API keys & outbound webhooks
Use the read-only REST API directly, or get a signed POST the moment a scan finishes.
API keys
Open API (Developers) from the sidebar to create and revoke API keys. Send your key as a Bearer token: Authorization: Bearer zk_…
The public REST API is read-only for your scans and is rate limited to 120 requests per minute per key.
- GET /api/v1/scans — list your completed scans.
- GET /api/v1/scans/{id} — one scan with its grid results.
Outbound webhooks
Add an https URL on the same page to get a POST the moment something happens — paste a Zapier “Catch Hook”, Make, n8n, or any endpoint.
- Events: scan.completed, scan.failed, reputation.feedback.created.
- Every call is signed with an X-Zuhya-Signature header so you can verify it came from Zuhya.
- The signing secret is shown once when you add the webhook — copy it then.