/json" \
  -d '{"hostname":"example.com"}'
# → { "jobId": "…" }

GET/api/v1/scans/:id

Current status + results of a scan.

curl https://checkvanta.com/api/v1/scans/<jobId>

GET/api/v1/scans/:id/stream

Server-Sent Events: live per-module progress.

curl -N https://checkvanta.com/api/v1/scans/<jobId>/stream

GET/api/v1/reports/:id?format=json|csv|pdf&lang=de|en

Full report as JSON, CSV or PDF.

curl "https://checkvanta.com/api/v1/reports/<jobId>?format=json"

GET/api/v1/history?host=example.com

A domain's score history across all scans.

curl "https://checkvanta.com/api/v1/history?host=example.com"

GET/api/v1/badge/:domain.svg

Live score badge (SVG) for embedding.

<img src="https://checkvanta.com/api/v1/badge/example.com.svg" alt="Checkvanta score">

Rate limits

Anonymous requests are limited per IP, API keys per organisation. Responses carry X-RateLimit-* headers.

Machine-readable specification

The full OpenAPI specification: /api/v1/openapi.json