Use Shaker through API keys, not tickets.

Submit a tenant-scoped scan job for CI, preview, or agent workflows using quick, standard, deep, full, aggressive, or smart scan_type presets. Legacy preview, sandbox, and complete aliases are still accepted. Set options.ai to true when you want AI enrichment explicit in API payloads, or false to disable it.

List recent scan jobs for your tenant with basic filtering and pagination.

Retrieve normalized vulnerability findings for a given scan.

Deterministically retest supported stored findings and persist an evidence artifact. Unsupported finding classes currently return unsupported.

Return a machine-usable allow, block, or needs_approval decision for a scan, optionally selecting a named policy_pack.

Evaluate caller-supplied agent or MCP event traces and return allow, block, or needs_approval with an evidence hash. Automatic runtime capture is not part of the beta path yet.

Fetch a persisted verification or policy artifact for audit and workflow logs.

Mint a short-lived signed approval token for policy evidence that resolves to allow.

Verify a signed approval token without an API key so downstream systems can trust it offline.

Persist a remediation artifact with fix steps, validation, rollback notes, patch suggestions, and a PR draft.

Fetch a stored remediation artifact for CI logs, PR comments, operator review, or agent follow-up.

Read current period usage, legacy counters, and control-plane feature flags.

Start a subdomain discovery run for a root domain or saved target. The hosted discovery callback persists discovery_runs and can feed shared DAST target inventory.

Read a discovery run status, including discovered subdomains once the run completes.

Create a tenant-scoped scheduled scan for a saved DAST target. The same route backs dashboard scheduling and API-key automation clients.

List existing target schedules with target metadata and pagination for operator automation.

Enable or tune continuous monitoring for a root domain target, including frequency, jitter, timezone, and scan options.

Manually trigger a continuous monitoring cycle for a root domain target, including discovery and follow-on scans.

Create the root DAST target, enable continuous monitoring, trigger subdomain discovery, and seed smart scheduling in one call.

Start discovery with a root domain. Poll /api/dast/discovery/:id to read status and the discovered subdomain list.

curl -sS -X POST "https://shakerscan.com/api/dast/discovery" \
  -H "X-API-Key: $SHAKER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "root_domain": "example.com",
    "quick": false
  }'

Create a recurring scan once a target already exists. This is the direct API shape behind the DAST schedules tab and the MCP scheduling tools.

curl -sS -X POST "https://shakerscan.com/api/dast/schedules" \
  -H "X-API-Key: $SHAKER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "target_id": "target_123",
    "day_of_week": 1,
    "time_of_day": "02:00",
    "scan_options": {
      "standard": true,
      "quick": false,
      "ai": true
    }
  }'

Configure root-domain continuous monitoring directly, or use auto-setup to create the target plus monitoring in one call.

curl -sS -X PATCH "https://shakerscan.com/api/dast/targets/target_123/continuous" \
  -H "X-API-Key: $SHAKER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": true,
    "frequency": "weekly",
    "day_of_week": 1,
    "time_of_day": "02:00",
    "scan_options": {
      "standard": true,
      "quick": false,
      "ai": true
    }
  }'

curl -sS -X POST "https://shakerscan.com/api/dast/targets/target_123/continuous/trigger" \
  -H "X-API-Key: $SHAKER_API_KEY"

curl -sS -X POST "https://shakerscan.com/api/dast/targets/auto-setup" \
  -H "X-API-Key: $SHAKER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "example.com",
    "scan_type": "standard",
    "frequency": "weekly",
    "day_of_week": 1,
    "time_of_day": "02:00",
    "auto_enable_subdomains": true
  }'

What is live now

API keys, the first-party CLI workspace, MCP connectivity, scan submission, findings retrieval, deterministic verification, family-aware policy decisions, evidence artifacts plus hashes, signed approval tokens, GitHub issue handoff, the hosted PR gate, usage metering, domain verification, and hosted billing readiness gates are already wired into the app.

Still missing today

• Deterministic verification currently covers a subset of finding classes. Unsupported findings return unsupported instead of a forced pass/fail result.
• Agent behavior evaluation currently works from caller-supplied traces; automatic runtime capture, sandboxing, and universal tool telemetry are still missing.
• Hosted PR gating still assumes a clean repo-to-target mapping; broader multi-environment routing and deeper PR review UX are not complete yet.
• Direct PR creation and auto-fix execution on remediation plans are not shipped yet; GitHub issue handoff is the current path.
• Approval tokens are still limited to persisted allow decisions backed by stored evidence records; the agent-behavior API returns an evidence hash but not a tokenizable evidence object.

Skill support

The hosted docs now expose the reusable agent skill directly, so users can copy or download the same SKILL.md from the product itself.