Business plan

Security scanning API: customer API and completion webhooks

The Business customer API connects supported ScanTitan asset and scan workflows to your own systems, and signed completion webhooks tell those systems when a scan has finished. It automates ScanTitan itself. It is not the same as scanning a Web API asset, which is covered on the API vulnerability scanner page.

  • Business plan only
  • Token-based access
  • Signed completion webhooks

Business costs $155 per asset place per year, billed annually. Choose the Website asset type to start.

Choose BusinessHow it works

What you can automate

  • Create an API token in the portal to authorize your systems.
  • Work with supported assets and scans through the customer API.
  • Retrieve results and coverage for a finished scan.
  • Receive a webhook when a scan completes, so you do not need to poll.

The current API base is https://portal.scantitan.com/api/v2/business. The portal documentation lists the supported operations, and you should rely on it for exact routes and request formats.

ScanTitan Business customer API overview in the portal documentation
The Business customer API overview in the ScanTitan portal. It uses placeholder key text only.

How the security scanning API and webhooks work

  1. Create a token. Keep it secret and store it like a password.
  2. Call the supported operations to read assets and start or read scans, following the portal documentation.
  3. Retrieve findings and coverage once a scan is complete.
  4. Register a webhook endpoint that receives a completion notification.
  5. Verify the signature on every delivery before your system acts on it.

Never paste real tokens or webhook secrets into tickets, chat or public code.

Two different APIs

Customer API (this page)

Automates ScanTitan from your tools: assets, scans, results and completion webhooks. Business plan.

API vulnerability scanner

Scans a Web API as an asset: it imports OpenAPI, Postman, GraphQL queries or SOAP and tests it. See the API vulnerability scanner.

Scope and limits

The customer API is a Business feature. It is not included in Consultant.
  • Native Slack and Jira connectors are not released integrations. A workflow that posts scan results to Slack, Jira or another tool is a custom integration you build on the webhook.
  • Signed completion webhooks tell you a scan finished. They are not a real-time guarantee of every finding.
  • Check the portal documentation for the exact routes before you build.

Plans

The customer API is available with Business. Compare plans, scan websites from the website vulnerability scanner, or read how Consultant handles client reporting instead.

Security scanning API questions

What is the ScanTitan customer API?

It is the Business API for automating ScanTitan workflows: supported assets and scans, results and coverage.

Which plan includes the API and webhooks?

Business only. Consultant does not include customer API tokens.

Is this the same as the API vulnerability scanner?

No. The API vulnerability scanner assesses a Web API asset. The customer API automates ScanTitan itself.

Do you offer Slack or Jira integrations?

No native connectors are released. You can build a custom workflow that uses completion webhooks.

How do I verify a webhook?

Check the signature on each delivery using the method in the portal documentation before acting on it.

Where is the API documentation?

In the ScanTitan portal. The base is https://portal.scantitan.com/api/v2/business.

Can I get results without polling?

Yes. A signed completion webhook tells your system when a scan has finished.

Automate ScanTitan with the Business API

Choose Business with the Website asset type, create a token and connect your first workflow.

Choose BusinessCompare plans