RustScan API

Validate Token Public Key

POST https://rustscan.com/app/api-validate-solana-token/

Request Body

Name	Type	Description
token	string	Token Public Key

CURL Example

Request

curl 'https://rustscan.com/app/api-validate-solana-token/' \
  -H 'content-type: application/json' \
  --data-raw '{"token":"rndrizKT3MK1iimdxRdWabcF7Zg7AR5T4nud4EkHBof"}'

Response

Scan Token

GET https://rustscan.com/app/api/v1/solana-scan/<token_public_key>

Note: An API token is required for this endpoint. Without a token, the API has strict rate limits. To obtain a token, contact the team at [email protected].

CURL Example

Request

curl 'https://rustscan.com/app/api/v1/solana-scan/rndrizKT3MK1iimdxRdWabcF7Zg7AR5T4nud4EkHBof' \
  -H 'accept: application/json, text/plain, */*' \
  -H 'accept-language: en-US,en;q=0.8' \
  -H 'cache-control: no-cache' \
  -H 'Authorization: Token {{token}}'

Response

Get Scan Details

POST https://rustscan.com/app/api-get-solana-scan-details/

Request Body

Name	Type	Description
scan_id	string	Id of the scan

CURL Example

Request

curl 'https://rustscan.com/app/api-get-solana-scan-details/' \
  -H 'content-type: application/json' \
  --data-raw '{"scan_id":"944a308e28b26787"}'

Response

RustScan GitHub Scan APIs

This section documents the REST and WebSocket interfaces for running RustScan security scans on code repositories (e.g. GitHub projects) and retrieving detailed results and reports.

REST API - Get Scan Details (GitHub Scans)

POST https://rustscan.com/app/api-get-rustscan-details/

Fetch detailed results for a previously completed RustScan scan by its scan_id.

Request Details

• Method: POST

• URL: https://rustscan.com/app/api-get-rustscan-details/

• Content-Type: application/json

• Accept: application/json

• Authentication: None required

Request Body

Name	Type	Description
scan_id	string	Id of the scan

CURL Example

Request

curl 'https://rustscan.com/app/api-get-rustscan-details/' \
  -H 'content-type: application/json' \
  --data-raw '{"scan_id":"03c30b7a373a4d7c"}'

Response

Response Fields

• scan_id: The scan identifier.

• project_url: GitHub or source URL of the scanned project.

• project_name: Name of the project.

• scan_type: Type of scan (e.g. github).

• is_zip_scan: Whether the scan was from a zip upload.

• quick_file_scan_details: Array of detector findings with severity and confidence.

• findings_count: Total number of findings.

• multi_file_scan_summary: Aggregated scan statistics, including severity distribution, scores, lines analyzed, and time taken.

• score_v2: Numeric security score.

• score_rating: Human‑readable rating (e.g. Poor, Fair, Good).

• project_id: Unique project identifier.

WebSocket API (GitHub Scans)

All real-time interactions use a persistent WebSocket connection. Messages are JSON objects with an action and a payload.

Initiate a Project Scan

Send this message to start a new scan on a public GitHub project.

Request (Client → Server)

{
  "action": "message",
  "payload": {
    "type": "public_project_scan_initiate",
    "body": {
      "project_url": "https://github.com/alloy-rs/alloy",
      "project_branch": "main",
      "project_name": "alloy",
      "project_commit": "",
      "project_type": "new",
      "project_visibility": "public",
      "scanner_type": "rustscan",
      "skip_file_paths": [
        ".config/",
        ".github/",
        "CHANGELOG.md",
        "Cargo.toml",
        "README.md"
        // ... additional paths to exclude
      ]
    },
    "cf-turnstile-response": "<cloudflare_token>"
  }
}

Body Fields

• project_url: Full GitHub URL of the repository.

• project_branch: Branch to scan (e.g. main).

• project_name: Display name for the project.

• project_commit: Specific commit hash (empty = latest).

• project_type: new or existing.

• project_visibility: public or private.

• scanner_type: Scanner to use — rustscan.

• skip_file_paths: Array of file/folder paths to exclude from scan.

• cf-turnstile-response: Cloudflare Turnstile CAPTCHA token.

Scan Status Update (Server → Client)

{
  "type": "quick_scan_status",
  "request_uuid": "7bab55cf1c82d4d451ed3f8583dc8bf4",
  "payload": {
    "scan_id": "af01d98488a4904c",
    "scan_status": "scan_done",
    "project_id": null,
    "scan_details": {
      "is_latest_scan": false,
      "webhook_enabled": false,
      "multi_file_scan_summary": {
        "issue_severity_distribution": {
          "critical": 0,
          "high": 1,
          "informational": 0,
          "low": 24,
          "medium": 6
        },
        "scan_time_taken": 7876,
        "score_v2": "12.00",
        "lines_analyzed_count": 102662,
        "threat_score": null
      },
      "project_url": "https://github.com/alloy-rs/alloy",
      "scan_id": "af01d98488a4904c",
      "scan_status": "scan_done",
      "quick_file_scan_details": [
        {
          "detector_id": "solana.account_reinitialization",
          "title": "Initialization without reinit check",
          "severity": "high",
          "confidence": "high"
        }
        // ... more findings
      ]
    }
  },
  "event_timestamp": "2026-02-18 10:53:32.352165"
}

Status Values

• scan_done: Scan completed successfully.

• scan_in_progress: Scan is currently running.

• scan_failed: Scan encountered an error (check scan_status_err_msg).

Generate a Report

Once a scan is complete and you have a project_id and scan_id, send this message to generate a downloadable report.

Request (Client → Server)

{
  "action": "message",
  "payload": {
    "type": "generate_report",
    "body": {
      "project_id": "bce56d35c587ec8e7555da589fb0a6ab",
      "scan_id": "38caa091805fcac6",
      "report_id": null,
      "scanner_type": "rustscan",
      "connection_id": "Y-UrzdzdCYcCIVw="
    }
  }
}

Body Fields

• project_id: Project ID from the scan details.

• scan_id: Scan ID to generate report for.

• report_id: null for new report; pass existing ID to regenerate.

• scanner_type: rustscan.

• connection_id: Current WebSocket connection ID.

Report Generation Status (Server → Client)

{
  "type": "report_generation_status",
  "request_uuid": "",
  "payload": {
    "scan_id": "38caa091805fcac6",
    "project_id": "bce56d35c587ec8e7555da589fb0a6ab",
    "report_status": "report_generated",
    "report_id": "6676b922481f5626"
  },
  "event_timestamp": "2026-02-18 10:57:28.984198"
}

Response Fields

• report_status: report_generated on success.

• report_id: Unique ID of the generated report.

• scan_id: Scan ID the report was generated for.

• project_id: Project ID the report belongs to.

• event_timestamp: UTC timestamp of the event.