Monitoring REST API

Create a Pro API key in your dashboard. Send it in the x-simplyscan-key header. Keys are shown once, stored hashed, and can be revoked. An active Pro entitlement is required. Results and monitors are scoped to the key’s account.

Base URL: https://wpyoohiwuephrhgeoctb.supabase.co/functions/v1/monitoring-api

• POST /scans with {"url":"https://your-app.example"} starts a scan and waits for its result. Keep the client timeout above 150 seconds. The response includes scan_id.
• GET /scans/:id returns status, findings and score for your scan.
• GET /monitors lists up to 100 of your monitored apps and scheduling state. Pro Monitoring runs scheduled rescans through your existing alert integrations.

curl "$BASE/monitors" -H "x-simplyscan-key: $SIMPLYSCAN_API_KEY"
curl "$BASE/scans" -H "x-simplyscan-key: $SIMPLYSCAN_API_KEY" \
  -H 'Content-Type: application/json' -d '{"url":"https://your-app.example"}'

Limits: 120 API requests per key per hour, 240 per IP per hour, and the shared Pro scan allowance of 20 per UTC day. A 401 means a missing, revoked or unentitled key; 404 means an unknown or unowned record; 429 means the allowance is exhausted. Scan findings are deterministic.

Scan editor files over MCP

Local-code scanning is available now at POST /functions/v1/scan-files with your x-simplyscan-key header. In MCP clients it is the scan_local_code tool. Provide selected file contents as files: [{path, content}]. Up to 50 files, 200 KB each and 1 MB total. The same deterministic repository rules inspect source and configuration. Contents leave your editor and are processed in server memory; only masked findings are saved. This route does not send source to an AI provider. The code rules analyse JavaScript and TypeScript; other files are checked for secrets only, and a scan in which no file could be analysed has no score.

CLI, Git hook and GitHub Action

Download and set up secret scanning before commits and in CI. Uses your existing API key and scan allowance. Selected source is uploaded; masked findings are retained. No npm installation required.

Owner-only database reachability

After verifying your HTTPS origin in the dashboard, POST to /functions/v1/owner-db-ports using your signed-in session with {origin, consent:"database-ports-v1"}. Only ports 1433, 1521, 3306, 5432, 6379 and 27017 are checked. The endpoint rechecks ownership, pins a public resolved IP, opens and closes TCP connections, and sends no database commands. Open means TCP reachable, not a proven unauthenticated database. Private and mixed private/public DNS targets are rejected.