# scann authentication

scann is the internet asset search and pentest reconnaissance API.

## Base URLs

- Main API: `https://api.ipgox.com`
- Frontend: `https://ipgox.com`
- CVE API: `https://cve.ipgox.com` (no API key)
- Exploits / risky-files API: `https://exp.ipgox.com` (session optional)

## Session authentication

Browser clients authenticate with the HTTP-only session cookie issued by `/api/v1/auth/login`.

```http
Cookie: t=<session_token>
```

## Bearer token authentication

API clients may send a JWT access token:

```http
Authorization: Bearer <token>
```

## API key authentication

Search, agent, MCP, and A2A clients should send:

```http
X-API-Key: <api_key>
```

Issue or rotate keys at `/api/v1/users/me/api-key` while authenticated in the browser.

## Agent interfaces

- OpenAPI: `https://api.ipgox.com/openapi.json`
- API catalog: `https://api.ipgox.com/.well-known/api-catalog`
- MCP JSON-RPC: `POST https://api.ipgox.com/mcp`
- A2A JSON-RPC: `POST https://api.ipgox.com/a2a`
- Agent export: `POST https://api.ipgox.com/api/v1/agent/export-targets`
- Agent enrich: `POST https://api.ipgox.com/api/v1/agent/enrich`
- DSL reference: `GET https://api.ipgox.com/api/v1/agent/dsl`

## CVE API

Public read-only service at `https://cve.ipgox.com`. No API key required.

- Search: `GET https://cve.ipgox.com/api/v1/cves`
- Detail: `GET https://cve.ipgox.com/api/v1/cves/{cve_id}`

## Exploits / risky-files API

Catalog service at `https://exp.ipgox.com`. Optional session for higher visibility tiers.

- Search: `GET https://exp.ipgox.com/api/v1/exploits`
- Detail: `GET https://exp.ipgox.com/api/v1/exploits/{id}`
- Purchase: `POST https://api.ipgox.com/api/v1/files/{id}/buy`
- Download grant: `GET https://exp.ipgox.com/v1/files/{file_id}/download`

## Discovery

- llms.txt: `https://ipgox.com/llms.txt`
- Agent skills: `https://ipgox.com/.well-known/agent-skills/index.json`
- MCP card: `https://ipgox.com/.well-known/mcp/server-card.json`
- Agent card: `https://ipgox.com/.well-known/agent-card.json`