API keys & outbound webhooks
Use the read-only REST API directly, or get a signed POST the moment a scan finishes.
API keys
Open API (Developers) from the sidebar to create and revoke API keys. Send your key as a Bearer token: Authorization: Bearer zk_…
The public REST API is read-only for your scans and is rate limited to 120 requests per minute per key.
- GET /api/v1/scans: list your completed scans.
- GET /api/v1/scans/{id}: one scan with its grid results.
Outbound webhooks
Add an https URL on the same page to get a POST the moment something happens: paste a Zapier “Catch Hook”, Make, n8n, or any endpoint.
- Events: scan.completed, scan.failed, reputation.feedback.created.
- Every call is signed with an X-Zuhya-Signature header so you can verify it came from Zuhya.
- The signing secret is shown once when you add the webhook. Copy it then.