CypherScan logoCypherScan by CypherNet
ScanAgentHistoryPluginsPricingDashboardAPI KeysDocs

CypherScan API

Scan files before they hit production

Use the CypherScan API to scan files for malware, exposed secrets, and risky patterns before they enter your application, CMS, or deployment pipeline.

Get your API key instantly

Create your API key and start securing upload workflows immediately.

Get your API keyTry a manual scan first

API keys remain private inside your CypherScan dashboard.

Need help integrating?

Ask questions or get setup help in the CypherNet Security Discord.

Ask on Discord
CMS Integrations

Install official CypherScan integrations for WordPress, Strapi, Payload CMS, Directus, and Ghost. Every integration uses the same secure presigned upload workflow.

Presign → Upload → Scan(objectKey) → Verdict → Allow / Block
View all integrationsWordPressStrapiPayload CMSDirectusGhost
See real detection examples

Explore realistic examples of exposed secrets, malware indicators, suspicious ZIP uploads, and risky payloads detected by CypherScan.

View examples

Secure upload API

Presigned upload workflow

CypherScan integrations no longer send uploaded files through the scan endpoint as multipart FormData. Files are uploaded directly to temporary object storage and scanned by object key.

Step 1

Request a presigned upload

Authenticate with your CypherScan API key and request a temporary upload URL.

Step 2

Upload the file

Upload the file directly to the temporary object storage URL returned by CypherScan.

Step 3

Request the scan

Submit the returned objectKey to the scan endpoint for security analysis.

Step 4

Apply the verdict

Allow or block the original CMS upload according to the CypherScan verdict.

Authentication header

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

API endpoints

New integrations should use the canonical authenticated presigned upload endpoint below. Upload the file to the returned temporary URL, then submit the returned objectKey to /api/v1/scan.

POST /api/v1/upload/presign
PUT PRESIGNED_UPLOAD_URL
POST /api/v1/scan

{
  "objectKey": "TEMPORARY_OBJECT_KEY"
}

API and plugin scans automatically enter Agent

With an active CypherScan Agent subscription, authenticated file scans through /api/v1/scanautomatically create API/plugin Agent observations. Send a stablex-cypherscan-clientvalue such as your application or plugin name so the integration is identifiable in Agent. No second Agent event request is required for normal API/plugin scans.

x-cypherscan-client: my-production-app

Canonical plugin contract

Payload, Strapi, Directus, Ghost, and custom upload integrations should use the authenticated /api/v1/scanAPI as their canonical scanner path. This keeps quota enforcement, ScanLog persistence, Threat Memory, webhooks, and the API/plugin Agent source on one implementation. WordPress keeps its dedicated Agent event route because it also identifies a WordPress site as a first-class monitored source.

The historical Payload endpoints/api/plugin/payload/scanand/api/v1/plugin/payload/scanare deprecated compatibility bridges only. New integrations must not depend on them.

Agent event sources

With an active CypherScan Agent subscription, completed scans can also be attached to S3 and CI/CD sources. These endpoints do not upload or scan the file themselves; they attach an existing CypherScan scanId to the Agent source so it can enter the attention pipeline. Event-driven artifacts are evaluated independently: a second risky artifact is not suppressed merely because it has the same security score or verdict as the previous artifact.

S3 Agent event
POST /api/v1/agent/s3/event

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "bucket": "example-bucket",
  "prefix": "uploads",
  "objectKey": "uploads/file.pdf",
  "scanId": "SCAN_ID",
  "eventName": "OBJECT_CREATED",
  "versionId": "OPTIONAL_VERSION_ID",
  "eTag": "OPTIONAL_ETAG"
}
CI/CD Agent event
POST /api/v1/agent/cicd/event

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "provider": "github-actions",
  "pipeline": "production-build",
  "runId": "RUN_ID",
  "scanId": "SCAN_ID",
  "stage": "build",
  "artifactName": "artifact.zip",
  "commitSha": "OPTIONAL_COMMIT_SHA",
  "environment": "production"
}

Agent targeted verification

Controller can authorize a bounded verification step before an Agent finding is escalated. Website findings use a fresh website re-observation. WordPress, S3, CI/CD, and API/plugin findings replay the persisted CypherScan scan evidence for the same account. GitHub findings replay the stored push evidence through the deterministic repository-risk rules. These verification steps are internal and do not perform external remediation.

Integration-specific configuration

Use the documentation page or GitHub README for your CMS integration to confirm its exact presign endpoint, environment variables, blocking behavior, and Fail Open or Fail Closed configuration.

Open integration docs

API keys remain private in your dashboard. Never expose a CypherScan API key in browser-side code or a public repository.

API Docs | CypherScan