REST API Reference

curl -H "X-Shieldome-Key: sk_live_xxxxxxxxxxxx" \
     https://app.shieldome.com/api/scans

#!/usr/bin/env bash
set -euo pipefail

API_KEY="sk_live_xxxxxxxxxxxxxxxx"      # ← your key from Account → API Keys
TARGET="https://example.com"            # ← the site to scan
BASE="https://app.shieldome.com"

# 1. Start the scan
SCAN_ID=$(curl -sf -X POST "$BASE/api/v1/scan" \
  -H "X-Shieldome-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"target\":\"$TARGET\",\"scan_type\":\"vuln\"}" | jq -r .scan_id)
echo "scan: $SCAN_ID"

# 2. Poll until completed or failed
while true; do
  STATUS=$(curl -sf "$BASE/api/v1/scan/$SCAN_ID" -H "X-Shieldome-Key: $API_KEY" | jq -r .status)
  echo "status: $STATUS"
  [ "$STATUS" = "completed" ] && break
  [ "$STATUS" = "failed" ] && { echo "scan failed"; exit 1; }
  sleep 10
done

# 3. Download the PDF report (includes the AI narratives)
curl -sf "$BASE/api/scan/$SCAN_ID/report" -H "X-Shieldome-Key: $API_KEY" -o report.pdf
echo "saved report.pdf"

# 4. CI gate: exit 1 if any High+ finding exists
PASSED=$(curl -sf "$BASE/api/v1/scan/$SCAN_ID/gate?fail_on=high" -H "X-Shieldome-Key: $API_KEY" | jq -r .passed)
[ "$PASSED" = "true" ] || { echo "gate failed"; exit 1; }
echo "gate passed"

import time, requests

API_KEY = "sk_live_xxxxxxxxxxxxxxxx"     # ← your key
TARGET  = "https://example.com"          # ← the site to scan
BASE    = "https://app.shieldome.com"
H = {"X-Shieldome-Key": API_KEY}

# 1. Start the scan
scan_id = requests.post(f"{BASE}/api/v1/scan", headers=H,
                        json={"target": TARGET, "scan_type": "vuln"}).json()["scan_id"]

# 2. Poll until done
while True:
    status = requests.get(f"{BASE}/api/v1/scan/{scan_id}", headers=H).json()["status"]
    if status == "completed":
        break
    if status == "failed":
        raise SystemExit("scan failed")
    time.sleep(10)

# 3. Download the PDF report (includes AI narratives)
pdf = requests.get(f"{BASE}/api/scan/{scan_id}/report", headers=H)
open("report.pdf", "wb").write(pdf.content)

# 4. Read the results JSON (findings nested at results.vulnerabilities)
data = requests.get(f"{BASE}/api/v1/scan/{scan_id}", headers=H).json()
print(len(data.get("vulnerabilities", [])), "findings")

#!/usr/bin/env bash
set -euo pipefail

API_KEY="sk_live_xxxxxxxxxxxxxxxx"      # ← your key
BASE="https://app.shieldome.com"

# 1. Start a batch of up to 50 URLs
JOB=$(curl -sf -X POST "$BASE/api/scan/bulk" \
  -H "X-Shieldome-Key: $API_KEY" -H "Content-Type: application/json" \
  -d '{"urls":["https://a.example.com","https://b.example.com","https://c.example.com"]}' | jq -r .job_id)
echo "batch job: $JOB"

# 2. Poll the batch until it is done
while true; do
  S=$(curl -sf "$BASE/api/scan/bulk/$JOB" -H "X-Shieldome-Key: $API_KEY")
  echo "$S" | jq -r '"\(.status) \(.completed)/\(.total)"'
  [ "$(echo "$S" | jq -r .status)" = "done" ] && break
  sleep 15
done

# 3. Download every scan's PDF
for SID in $(curl -sf "$BASE/api/scan/bulk/$JOB" -H "X-Shieldome-Key: $API_KEY" | jq -r '.scan_ids[]'); do
  curl -sf "$BASE/api/scan/$SID/report" -H "X-Shieldome-Key: $API_KEY" -o "report-$SID.pdf"
done

#!/usr/bin/env bash
set -euo pipefail

API_KEY="sk_live_xxxxxxxxxxxxxxxx"      # ← your key
BASE="https://app.shieldome.com"

# Create a weekly scan (168h) with webhook + email notification
curl -sf -X POST "$BASE/api/scheduled-scans" \
  -H "X-Shieldome-Key: $API_KEY" -H "Content-Type: application/json" \
  -d '{
    "target_url": "https://example.com",
    "scan_type": "both",
    "interval_hours": 168,
    "notify_email": "[email protected]",
    "webhook_url": "https://hooks.example.com/shieldome"
  }' | jq .

