AUTO-SEC AUDITOR
Resources/API Reference

API Reference

Base URL: https://audit-otomatis-phi.vercel.app

Rate limit per crawl: maksimal 100 request HTTP ke domain target ( RequestBudget di lib/rate-limit.ts). Cooldown per domain: 5 menit di production, 10 detik saat NODE_ENV=development. Cooldown scan pasif dan QC dihitung terpisah (prefix Redis beda).
POST/api/scan
Server Action, bukan REST route. Kalau butuh trigger scan dari luar browser (mis. CI, script), endpoint publik ini perlu dibuat dulu.

Belum tersedia sebagai REST endpoint publik. Memulai scan saat ini dilakukan lewat Next.js Server Action (startScanAction di lib/actions.ts), dipanggil langsung dari form di halaman Overview — bukan lewat fetch ke /api/scan. Ditulis di sini supaya konsisten dengan rencana API, tapi cURL di bawah TIDAK akan berhasil sampai endpoint-nya benar-benar dibuat.

FieldTypeReq.Note
domainstringyesURL atau hostname target, mis. "example.com"
Response
{
  "ok": true,
  "scanId": "aB3xQ9kLmZ"
}
cURL
# BELUM BERFUNGSI — lihat catatan di atas
curl -X POST 'https://audit-otomatis-phi.vercel.app/api/scan' \
  -H 'Content-Type: application/json' \
  -d '{"domain":"example.com"}'
GET/api/scan/[id]/stream

Server-Sent Events. Tiap event berupa JSON ScanLogEvent ({type, message?, status?, finding?, endpoints?, timestamp}). type bisa log | status | finding | done | error | blocked | endpoints. Mendukung resume via header Last-Event-ID kalau koneksi putus.

Response
id: 12
data: {"type":"finding","finding":{...},"timestamp":1785457624177}

id: 13
data: {"type":"done","status":"done","timestamp":1785457630001}
cURL
curl -N 'https://audit-otomatis-phi.vercel.app/api/scan/aB3xQ9kLmZ/stream'
GET/api/scan/[id]

Snapshot status scan saat ini (bukan realtime — pakai /stream untuk itu).

Response
{
  "id": "aB3xQ9kLmZ",
  "domain": "example.com",
  "status": "done",
  "createdAt": 1785457624177,
  "requestsMade": 87,
  "endpointsDiscovered": 14,
  "pagesCrawled": 12,
  "jsFilesScanned": 6,
  "findingsCount": 3,
  "blockedReason": null
}
cURL
curl 'https://audit-otomatis-phi.vercel.app/api/scan/aB3xQ9kLmZ'
POST/api/qc/scan

Membuat QC run baru lalu langsung menjalankannya di background. Field body sebenarnya domain (bukan url seperti di rencana awal) — nama field ini yang divalidasi oleh validateDomainInput().

FieldTypeReq.Note
domainstringyesURL atau hostname target
modules.seobooleannodefault true
modules.perfbooleannodefault true
modules.contentbooleannodefault true
Response
{ "ok": true, "id": "qC7nR2wXpL" }
cURL
curl -X POST 'https://audit-otomatis-phi.vercel.app/api/qc/scan' \
  -H 'Content-Type: application/json' \
  -d '{"domain":"example.com","modules":{"seo":true,"perf":true,"content":false}}'
GET/api/qc/[id]/stream

Sama seperti scan stream tapi payload QcLogEvent: {type, message?, status?, module?, timestamp}. type: log | status | module_done | done | error.

Response
id: 4
data: {"type":"module_done","module":"seo","timestamp":1785457901234}
cURL
curl -N 'https://audit-otomatis-phi.vercel.app/api/qc/qC7nR2wXpL/stream'
GET/api/qc/[id]

Snapshot QC state termasuk result per modul (skor 0–100 masing-masing).

Response
{
  "id": "qC7nR2wXpL",
  "domain": "example.com",
  "status": "done",
  "modules": { "seo": true, "perf": true, "content": false },
  "result": {
    "seo": { "score": 82, "issues": [...] },
    "perf": { "score": 91, "metrics": { "source": "pagespeed", ... } }
  },
  "requestsMade": 41
}
cURL
curl 'https://audit-otomatis-phi.vercel.app/api/qc/qC7nR2wXpL'
GET/api/requests

List semua scan (Passive + QC berbagi store yang sama), terbaru dulu, maks 50.

Response
{
  "scans": [
    {
      "id": "aB3xQ9kLmZ",
      "domain": "example.com",
      "origin": "https://example.com",
      "createdAt": 1785457624177,
      "status": "done",
      "pagesCount": 12,
      "findingsCount": 3,
      "severityCounts": { "CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 0, "INFO": 0 }
    }
  ]
}
cURL
curl 'https://audit-otomatis-phi.vercel.app/api/requests'
GET/api/requests/[id]

Semua halaman yang di-crawl untuk satu scan, lengkap dengan header, content-type, ukuran, dan preview HTML — plus deteksi tech stack sederhana. 404 kalau scan tidak ada / sudah kedaluwarsa.

Response
{
  "meta": { "id": "aB3xQ9kLmZ", "hostname": "example.com", "url": "https://example.com", "createdAt": 1785457624177, "status": "done" },
  "pages": [
    { "url": "https://example.com", "status": 200, "contentType": "text/html", "size": 15342, "headers": {...} }
  ],
  "techStack": ["Next.js", "Vercel"]
}
cURL
curl 'https://audit-otomatis-phi.vercel.app/api/requests/aB3xQ9kLmZ'