hosting
GET /v1/sites/{siteId}/security
A site's malware state and live findings.
身份验证
请将 API 密钥作为 bearer 令牌发送。此端点在规范中未指明具体的权限，因此请为您的密钥赋予所需的最小权限，并通过检查响应来确认，而不是盲目假设。
此端点不需要组织 ID。您的密钥已用于识别其所属的组织，且响应范围也仅限于该组织。
免费试用
将尖括号中的内容替换为您自己的值，并将键占位符替换为您仪表板中的一个键。
curl -X GET https://api.zinndigital.com/v1/sites/{siteId}/security \
-H "Authorization: Bearer zdk_live_…"已登录？您仪表板中的 API 控制台会自动填入您真实的组织 ID 和您自己的密钥，并针对实时 API 运行请求，以便您查看实际的响应。 在 API 控制台中打开此端点
详细信息
The per-site Tools tab's Malware and security card — the scan verdict, when it last completed, and every live finding. RLS-scoped to a site the caller can view (sites.view); an out-of-scope or unknown id is a 404, exactly like getSite. This reads a stored projection and never calls the scanner. The card mounts with the Tools tab for every site and polls while a scan is in flight, so a vendor round-trip here would be an un-cached external call in a hot path (CLAUDE.md §2.16). A scan is a durable Temporal workflow (§2.9) that writes the row this returns. status: clean with last_scan_at: null means not scanned yet — one nullable timestamp rather than a fourth status. "We could not look" is deliberately distinguishable from "we looked and it is fine", because neither a failed nor an un-attempted scan stamps last_scan_at. ⛔ "We tried and could not" and "we have never tried" are different facts and arrive in different fields. last_scan_error carries the first (an attempt ran and broke — an unreachable host, a vendor error, a scan abandoned after timing out); unavailable_reason carries the second as a machine identifier (nothing is attached to scan this site, or its platform cannot be scanned at all). They are never both non-empty. Render the first as a warning and the second as a neutral notice: showing "we couldn't scan this site" over a scan that was never attempted tells a customer their site might be infected when nothing of the sort is known. detections[].path is always relative to the document root — an absolute path would disclose the host account handle and the fleet's filesystem layout (§2.4).
参数
| 名称 | 类型 | 必填 | 内容简介 |
|---|---|---|---|
siteId (path) | Uuid | 是 | Site ID (UUIDv7). |
响应
| 名称 | 类型 | 必填 | 内容简介 |
|---|---|---|---|
status | MalwareStatus | 是 | A site's scan verdict. There is deliberately no unscanned member: a site nothing has looked at yet is clean with last_scan_at: null, which is one nullable timestamp… |
last_scan_at | object | 是 | When a scan last completed. null = never scanned. A scan that failed does not stamp this, so a stale success can never be mistaken for a fresh one. |
detections | MalwareDetection[] | 是 | — |
recent_resolutions | ResolvedMalwareDetection[] | 是 | Findings that were present and are not any more, most recently cleared first — the record of the protection having worked, which an all-clear alone cannot show. resolved_at… |
can_rescan | boolean | 是 | Whether rescanSite will accept a request for this site: false while a scan is already running, false for a site that is not running at all (there is no document root to scan),… |
last_scan_error_code | string<, scan_conflict, scanner_unreachable, scanner_missing, scan_failed> | 是 | Why a scan that ran could not finish; empty when none has failed. Non-empty means an attempt was made against this site and broke — an unreachable host, a vendor error, a scan… |
unavailable_reason | string | 是 | Why no scan was attempted; empty when one was. A stable machine identifier for the client to localise, never a sentence and never a vendor name. vendor_unsupported — the… |
runtime | SiteRuntimeSecurity | 是 | What our runtime sensor saw happen on this site, and whether anything was watching it at all. The malware fields above are a verdict on files at rest; this is the other half —… |
此端点可能返回的错误
401 · 403 · 404 · 429