Integrate ScanToSec into your Business tools

Create a company and API key

Creates a company and returns a secret API key. This public route should only be called from a secure server.

name (required, string, maximum 255 characters)
email (required, unique email)
password (required, minimum 8 characters)
password_confirmation (required, must match password)

{ "company": { ... }, "api_key": "prefix.secret" }

Get account

Returns the company, active subscription, and current site quota usage.

No parameters.

{ "company": { ... }, "subscription": { ... }, "usage": { "sites_used": 2, "site_limit": 50 } }

Get active plan

Returns the plan attached to the company’s active subscription.

No parameters.

{ "data": [ { "id": 2, "name": "Business 100", "price": "719.99" } ] }

Create checkout

Creates a Stripe checkout session to purchase an active plan. The mode depends on the plan: one-time payment or recurring subscription according to payment_type. White label can only be requested when the plan allows it.

plan_id (required, integer, active plan)
payment_type (required: one_time or subscription)
billing_period (required for subscription: 3_months, 6_months, or year)
white_label_enabled (optional, boolean)

{ "checkout_url": "https://checkout.stripe.com/...", "subscription_id": 42 }

List sites

Returns company sites with standard pagination.

page (optional)
per_page (optional)

{ "data": [ { "id": 10, "name": "Client", "domain": "https://client.example" } ], "pagination": { ... } }

Create a site

Adds an active site to the company portfolio. The domain must be a valid URL and plan quota must be available. The quota check and creation are protected against concurrent requests. Existing domains are returned without creating a duplicate.

name (required, string)
domain (required, URL)

{ "data": { "id": 10, "name": "Client", "domain": "https://client.example" } }

Activate a site

Activates an existing site belonging to the company. Activation is rejected without an active subscription or when it exceeds the plan site quota.

site (required, integer, ID in the URL)\nNo JSON body.

{ "data": { "id": 10, "status": "active", ... }, "message": "Site activated successfully." }

Deactivate a site

Deactivates an existing site belonging to the company. The site data and its reports are not deleted.

site (required, integer, ID in the URL)\nNo JSON body.

{ "data": { "id": 10, "status": "inactive", ... }, "message": "Site deactivated successfully." }

Delete a site

Permanently deletes a site belonging to the company and reports associated with that site or its domain.

site (required, integer, ID in the URL)\nNo JSON body.

{ "message": "Site deleted successfully.", "site_id": 10 }

Launch a scan

Starts an asynchronous analysis for the active site matching domain. site_id can be provided to select a company site explicitly. The API immediately returns a report UUID to track. If no active site matches, it returns an error and never selects another site automatically. Business API reports are generated in English.

domain (required, URL)
cms_type (required, string)
site_id (optional, integer)
external_reference (optional, string)

{ "data": { "uuid": "...", "status": "pending", "site_id": 10 } }

List reports

Returns company reports with status, details, and pagination.

page/per_page (optional)

{ "data": [ { "uuid": "...", "status": "completed" } ], "pagination": { ... } }

Get latest report

Returns the latest report and a summary of passed and failed tests.

No parameters.

{ "data": { "uuid": "...", "status": "completed" }, "summary": { ... } }

Get a report

Returns one report by UUID and branding information when white label is active.

uuid (required, UUID in the URL)

{ "data": { ... }, "branding": { ... } }

List payments

Returns the company subscription payment history.

page/per_page (optional)

{ "data": [ { "amount": "719.99", "status": "paid" } ], "pagination": { ... } }

Get remaining quota

Returns used sites, plan limit, and remaining available sites.

No parameters.

{ "data": { "sites_used": 2, "site_limit": 50, "sites_remaining": 48 } }

Get or update branding

GET reads branding configured by the administrator. PUT updates an existing branding only when the active subscription is within its plan period, the plan supports white label, and the administrator has enabled company editing. Companies cannot create branding through the API. Logo uploads must be PNG, JPG, JPEG, or WebP, no larger than 2 MB and exactly 60 × 60 pixels.

PUT: brand_name, primary_color, secondary_color, support_email (optional)
logo (optional image file: PNG/JPG/JPEG/WebP, max 2 MB, exactly 60 x 60 px)

GET returns 403 when the plan or period is not eligible, and 404 when the administrator has not configured branding. PUT returns 403 when editing is disabled and 404 when branding does not exist.

{ "data": { "brand_name": "Client" } }

Receive Stripe events

Receives Stripe events for B2B subscriptions and automatically updates payments and subscription status.

No business JSON to build: send the raw Stripe body with the Stripe-Signature header. The signature is verified server-side.