API docs.

Send exactly one JSON field, url, to the production endpoint. Bare domains and public HTTP(S) URLs are accepted.

curl -sS https://scope.breach.io/api/v1/recon \
  -H 'Content-Type: application/json' \
  -d '{"url":"example.com"}'

Browser or Node.js

const response = await fetch("https://scope.breach.io/api/v1/recon", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ url: "example.com" }),
});

const payload = await response.json();
if (!response.ok) {
  throw new Error(payload.error.code + ": " + payload.error.message);
}

console.log(payload.data.scope.allowedHosts);

Every v1 search response includes apiVersion and a uniquerequestId. The complete schema—including every asset, provenance, coverage, fingerprint, and scope field—is in the OpenAPI document.

{
  "apiVersion": "1.2.0",
  "requestId": "b842a62c-4dcb-47b2-a83f-207e63f58bb3",
  "data": {
    "apex": "example.com",
    "anchor": {
      "apex": "example.com",
      "registrantOrg": null,
      "registrantEmailDomain": null,
      "certOrgs": [],
      "githubOrgs": []
    },
    "assets": [],
    "github": [],
    "gitlab": [],
    "services": [],
    "githubReferences": [],
    "dnsRelations": [],
    "relatedDomains": [],
    "candidates": [],
    "dangling": [],
    "referenced": [],
    "origins": [],
    "fingerprints": { "signals": [], "matches": [] },
    "scope": {
      "name": "example.com-recon-2026-08-12",
      "authorized": false,
      "allowedHosts": ["example.com"],
      "excludedHosts": [],
      "allowedSchemes": ["http", "https"],
      "rateLimit": { "requestsPerSecond": 1, "parallelism": 1 },
      "notes": "Authorization must be attested by a human."
    },
    "perSource": {},
    "coverage": {
      "sources": {},
      "discoveredHosts": 0,
      "processedHosts": 0,
      "truncatedHosts": 0
    },
    "counts": {
      "CONFIRMED": 0,
      "THIRD_PARTY": 0,
      "CANDIDATE": 0,
      "DANGLING": 0
    }
  }
}

Asset classifications are CONFIRMED, THIRD_PARTY, CANDIDATE, or DANGLING. Only CONFIRMED hosts enter scope.allowedHosts.scope.authorized is always false until a human confirms written permission.

githubReferences records repository, Pages, deployment, selected-file, and exact-domain code-search evidence. dnsRelationsrecords bounded TXT/CAA/SRV/HTTPS/SVCB relationships. relatedDomainskeeps off-apex portfolio candidates separate from the generated scope and marks a domain confirmed only after two independent evidence families agree.

gitlablists public projects only for groups linked by the target’s own site or security policy. services derives cloud and SaaS dependencies from CNAME and MX data already collected; these provider targets are never test scope.

Inspect X-Scope-Cache, RateLimit-Policy, and X-Request-Id. A 429 response also includes Retry-After: 60.

Non-2xx responses use one stable envelope. Log the request ID when reporting a failure.

{
  "apiVersion": "1.2.0",
  "requestId": "8dd7cecf-69f5-4309-b89f-2ee88c9ebc8f",
  "error": {
    "code": "INVALID_TARGET",
    "message": "Enter a public company domain, e.g. acme.com"
  }
}

• No API key or cookies are accepted; cross-origin responses use Access-Control-Allow-Origin: * without credentials.
• Private, loopback, link-local, internal, credential-bearing, non-HTTP(S), and disallowed-port targets are rejected.
• Discovery is bounded and provider-dependent. Treat CANDIDATE, DANGLING, origin, and fingerprint results as evidence to review—not proof of ownership or authorization.
• Using the generated scope for testing still requires written permission from the target owner.