Skip to content
HeaderHawk

List a site's monitored pages

GET
/v1/sites/{siteId}/pages
curl --request GET \
  --url 'https://api.us.headerhawk.com/v1/sites/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/pages?limit=50' \
  --header 'Authorization: Bearer <token>'

The pages you marked on the site, payment pages and others, in the order the site lists them, each with its latest scheduled scan. Every plan can read them, including one that no longer scans them.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
siteId
required
string format: uuid

The site’s id.

Query Parameters

Section titled “Query Parameters”
limit
integer
default: 50 >= 1 <= 200

How many items a page holds.

cursor
string
>= 1 characters <= 1024 characters

The previous page’s nextCursor. Omit it for the first page.

Responses

Section titled “Responses”

200

Section titled “200”

A page of monitored pages

Media typeapplication/json
object
data
required
Array<object>
object
id
required
string format: uuid
siteId
required
string format: uuid
label
required
string
kind
required

payment: a page with a payment form or a payment provider’s iframe, the pages PCI DSS 6.4.3 and 11.6.1 are about. other: a page worth scanning that is not one, such as a login page. An open enum.

string
Allowed values: payment other
matchPattern
required

scheme://host/path: which reports and scripts belong to the page. In the path * matches within one segment and **, as the whole last segment, any remainder. Query strings and fragments are never part of a page.

string
scanUrl
required

The one URL the scheduled scans fetch; always set on a payment page.

string
nullable
latestScan
required

The page’s latest scheduled scan; null until it has had one.

object
id
required
string format: uuid
scannedAt
required
string format: date-time
status
required

complete, or failed with a failureReason. An open enum.

string
Allowed values: complete failed
grade
required

The letter grade HeaderHawk’s scan rubric gave the page’s headers: A+, A, B, C, D or F. Null for a failed scan.

string
nullable
failureReason
required

Why the scan failed, or null for a complete scan: bot_challenge, access_denied, server_error, timeout, tls_failure, connection_failed, too_many_redirects, not_html, or not_allowed when the page or a redirect led off the site’s hosts or to an address scans do not connect to. A string, so a new reason does not break a client.

string
nullable
consecutiveFailures
required

Failures in a row, this one included; 0 for a complete scan.

integer
changes
required

What differs from the page’s last complete scan.

object
headers
required
Array<object>

One watched header that differs from the last complete scan.

object
header
required

The header’s name, lowercase. An open enum.

string
Allowed values: content-security-policy content-security-policy-report-only strict-transport-security x-frame-options x-content-type-options referrer-policy permissions-policy
change
required

An open enum.

string
Allowed values: added removed changed
before
required
string
nullable
after
required
string
nullable
gradeDroppedFrom
required

The last complete scan’s grade, when this one is lower under the same rubric; otherwise null.

string
nullable
rebaselined
required

The rubric changed since the last complete scan, so the grade was not compared.

boolean
createdAt
required
string format: date-time
updatedAt
required
string format: date-time
nextCursor
required
string
nullable
Example
{
  "data": [
    {
      "kind": "payment",
      "latestScan": {
        "status": "complete",
        "changes": {
          "headers": [
            {
              "header": "content-security-policy",
              "change": "added"
            }
          ]
        }
      }
    }
  ]
}

Headers

Section titled “Headers”
RateLimit-Limit
integer

The budget nearest to running out, per minute.

RateLimit-Remaining
integer

What is left of that budget this minute.

RateLimit-Reset
integer

Seconds until that budget starts again.

400

Section titled “400”

A parameter was refused, or one the operation does not take was sent. The message names it.

Media typeapplication/json
object
error
required
object
code
required

What went wrong. An open enum: treat a code you do not know by its HTTP status.

string
Allowed values: bad_request validation_error invalid_api_key plan_upgrade_required forbidden not_found rate_limited rate_limit_unavailable upstream_unavailable internal_error
message
required

For people. Branch on code.

string
requestId
required

Quote it when you write to us about this request.

string
Example
{
  "error": {
    "code": "bad_request"
  }
}

401

Section titled “401”

invalid_api_key: no key, or one that is malformed, unknown, revoked or expired. One answer for all of them.

Media typeapplication/json
object
error
required
object
code
required

What went wrong. An open enum: treat a code you do not know by its HTTP status.

string
Allowed values: bad_request validation_error invalid_api_key plan_upgrade_required forbidden not_found rate_limited rate_limit_unavailable upstream_unavailable internal_error
message
required

For people. Branch on code.

string
requestId
required

Quote it when you write to us about this request.

string
Example
{
  "error": {
    "code": "bad_request"
  }
}

403

Section titled “403”

plan_upgrade_required: the tenant’s plan does not include API access (the key works again when it does), or does not include what this operation reads.

Media typeapplication/json
object
error
required
object
code
required

What went wrong. An open enum: treat a code you do not know by its HTTP status.

string
Allowed values: bad_request validation_error invalid_api_key plan_upgrade_required forbidden not_found rate_limited rate_limit_unavailable upstream_unavailable internal_error
message
required

For people. Branch on code.

string
requestId
required

Quote it when you write to us about this request.

string
Example
{
  "error": {
    "code": "bad_request"
  }
}

404

Section titled “404”

No such resource in your tenant.

Media typeapplication/json
object
error
required
object
code
required

What went wrong. An open enum: treat a code you do not know by its HTTP status.

string
Allowed values: bad_request validation_error invalid_api_key plan_upgrade_required forbidden not_found rate_limited rate_limit_unavailable upstream_unavailable internal_error
message
required

For people. Branch on code.

string
requestId
required

Quote it when you write to us about this request.

string
Example
{
  "error": {
    "code": "bad_request"
  }
}

429

Section titled “429”

rate_limited: over a budget. Wait Retry-After seconds.

Media typeapplication/json
object
error
required
object
code
required

What went wrong. An open enum: treat a code you do not know by its HTTP status.

string
Allowed values: bad_request validation_error invalid_api_key plan_upgrade_required forbidden not_found rate_limited rate_limit_unavailable upstream_unavailable internal_error
message
required

For people. Branch on code.

string
requestId
required

Quote it when you write to us about this request.

string
Example
{
  "error": {
    "code": "bad_request"
  }
}

Headers

Section titled “Headers”
Retry-After
integer

Seconds to wait before trying again.