Current queue state for this API key's tenant: whether the queue is active (paused/resumed), queued/running target counts, and the tenant's active/reserved Celery tasks.

How many scanner modules are currently being rate-limited by an external target's API (circuit-breaker tripped), if any -- surfaced as part of the same queue-status data queue_status() returns, exposed here as its own discoverable tool for the common "is anything rate-limited right now" question. Only a count is available via the API, not the specific module names.

Pause the scan queue -- stops workers from picking up new tasks. NOTE: this is fleet-wide, not scoped to this key's tenant (matches YADS's existing dashboard pause behavior).

Resume the scan queue after a pause. NOTE: like queue_pause, this is fleet-wide, not scoped to this key's tenant.

Cancel a single queued/reserved/active scan task by its Celery task id (see queue_status's active_tasks/reserved_tasks for ids). Only cancels tasks belonging to this key's tenant.

Clear every queued/running scan for this key's tenant -- irreversible beyond a 60-second undo window (see queue_undo_purge). Requires the 'destructive' scope on this API key. Set confirm=True to actually perform this.

Re-queue the tasks purged by a prior queue_purge call, using the undo_batch id from that call's response. Only works within 60 seconds of the purge, and only for tasks that hadn't started running yet.

All unique tags currently in use across this key's tenant's targets.

Add a tag to one target. Returns the target's full tag list after the change.

Remove a tag from one target. Returns the target's full tag list after the change.

Add, remove, or replace tags on multiple targets at once. action: "add" (default), "remove", or "replace" (replaces each target's entire tag list with tags).

Add a single tag to multiple targets by id (simpler variant of tags_bulk_assign for the common "add one tag to many targets" case).

Remove a tag from every target in this key's tenant that has it -- irreversible, no undo. Requires the 'destructive' scope on this API key. Set confirm=True to actually perform this.

Trigger a scan for a URL, finding-or-creating the Target by domain. profile: "quick" (web_analyzer only), "standard" (dns_scanner, web_analyzer, ssl_scanner -- default), or "full" (all 7 modules: dns_cleanup, subdomain_scanner, dns_scanner, web_analyzer, ssl_scanner, crawler, cve_scanner).

Trigger a scan for an already-known target by its numeric id, with an explicit module list (e.g. ["catchall_detector"] for a parked-domain-only check). scan_types accepts module names from the scanner registry, plus "full_scan" (expands to every module except subdomain_scanner and catchall_detector) and "dns_cleanup".

Count how many targets match a set of bulk-scan criteria, without queuing anything -- use before scan_bulk_by_criteria to see the blast radius first. scanned_before is an ISO date string ("2026-08-01"); matches targets last scanned before that date OR never scanned.

Queue a scan for every target matching the given criteria (combined with AND). No target-tag filter exists yet -- to scan only targets without a given tag, list tags_list, resolve target ids yourself, and use scan_bulk_selected instead.

Queue a scan for an explicit list of target ids.

All scan findings for this key's tenant, newest first.

List targets for this key's tenant, with optional filters (combined with AND). limit is capped at 100 server-side. scan_status accepts "idle"/"queued"/"running"/"failed". last_scanned_before is an ISO date string; matches targets scanned before that date OR never scanned.

Lean summary of one target: domain, scan status/progress, tags, archive state, when it was created, when it was last scanned, and how many distinct scanner modules have results for it. For per-module scan data, use scan_get_findings() (Wave 1) -- note it returns every finding for the whole tenant, not just this target, so filter its result by target_id client-side. For this target's recent change history, use get_target_changes() instead.

Add a target by domain, or return the existing one if it's already present (find-or-create). Blocked for internal/private-network domains by SSRF protection. Does not trigger a scan -- follow up with scan_trigger_by_target_id() if you want one.

Permanently delete targets and all their scan history/findings -- irreversible beyond a 60-second undo window (see undo_bulk_delete_targets; the domain/tags are restorable, scan history is not). Requires the 'destructive' scope on this API key. Set confirm=True to actually perform this.

Re-create targets deleted by a prior bulk_delete_targets call, using the undo_batch id from that call's response. Only works within 60 seconds of the delete -- restores domain/tags only, not scan history.

Archive targets -- stops them from being scanned, but fully reversible via restore_target(). Not destructive.

Archive every target in this key's tenant whose most recent DNS scan returned empty records (i.e. the domain no longer resolves). Tenant-wide sweep, no target_ids needed. Reversible via restore_target().

Un-archive a target, clearing its archived state so it's scanned again.

Add each target's domain to this tenant's Discovery blocklist (exact match -- future Discovery runs won't re-add it) AND archive the target. Requires the 'destructive' scope: unlike plain archiving, reversing this needs both restore_target() and manually removing the blocklist entry (no blocklist-management tool exists yet), so there's no clean single-action undo. Set confirm=True to actually perform this.

Recent detected changes for a target (new/changed/removed findings across scans), newest first. limit capped at 100 server-side.

Current scan status/progress message for a target -- live if a scan is running, otherwise the last known state ("idle", "queued", etc.).

Network context captured during a target's scans -- the external IP YADS scanned from and the IPs the target resolved to at scan time.