API Reference
ZeroLeaks REST API
Authentication, versioning, and ZeroLeaks v1 HTTP endpoints.
All authenticated v1 requests use a ZeroLeaks API key:
Authorization: Bearer zl_live_...
Content-Type: application/jsonThe base URL is https://zeroleaks.ai/api/v1. The full machine-readable schema is served from https://zeroleaks.ai/openapi.json.
See ZeroLeaks authentication, error and rate-limit conventions, skill scan webhooks, and the public MCP resource server.
Endpoints
| Method | Path | Purpose |
|---|---|---|
GET | /health | Public service health |
GET | /capabilities | Public models, modes, surfaces, and limits |
POST | /scans | Retired; returns 410 Gone |
GET | /scans | List historical prompt scans |
GET | /scans/{id} | Read historical prompt scan state and report |
POST | /scans/{id}/cancel | Cancel a pending or running prompt scan |
GET | /reports | List prompt-scan reports |
GET | /reports/{id} | Get a report by ID |
GET | /reports/by-scan/{id} | Get a report by scan ID |
POST | /runtime-scans | Create an SDK relay scan (202) |
GET | /runtime-scans | List runtime scans (limit up to 100, default 50) |
GET | /runtime-scans/{id} | Read runtime scan state and report |
POST | /runtime-scans/{id}/cancel | Cancel a runtime scan |
POST | /runtime-scans/{id}/events/next | Claim the next relay event (204 when none is ready) |
POST | /runtime-scans/{id}/events/{eventId} | Submit a target response or runner error |
POST | /agent-configs | Create an HTTP endpoint configuration (201) |
GET | /agent-configs | List endpoint configurations |
PATCH | /agent-configs/{id} | Replace an endpoint configuration |
DELETE | /agent-configs/{id} | Delete an endpoint configuration |
POST | /agent-scans | Scan a configured HTTP endpoint (202) |
GET | /agent-scans | List endpoint scans |
GET | /agent-scans/{id} | Read endpoint scan state, redacted config, and report |
POST | /agent-scans/{id}/cancel | Cancel an endpoint scan |
POST | /skill-scans | Scan a repository, URL, or ZIP archive (202 async, 200 sync) |
GET | /skill-scans | List recent skill scans |
Use the SDK when possible: it applies authentication, serializes request types, handles polling and cancellation, and runs the runtime relay protocol for local agents.