Scan websites programmatically

1. Get an API key

Sign in and generate a key from your dashboard. Keys start with nxs_live_ and are shown once — store it somewhere safe. You can have up to 5 active keys at a time.

2. Make a request

POST to /api/v1/scan with your key in the Authorization header and a url in the body.

cURL

curl -X POST https://nexorashield.site/api/v1/scan \
  -H "Authorization: Bearer nxs_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'

JavaScript

const res = await fetch("https://nexorashield.site/api/v1/scan", {
  method: "POST",
  headers: {
    "Authorization": "Bearer nxs_live_your_api_key",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ url: "https://example.com" }),
});

const report = await res.json();
console.log(report.score, report.status);

3. Response

A successful scan returns:

{
  "id": "clx...",
  "url": "https://example.com",
  "score": 85,
  "status": "Secure",
  "ssl": true,
  "httpStatus": 200,
  "responseTime": 342,
  "robotsFound": true,
  "sitemapFound": true,
  "securityHeaders": { "...": "header-by-header breakdown" },
  "virusTotal": { "...": "reputation summary" },
  "aiAdvice": "Plain-English summary of what to fix and why...",
  "robots": { "found": true, "url": "https://example.com/robots.txt" },
  "sitemap": { "found": true, "url": "https://example.com/sitemap.xml" }
}

Errors & rate limits

• 401 — missing, invalid, or revoked API key:

  { "error": "Missing or invalid API key. Use 'Authorization: Bearer <key>'." }

• 429 — rate limit exceeded (30 requests/hour per key)
• 400 — missing url in the request body
• 500 — the scan itself failed (target site unreachable, timed out, etc.)