AKILI API

REST API for security scans and OSINT modules. Responses stream as plain text during scans, then finish with a JSON report. Sign in on the web app or use named API keys from the dashboard.

v1 JSON reports Streaming scans
Base URL —

Quick start

1. Create an account and open Developers in the dashboard.

2. Generate a named live key (ak_live_…).

3. POST to a scan endpoint with Authorization: Bearer <session> or X-API-Key.

4. Read the stream until you see COMPLETE:{...json...}, or fetch the report later by scan_id.

POST /api/v1/scan/website 
curl -X POST BASE/api/v1/scan/website \
  -H "Authorization: Bearer YOUR_JWT" \
  -H "X-API-Key: ak_live_xxxx" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

Authentication

All scan routes require a signed-in user. Use either method below (both can be sent together).

HeaderDescription
AuthorizationBearer <JWT> from POST /api/v1/auth/login or register
X-API-KeyNamed key from POST /api/v1/keys/generate (ak_live_ or ak_test_)
X-Session-TokenSame JWT as Bearer (browser convenience)
Content-Typeapplication/json on POST bodies

Session endpoints

POST/api/v1/auth/register

Body: email, password, confirm_password, optional name, phone.

{"email":"you@example.com","password":"secret123","confirm_password":"secret123","name":"Ada Lovelace"}
POST/api/v1/auth/login
{"email":"you@example.com","password":"secret123"}
GET/api/v1/auth/me

Returns user and usage (plan, monthly module counts, caps).

Streaming scans

Scan POST endpoints return text/plain with one line per event, for example:

[AKILI] Starting website assessment…
[TOOL] fingerprint — running
[FOUND] Missing HSTS header
[DONE] Report ready
COMPLETE:{"scan_id":"…","score":72,"grade":"B",…}

Parse the final line starting with COMPLETE: as JSON, or call GET /api/v1/report/{scan_id} afterward.

Results are automated OSINT/security signals — verify important findings before you act.

Rate limits

Limits depend on your plan and module. Response headers:

HeaderMeaning
X-RateLimit-LimitMax requests in the window
X-RateLimit-RemainingRequests left
X-RateLimit-ResetUnix reset time
X-AKILI-TierEffective tier (free, trial, premium, sandbox)

HTTP 429 when monthly module quota or hourly cap is exceeded. HTTP 403 for premium-only modules on free plan.

Scan endpoints

All require authentication. Body must be JSON. Unless noted, response is a streaming scan.

POST/api/v1/scan/website

Website security: headers, SSL, DNS, ports, tech stack.

{"url":"https://example.com"}
POST/api/v1/scan/vulnerability

Misconfiguration and exposure checks (CORS, cookies, etc.).

{"url":"https://example.com"}
POST/api/v1/scan/subdomains
{"domain":"example.com"}
POST/api/v1/scan/ip
{"ip":"8.8.8.8"}
POST/api/v1/scan/person

Public OSINT only — authorized due diligence.

{"name":"Jane Doe","keywords":"engineer Lagos"}
POST/api/v1/scan/email
{"email":"user@example.com"}
POST/api/v1/scan/domain
{"domain":"example.com"}
POST/api/v1/scan/organization

Premium / trial. ASN and organizational footprint.

{"name":"Acme Corp","domain":"acme.com"}
POST/api/v1/scan/company
{"name":"Acme Corp","domain":"acme.com"}
POST/api/v1/scan/api

Generic API scanner: exercises common HTTP methods and returns per-method responses and optional diffs vs GET.

Body (JSON):

{
  "url": "https://example.com",
  "methods": ["GET", "POST"],
  "headers": {"X-Test": "1"},
  "form_payload": {"q":"test"},
  "auth": {"type":"basic","username":"u","password":"p"},
  "timeout": 8,
  "diff": true
}

Notes: POST/PUT/PATCH will send a small non-destructive payload by default. Use `form_payload` to send `application/x-www-form-urlencoded` data.

POST/api/v1/scan/template

Multi-module template: pre_launch, freelancer, vendor, full, etc.

{"template":"pre_launch","target":"https://example.com"}

Reports & history

GET/api/v1/report/{scan_id}

Full JSON report for a completed scan (must belong to your account).

GET/api/v1/history?limit=20&page=1&q=

Paginated list of your scans. Query params: type, q (target filter).

DELETE/api/v1/report/{scan_id}

Delete one report from your history.

API keys

Keys must have a name when created. The full secret is shown once.
POST/api/v1/keys/generate
{"name":"Production CI","sandbox":false}
GET/api/v1/keys/list

Lists named keys (preview only, not the secret).

DELETE/api/v1/keys/{key_id}

Revoke a key.

Sandbox

Mock data for demos — use ak_test_ keys or sandbox routes without hitting live targets.

POST/api/v1/sandbox/scan/website?scenario=clean_scan

Scenarios include clean_scan, risky_scan. Same modules as production sandbox paths.

GET/api/v1/sandbox/report/{module}

Instant mock JSON report (no stream).

Errors

StatusTypical cause
401Missing or invalid session / API key
403Module not on your plan
404Unknown scan_id or report not yours
429Rate or monthly quota exceeded
400Validation (URL, email, IP, key name missing)

Plans

GET/api/v1/plans

Public list of modules, trial length, and limit tables.

GET/api/v1/health

API and optional Groq LLM connectivity status.