Submit a URL to urlscan.io for scanning. Returns immediately with a UUID.

The scan takes roughly 10-30 seconds to complete. Use scan_and_wait instead if you want the finished result in one call.

Requires an API key. visibility must be one of: public, unlisted, private. country is a 2-letter ISO code selecting the scanner's exit location.

Submit a URL and wait for the finished, summarised result.

This is the tool to reach for in most workflows — it handles the submit, poll and summarise cycle in one call. Requires an API key.

Fetch the result of a completed scan by UUID. Requires an API key.

Returns a summary by default. Set full=True for the complete document — be aware that it is frequently several megabytes and will dominate the context window.

Fetch the captured DOM snapshot for a scan. Requires an API key.

Useful for inspecting injected scripts, hidden form fields, or obfuscated payloads. Truncated to max_chars — full DOMs regularly exceed 1 MB.

Get the screenshot URL for a scan.

Returns a link rather than image bytes — screenshots are large and usually meant for a human to open.

Search historical urlscan.io scans with an ElasticSearch query string.

Useful fields: page.domain, page.ip, page.asn, page.server, page.status, domain, ip, asn, country, hash, filename, task.tags, verdicts.score, verdicts.malicious, date.

Examples: page.domain:example.com AND page.status:200 task.tags:phishing AND date:>now-30d verdicts.score:>50 AND page.asn:AS15169

Works without an API key, at lower rate limits.

Find recent scans of a domain. Matches the domain and its subdomains.

Find recent scans of pages served from an IP address.

Good for spotting what else is hosted alongside something suspicious.

Find recent scans hosted within an autonomous system, e.g. 'AS15169'.

Find scans that loaded a resource with this SHA-256 response hash.

Pivots from one known-bad file to every other page serving it — often the fastest way to map a campaign.

Show remaining urlscan.io API quota for the configured key.

Worth checking before a batch of scans. Requires an API key.

List country codes available as scanner exit locations.

Geo-targeted phishing frequently only serves the payload to one region, so re-scanning from the right country is often what makes it visible.

Report which operations are available with the current configuration.

Submission and quota lookup need an API key; search and result retrieval do not. Call this first if something is unexpectedly refused.

Build a reputation picture for a domain, IP, URL or SHA-256 hash.

Aggregates every recent urlscan.io scan of the indicator into one assessment: how often it has been scanned, how many scans were flagged malicious, the highest and mean verdict scores, which tags and brands recur, and the hosting spread.

This is analysis on top of the raw API rather than a passthrough — it answers "should I care about this?" instead of returning a scan document. Read the caveats field before acting on the result.