How to test your website with a security API

A website security API checks a running deployment and returns evidence your application can act on. AgentDAST accepts an owned HTTPS website, a time and request budget, and an optional capture flag. You can poll the result or receive a signed webhook.

1. Create a key and register your website

Create a free account and keep the API key in your server or agent’s secret store. Never embed it in a public page. Set AGENTDAST_API_KEY in your environment, then register the exact origin:

curl https://agentdast.com/v1/targets \
  -H "Authorization: Bearer $AGENTDAST_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"url":"https://app.example.com"}'

2. Prove ownership

The response includes a target ID and a unique DNS TXT record or verification file. Publish the returned proof exactly as provided. A parent domain does not authorize a subdomain. Keep the proof in place throughout the run.

curl https://agentdast.com/v1/targets/TARGET_ID/verify \
  -H "Authorization: Bearer $AGENTDAST_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"method":"file"}'

Replace TARGET_ID with the returned ID. Use "method":"dns" if you published the TXT record.

3. Start a bounded assessment

curl https://agentdast.com/v1/runs \
  -H "Authorization: Bearer $AGENTDAST_API_KEY" \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: my-deployment-001' \
  -d '{"target_id":"TARGET_ID","duration_seconds":300,"max_requests":15}'

The response is HTTP 202 with a run ID. Use a new idempotency key for each intended run; keep the same key and body when retrying a request. An optional flag is a unique synthetic string you placed on your own test site. Do not use a real credential as a flag.

4. Read evidence or receive an alert

Poll GET /v1/runs/RUN_ID every ten seconds, or create a webhook and pass its ID when starting the run. Verify each webhook’s HMAC against the raw body and deduplicate the event ID. The API documentation includes signature verification code.

Confirmed evidence includes supported exposed secrets, public Git metadata and exact flag captures. A run with no findings is not proof that your site is secure. AgentDAST currently makes bounded, read-only requests; it does not test logged-in workflows or replace a full penetration test.

100 free assessments per month. No card required. Get a free API key.