# List your schedules
curl -sf "$BASE/api/scheduled-scans" -H "X-Shieldome-Key: $API_KEY" | jq .

# Delete one (uncomment and set the id)
# curl -sf -X DELETE "$BASE/api/scheduled-scans/SCHED_ID" -H "X-Shieldome-Key: $API_KEY"

{
  "scan_id": "a1b2c3d4-...",
  "status": "completed",
  "started_at": "2026-10-10T08:00:00Z",
  "message": "This target was already scanned within the last 15 minutes."
}

{
  "event": "scan_completed",
  "scan_id": "a1b2c3d4-...",
  "target_url": "https://example.com",
  "risk_score": 72,
  "vulnerability_counts": { "critical": 0, "high": 1, "medium": 2, "low": 7, "info": 30 },
  "total_findings": 10,
  "timestamp": "2026-10-10T08:05:00Z"
}

from flask import Flask, request
import requests

app = Flask(__name__)
API_KEY = "sk_live_xxxxxxxxxxxxxxxx"
BASE    = "https://app.shieldome.com"

@app.post("/shieldome-webhook")
def hook():
    e = request.json
    if e.get("event") == "scan_completed":
        pdf = requests.get(f"{BASE}/api/scan/{e['scan_id']}/report",
                           headers={"X-Shieldome-Key": API_KEY})
        open(f"report-{e['scan_id']}.pdf", "wb").write(pdf.content)
    return "", 204

{
  "name": "Security Headers Grade: D",
  "severity": "high",                 // critical | high | medium | low | info
  "status": "vulnerable",             // vulnerable | warning | secure | info
  "confidence": "confirmed",          // confirmed | likely | possible
  "owasp_id": "A05:2021",
  "cwe_id": "CWE-693",
  "cvss_score": 7.5,
  "description": "...",
  "evidence": "...",
  "remediation": "...",
  "ai_triage_score": 100,             // 0-100 exploitability rank
  "ai_remediation": "...",            // present on actionable findings
  "ai_pentest_narrative": "...",
  "due_date": "2026-11-09T...",
  "days_remaining": 29
}

name: Shieldome Scan
on: [push]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Scan and gate on High+
        env:
          KEY: ${{ secrets.SHIELDOME_API_KEY }}
          BASE: https://app.shieldome.com
          TARGET: https://example.com
        run: |
          SID=$(curl -sf -X POST "$BASE/api/v1/scan" -H "X-Shieldome-Key: $KEY" \
                -H "Content-Type: application/json" -d "{\"target\":\"$TARGET\"}" | jq -r .scan_id)
          until [ "$(curl -sf "$BASE/api/v1/scan/$SID" -H "X-Shieldome-Key: $KEY" | jq -r .status)" != "running" ]; do sleep 10; done
          test "$(curl -sf "$BASE/api/v1/scan/$SID/gate?fail_on=high" -H "X-Shieldome-Key: $KEY" | jq -r .passed)" = "true"

shieldome_scan:
  image: alpine
  variables:
    BASE: "https://app.shieldome.com"
    TARGET: "https://example.com"
  before_script:
    - apk add --no-cache curl jq
  script:
    - SID=$(curl -sf -X POST "$BASE/api/v1/scan" -H "X-Shieldome-Key: $SHIELDOME_API_KEY" -H "Content-Type: application/json" -d "{\"target\":\"$TARGET\"}" | jq -r .scan_id)
    - until [ "$(curl -sf "$BASE/api/v1/scan/$SID" -H "X-Shieldome-Key: $SHIELDOME_API_KEY" | jq -r .status)" != "running" ]; do sleep 10; done
    - test "$(curl -sf "$BASE/api/v1/scan/$SID/gate?fail_on=high" -H "X-Shieldome-Key: $SHIELDOME_API_KEY" | jq -r .passed)" = "true"

withCredentials([string(credentialsId: 'shieldome-api-key', variable: 'KEY')]) {
  sh '''
    BASE=https://app.shieldome.com; TARGET=https://example.com
    SID=$(curl -sf -X POST "$BASE/api/v1/scan" -H "X-Shieldome-Key: $KEY" -H "Content-Type: application/json" -d "{\\"target\\":\\"$TARGET\\"}" | jq -r .scan_id)
    until [ "$(curl -sf "$BASE/api/v1/scan/$SID" -H "X-Shieldome-Key: $KEY" | jq -r .status)" != "running" ]; do sleep 10; done
    test "$(curl -sf "$BASE/api/v1/scan/$SID/gate?fail_on=high" -H "X-Shieldome-Key: $KEY" | jq -r .passed)" = "true"
  '''
}

// Cookie
{ "target_url": "https://example.com", "auth_config": { "type": "cookie", "cookie_string": "session=abc; csrftoken=def" } }

// Bearer token
{ "target_url": "https://example.com", "auth_config": { "type": "token", "token": "eyJhbGciOi..." } }

// Form login (headless browser)
{ "target_url": "https://example.com",
  "auth_config": { "type": "form", "login_url": "https://example.com/login",
                   "username": "[email protected]", "password": "secret",
                   "success_url_contains": "/dashboard" } }

curl -sf "$BASE/api/scans?status=completed&page=1&per_page=100" \
  -H "X-Shieldome-Key: $API_KEY" | jq '.[].id'