# HostedScan Documentation

> Technical documentation for HostedScan (https://hostedscan.com), an online vulnerability scanning platform with a REST API. Every guide below is linked as a plain-markdown URL (the page route plus `.md`) — prefer those over the HTML pages. The interactive API reference lives at https://docs.hostedscan.com/api/.

Agent skills for working with HostedScan are published at https://docs.hostedscan.com/.well-known/skills/index.json. If you are an agent integrating the HostedScan API, load the `hostedscan-api` skill or read the "Instructions for LLM agents" section below before writing code — do not rely on memorized API shapes.

## Getting started

- [Introduction](https://docs.hostedscan.com/index.md): Platform overview — scanners, dashboards, alerts, and reports.
- [Developer API + Webhooks](https://docs.hostedscan.com/developer-api.md): Entry point for programmatic access.
- [AI Agents guide](https://docs.hostedscan.com/ai-agents.md): How to find and use HostedScan's llms.txt files, markdown docs, and agent skills.
- [API reference](https://docs.hostedscan.com/api/): Full REST API reference (Redoc, HTML only), generated from the OpenAPI spec.

## Scanning guides

- [API scanning](https://docs.hostedscan.com/api-scanning.md): Import an OpenAPI/Swagger definition and scan every endpoint of a REST API with the ZAP scanner.
- [Agent-based scanning](https://docs.hostedscan.com/endpoint-agent-scanning.md): Install lightweight Nessus agents on laptops, desktops, and servers, including devices behind firewalls.

## Authenticated scanning

Scan behind the login page of websites and web applications with the ZAP scanner.

- [Header authentication](https://docs.hostedscan.com/authenticated-scanning/header.md): Authenticate scans with Basic Auth, bearer tokens, or other custom request headers.
- [Session cookie](https://docs.hostedscan.com/authenticated-scanning/session-cookie.md): Authenticate scans with a fixed session cookie — best for one-time scans since cookies expire.
- [Recorded login](https://docs.hostedscan.com/authenticated-scanning/recorded-login.md): Record a Selenium login sequence for playback during scans — the most flexible method, works with complex login flows.
- [Selenium troubleshooting](https://docs.hostedscan.com/authenticated-scanning/recorded-login/selenium-troubleshooting.md): Diagnose recorded-login playback failures using logs and screenshots.

## Internal network scanning

- [Internal network scanning](https://docs.hostedscan.com/internal-network-scanning.md): Run the HostedScan Internal Scanner inside your network — no open ports or tunnels required — with centralized management and reporting.
- [Install the Internal Scanner on Linux](https://docs.hostedscan.com/internal-network-scanning/install-agent-on-linux.md): Installation steps for x64 and ARM Linux systems.
- [Authenticated OpenVAS scanning](https://docs.hostedscan.com/internal-network-scanning/authenticated-scanning.md): Let the internal scanner log into systems for deeper, credentialed vulnerability checks.

## SAML single sign-on

- [SAML SSO overview](https://docs.hostedscan.com/saml-sso.md): SAML 2.0 SSO with your existing identity provider.
- [Integration steps](https://docs.hostedscan.com/saml-sso/integration-steps.md): Generic IdP setup walkthrough.
- [Microsoft Entra ID](https://docs.hostedscan.com/saml-sso/microsoft-entra.md): Step-by-step Entra ID (Azure AD) configuration.
- [Automatic provisioning](https://docs.hostedscan.com/saml-sso/automatic-provisioning.md): Create accounts automatically on first SAML login.

## Vulnerability management

- [Advanced risk acceptance rules](https://docs.hostedscan.com/vulnerability-management/advanced-rules.md): Bulk-accept expected or low-priority findings with rule-based matching to reduce noise.
- [Health score modeling](https://docs.hostedscan.com/vulnerability-management/health-score-modeling.md): How target health scores are computed from open risks.

## Instructions for LLM agents: integrating the HostedScan API

The API base URL is `https://api.hostedscan.com/v1`. Authenticate every request with the `X-HOSTEDSCAN-API-KEY` header — not an `Authorization: Bearer` header. Users create API keys in the dashboard at https://hostedscan.com/settings/api; the developer API and webhooks require a Premium or higher plan. Every endpoint requires a real API key — ask the user to set it in the `HOSTEDSCAN_API_KEY` environment variable, but never ask them to reveal the key's value.

The API reference at https://docs.hostedscan.com/api/ is the source of truth for every request and response field, enum, status code, and error. Read the section you need before writing a request rather than guessing from memory: [Scans](https://docs.hostedscan.com/api/#tag/Scans), [Scheduled Scans](https://docs.hostedscan.com/api/#tag/Scheduled-Scans), [Authenticated Scanning](https://docs.hostedscan.com/api/#tag/Authenticated-Scanning), [Risks](https://docs.hostedscan.com/api/#tag/Risks), [Targets](https://docs.hostedscan.com/api/#tag/Targets), [Reports](https://docs.hostedscan.com/api/#tag/Reports), [Upload Results From Your Own Scanners](https://docs.hostedscan.com/api/#tag/Upload-Results-From-Your-Own-Scanners), and [Webhooks](https://docs.hostedscan.com/api/#tag/Webhooks-Overview). Every list endpoint is paginated; see the `page_size` and `page_token` parameters on each one.

Scans are asynchronous: creating one returns immediately, and the scan runs for minutes to many hours depending on the scanner and target — see [How long will a scan take?](https://help.hostedscan.com/help/how-long-will-a-scan-take) and [Long running scans are normal](https://help.hostedscan.com/help/long-running-scans-are-normal). Wait for a terminal state by preferring webhooks over tight polling loops; the states, the `risks` and `results` fields, and the webhook events are described in the Scans and Webhooks sections above. In automation, create targets with `?upsert=true` so re-runs update the existing target instead of failing on duplicates (Targets section). Reports are a two-step flow, create then download, described in the Reports section.

If scans return fewer findings than expected, check that HostedScan's scanner IP addresses are allowlisted in firewalls and WAFs: [What IP addresses are used for the HostedScan vulnerability scanners?](https://help.hostedscan.com/help/what-ip-addresses-are-used-for-the-hostedscan-vulnerability-scanners)

## Help center

- [Help center home](https://help.hostedscan.com/): Knowledge base with all support articles.
- [How can I fix an unreachable target?](https://help.hostedscan.com/help/unreachable-targets): Troubleshooting targets that scans cannot reach.
- [Why did a scan return a cached result?](https://help.hostedscan.com/help/cached-scan-results): When and why recent scan results are reused.
- [What is Quality of Detection (QoD) in OpenVAS scans?](https://help.hostedscan.com/help/what-is-quality-of-detection-qod-in-openvas-scans): How OpenVAS scores detection reliability.
- [Can HostedScan run internal network scans?](https://help.hostedscan.com/help/can-hostedscan-run-internal-network-scans): Options for scanning private networks.

## Optional

- [HostedScan marketing site llms.txt](https://hostedscan.com/llms.txt): Product, pricing, and scanner overview links.
- [Pricing](https://hostedscan.com/pricing): Plans and target-based pricing.
- [Sign up](https://hostedscan.com/sign-up): Create an account — direct sign-ups (email magic link or OAuth login) start a 14-day free trial of the Premium plan.
- [Status page](https://status.hostedscan.com/): Live service status.
- Support: hello@hostedscan.com