Skip to content
nebtynebtynebty Docs

List a brand's scans

GET
/core/api/brands/{id}/scans/
curl --request GET \
  --url https://app.nebty.de/core/api/brands/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/scans/ \
  --header 'Authorization: <Authorization>'

Returns scan results for all domains associated with the brand, newest first. A domain scanned several times appears several times; use the domain endpoints for the current state of one domain.

Paginated: page and page_size (default 50, maximum 100). See the pagination note in the API description.

Use compact=true for a short row per scan (id, domain, domain_name, risk_score, verdict, requires_human_review, https_head_request_response_code and timestamps). Without it each row embeds the scan’s history and evidence.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

UUID of the brand, as returned in the id field of the brand list.

Query Parameters

Section titled “Query Parameters”
compact
boolean

Return compact list summaries without embedded history. Use domain detail for evidence.

page
integer

A page number within the paginated result set.

page_size
integer

Number of results to return per page.

Responses

Section titled “Responses”

200

Section titled “200”
Media typeapplication/json
object
count
required
integer
next
string format: uri
nullable
previous
string format: uri
nullable
results
required
Array
Any of:

Serializer for DomainScan model.

risk_score and visual_match are answers about a brand↔domain pair, not about the domain (#954). When the caller puts a brand in the serializer context — every brand-scoped endpoint does — both are rendered from that brand’s association, so a domain two customers monitor shows each of them the verdict computed against their own brand.

Without a brand in context the shared columns are rendered unchanged, which is what the domain-global endpoints and the admin want. That column now means “the worst score across every brand monitoring this domain” rather than “the longest-monitored brand’s score” — see DomainScan.get_risk_score.

verdict/verdict_reasoning/requires_human_review are the single customer-facing verdict merged from the visual and content detectors (BrandDomainAssociation.refresh_merged_verdict) and are what the frontend should read going forward. visual_match is kept in the payload as deprecated — do not remove it — because it still governs code paths mid-migration; new consumers should read verdict instead.

object
id
required
string format: uuid
domain
required
string format: uuid
mx_records
string
nullable
a_records
string
nullable
cname_records
string
nullable
visual_match
required
boolean
nullable
verdict
required

The single customer-facing verdict, resolved for the requesting brand.

Unlike risk_score/visual_match there is no shared DomainScan column to fall back to: the merged verdict has only ever lived on the pair (BrandDomainAssociation.refresh_merged_verdict), so a caller with no brand in context — or a historical scan row, which carries no pair-specific verdict of its own — gets “unknown” rather than another brand’s answer.

string
verdict_reasoning
required
string
nullable
requires_human_review
required
boolean
visual_scan_at
required

When this brand last had the domain visually scanned.

The shared timestamp is whichever brand scanned the domain most recently, so on a shared hostname it is somebody else’s. NULL on the pair means this brand has not scanned it yet, which is exactly what the cooldown treats it as.

string format: date-time
nullable
screenshot_url

URL to the screenshot of the domain stored in Hetzner S3-compatible Object Storage

string format: uri
nullable <= 2000 characters
https_head_request_response_code
integer
nullable
certificate
string
nullable
scans_executed
integer
is_alerting_event
required

Whether this brand still has an unsent alert for the domain.

The shared flag means “somebody has one”, so after this brand’s alert was sent it would keep reporting true while another brand’s is pending.

boolean
nullable
completeness
required

A completeness of 0 means that the domain has no records set. The higher this number, the more likely the domain is actually used.

integer
risk_score
required
integer
scan_history
required

The domain’s scan timeline, most recent first.

On a domain that has only ever had single-brand history, the whole history is this brand’s own and renders untouched. Once branded rows exist, the domain has had a multi-brand period: the requesting brand then sees only its own rows, and NULL-brand rows are redacted because current association count can no longer prove which brand they belonged to.

Array<object>
object
key
additional properties
user_feedback_type
required
One of:
  • false_positive - False Positive
  • comment - Comment
string
Allowed values: false_positive comment
user_feedback_comment
required

Free text comment from the user.

string
user_feedback_by
required

User who submitted the feedback.

string format: uuid
nullable
user_feedback_at
required

When the feedback was submitted.

string format: date-time
nullable
created_at
required
string format: date-time
updated_at
required
string format: date-time
Example
{
  "count": 123,
  "next": "http://api.example.org/accounts/?page=4",
  "previous": "http://api.example.org/accounts/?page=2",
  "results": [
    {
      "user_feedback_type": "false_positive"
    }
  ]
}

401

Section titled “401”

The API key is missing, invalid, revoked or belongs to an inactive user.

Media typeapplication/json
object
detail
required
string
Examplegenerated
{
  "detail": "example"
}

404

Section titled “404”

The requested page or record does not exist or cannot be accessed.

Media typeapplication/json
object
detail
required
string
Examplegenerated
{
  "detail": "example"
}

429

Section titled “429”

Too many requests or failed authentication attempts. Try again later.

Media typeapplication/json
object
detail
required
string
Examplegenerated
{
  "detail": "example"
}