Developers

Build on ScanLeaks.

A REST API for pulling detections, filing takedowns and receiving webhooks when something of yours turns up. JSON in, JSON out.

Preview reference. These endpoints are not final and the API is not yet open. Do not build against them until the backend team publishes the confirmed contract.

Quick start

curl https://api.scanleaks.io/v1/scans \
  -H "Authorization: Bearer sk_live_••••••••••••••••" \
  -H "Content-Type: application/json"

Base URLhttps://api.scanleaks.io
Versionv1
AuthBearer token

Endpoints

GET/v1/scans

List all scans for your account, paginated.

Parameters

limitintegerMax results per page (default 20, max 100)
statusstringFilter by status: pending | active | resolved
platformstringFilter by platform slug (e.g. onlyfans, instagram)

Example response

{
  "data": [
    {
      "id": "scan_01J8XKPQR7TNMV3W9Y4Z",
      "status": "active",
      "platform": "telegram",
      "url": "https://t.me/leakschannel/4821",
      "detected_at": "2026-08-08T14:32:00Z",
      "severity": "high",
      "takedown_filed": true
    }
  ],
  "meta": {
    "total": 287,
    "page": 1,
    "per_page": 20
  }
}

Webhooks

ScanLeaks sends signed webhook events to your endpoint so you can react to incidents in real time.

scan.detectedFired when a new leak or impersonation is detected.
scan.false_positiveFired when a scan is marked as a false positive.
takedown.filedFired when a DMCA notice or report is submitted.
takedown.resolvedFired when the infringing content is confirmed removed.
takedown.escalatedFired when a case is escalated to legal partners.