Quickstart
Create an API key, start a passive scan and read the result.
The Barrion API starts passive scans and AI pentests, reads their results and shows what each run cost. It works like the dashboard: the same credits, the same verified targets and the same roles. A run started through the API shows up in the dashboard like any other.
Every request is JSON over HTTPS to https://api.barrion.io/v1, with an API key in the Authorization header.
Create a key
In the dashboard, open Settings, then API keys, and create a key. Give it only the permissions it needs, and a credit budget per billing cycle. The full key is shown once, so copy it into your secret store straight away.
| Permission | Allows |
|---|---|
credits:read | Reading your balance and credit history |
scans:read | Reading passive scans and their findings |
scans:write | Starting passive scans |
pentests:read | Reading pentests, what they cost, and their findings |
pentests:write | Starting and cancelling pentests |
A key acts as the person who created it and can never do more than they can. A key stops working when it expires, is revoked, or its creator loses access.
Make your first request
Start a passive scan. Scans are free and take a few minutes. Every start needs an Idempotency-Key, so a retried request never starts a second run.
curl -X POST https://api.barrion.io/v1/scans -H "Authorization: Bearer $BARRION_API_KEY" -H "Content-Type: application/json" -H "Idempotency-Key: my-first-scan" -d '{"url": "https://example.com"}'{ "id": "5b1c...", "domain": "example.com", "status": "STARTED" }The examples are for bash, including Git Bash on Windows and the shells in GitHub Actions and GitLab CI. In Windows PowerShell, use curl.exe and write each command on one line.
Wait for the result
Poll GET /v1/scans/{id} until status is COMPLETED, then read the failing checks with GET /v1/scans/{id}/findings. Pentests take hours, so keep the id and check back later. See Pentests.