REST API Documentation & Integration
Integrate comprehensive security assessments directly into your CI/CD pipelines, DevOps workflows, and security monitoring systems.
Authentication & Security
Requests to protected endpoints require an API token sent in the standard HTTP Authorization header. You can generate and rotate your keys inside the Dashboard settings.
Quickstart Request
curl -X POST "https://webdefect.com/api/audit/start" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer wfp_live_your_api_key" \
-d '{
"domain": "example.com",
"scanMode": "standard"
}'Core API Endpoints
Initiate Security Assessment
Starts a comprehensive security assessment of the requested target domain. Returns an audit ID for polling progress.
{
"domain": "example.com",
"scanMode": "standard" // "standard" | "deep"
}{
"id": "aud_7f9b2c3a-9e20-4281-a83d-3b7c89d2a014",
"domain": "example.com",
"status": "queued",
"startedAt": 1725619200000
}Poll Assessment Status
Retrieves real-time progress status and completion percentage for the ongoing security assessment.
{
"id": "aud_7f9b2c3a-9e20-4281-a83d-3b7c89d2a014",
"status": "in_progress", // "queued" | "in_progress" | "completed" | "failed"
"currentPhase": "TLS & Certificate Analysis",
"percentComplete": 42,
"summary": {
"findingsCount": 3
}
}Retrieve Security Assessment Report
Fetches the complete assessment results including overall security score (0-100), letter grade (A+ through F), category breakdown, and detailed security findings with evidence.
{
"id": "aud_7f9b2c3a-9e20-4281-a83d-3b7c89d2a014",
"domain": "example.com",
"status": "completed",
"score": {
"total": 92,
"grade": "A",
"categories": {
"transport_security": 95,
"http_security": 88,
"infrastructure": 100,
"network": 90
}
},
"findings": [
{
"id": "WD-F-001",
"category": "http_security",
"severity": "medium",
"title": "Content-Security-Policy Lacks frame-ancestors Directive",
"description": "The page can potentially be embedded in unauthorized iframes, enabling UI redressing attacks.",
"affectedUrl": "https://example.com/",
"evidence": "X-Frame-Options: SAMEORIGIN present, but CSP frame-ancestors missing."
}
]
}Download Executive Security Report
Generates and streams a comprehensive executive security report in PDF format with detailed findings and remediation guidance.
[Binary PDF Stream (application/pdf)]
Compare Security Assessments
Fetches side-by-side security posture comparison, score differentials, and category breakdowns for two domains.
{
"targetA": {
"domain": "stripe.com",
"score": 96,
"grade": "A+",
"categories": {
"transport_security": { "score": 100, "status": "pass" },
"infrastructure": { "score": 95, "status": "pass" }
}
},
"targetB": {
"domain": "adyen.com",
"score": 92,
"grade": "A",
"categories": {
"transport_security": { "score": 95, "status": "pass" },
"infrastructure": { "score": 90, "status": "pass" }
}
},
"delta": 4,
"lead": "stripe.com"
}Retrieve Quota & Scan Allowance
Returns your current audit quota, completed scans, remaining allowances, and subscription tier status.
{
"used": 1,
"limit": 3,
"remaining": 2,
"isAuthenticated": true,
"subscriptionStatus": "free" // "free" | "premium"
}Continuous Integration & PR Gating
Integrate WebDefect with GitHub Actions or GitLab CI to monitor security posture changes in your deployment pipeline.
# .github/workflows/security-assessment.yml
name: Security Assessment
on: [deployment_status]
jobs:
webdefect_scan:
runs-on: ubuntu-latest
steps:
- name: Trigger WebDefect Assessment
run: |
AUDIT_ID=$(curl -s -X POST "https://webdefect.com/api/audit/start" \
-H "Authorization: Bearer ${{ secrets.WFP_API_KEY }}" \
-H "Content-Type: application/json" \
-d '{"domain":"staging.yourcompany.com"}' | jq -r '.id')
echo "Assessment triggered: $AUDIT_ID"Ready to integrate WebDefect into your workflow?
WebDefect API is available for Pro, Business, and Enterprise plans. Generate your API key from the dashboard to get started with programmatic security assessments.