Domain Guardian Security Scanning API — embed scanning into any site or tool
t=, np=, psd=), deprecated tag flags (pct=, rf=, ri=), and a complianceLevel field. Accuracy fixes: scan modules are set per-tenant via enabled_modules (not per-request selectedCategories); auth uses X-API-Key (not Authorization: Bearer); self-service keys use the wgt_ prefix; tier limits are enforced per day.https://guardian.itfortress.com/functionsAll API requests use this base URL (note the /functions path). HTTPS only. Full endpoint example: https://guardian.itfortress.com/functions/widgetApi. Requests must be POST with a JSON body — calling the bare /widgetApi path without /functions returns 405 Method Not Allowed.
Two credential types are supported:
Starts with wgt_ (admin-generated) or sk_ (partner self-service). Both prefixes accepted on all /widgetApi endpoints.
X-API-Key: wgt_YOUR_KEYStarts with emb_. Safe to expose in iframe/JS embed code.
X-Embed-Token: emb_YOUR_TOKENAuthorization: Bearer — the correct header is X-API-Key./widgetApiRun a full security scan on a domain or IP address.
| Parameter | Type | Required | Description |
|---|---|---|---|
action | string | Required | Must be "scan" |
domain | string | Required | Domain name or IP address to scan |
analytics | object | Optional | Optional tracking metadata: { referrer, sourceUri, widgetId, timestamp, userAgent } |
The set of modules run on a scan is determined by your tenant's enabled_modules (configured in the Partner Portal / by an admin), not by request parameters. Subdomain scanning runs when subdomainScanning is included in enabled_modules.
| Category Key | What It Checks |
|---|---|
emailSecurity | SPF, DKIM, DMARC (RFC 9989/9990/9991 — p=, sp=, np=, t=, pct deprecation, rua=, complianceLevel, warnings[]), spam filter, Spamhaus blacklist, BIMI, TLS-RPT, MTA-STS |
dnsSecurity | DNSSEC, CAA records, SOA, IPv6, TLS/SSL certificate expiry |
webSecurity | Security headers: CSP, HSTS, X-Frame-Options, X-Content-Type, Referrer-Policy, Permissions-Policy |
seo | Title tag, meta description, Open Graph, canonical URL, robots meta |
infrastructure | Shodan: open ports, exposed services, known CVEs across all IPs |
reputation | IP/domain reputation (Talos), lookalike/typosquat domain detection |
threatIntelligence | VirusTotal, AbuseIPDB, AlienVault OTX cross-feed analysis |
censysScanning | Censys internet-facing service & certificate inventory |
certTransparency | Certificate Transparency log subdomain discovery |
securityTrails | Historical DNS records, WHOIS history |
darkwebExposure | IntelX breach databases, paste sites, Tor/Ahmia network mentions (riskPoints-based scoring) |
pentestScan | Port scanning, directory enumeration — aggressive, default OFF, requires explicit opt-in |
{
"domain": "example.com",
"scanId": "abc123xyz",
"inputType": "domain",
"timestamp": "2026-06-18T14:22:00Z",
"scores": {
"overall": 71,
"emailSecurity": 82,
"dnsSecurity": 65,
"webSecurity": 88,
"seo": 70,
"infrastructure": 60,
"reputation": 85,
"threatIntelligence": 95,
"censysScanning": 72,
"darkwebExposure": 90,
"pentestScan": null
},
"emailSecurity": {
"mx": { "status": "pass", "records": [{ "priority": 10, "server": "mail.example.com." }] },
"spf": { "status": "pass", "record": "v=spf1 include:_spf.google.com ~all" },
"dmarc": {
"status": "warning",
"record": "v=DMARC1; p=none; rua=mailto:[email protected]",
"parsed": {
"policy": "none",
"subdomainPolicy": "none",
"hasExplicitSP": false,
"isTestMode": false,
"testMode": null,
"nonExistentSubdomainPolicy": null,
"psdTag": null,
"hasPctTag": false,
"hasRfTag": false,
"hasRiTag": false,
"aggregateReports": ["mailto:[email protected]"],
"forensicReports": [],
"spfAlignment": "r",
"dkimAlignment": "r",
"complianceLevel": "monitoring",
"rfcVersion": "RFC 9989/9990/9991 (DMARCbis 2026)",
"warnings": [
{
"code": "policy_none",
"severity": "high",
"message": "p=none is Monitoring Mode (RFC 9989 §3.2). Upgrade to p=quarantine or p=reject."
},
{
"code": "no_explicit_sp",
"severity": "low",
"message": "No explicit sp= tag. Subdomains inherit p=none."
},
{
"code": "no_np_tag",
"severity": "low",
"message": "No np= tag (RFC 9989). Consider adding np=reject."
}
]
}
},
"dkim": { "status": "pass", "selectors": [{ "selector": "google" }] },
"spamFilter": { "status": "pass", "message": "Google Workspace detected", "hasEnterpriseFilter": false },
"bimi": { "status": "warning", "message": "No BIMI record found (optional)" },
"tlsrpt": { "status": "warning", "message": "No TLS-RPT record (optional)" },
"mtasts": { "status": "warning", "message": "No MTA-STS policy (optional)" },
"spamhausBlacklist": { "status": "pass", "listed": false, "checkedIPs": ["93.184.216.34"] }
},
"dnsSecurity": {
"dnssec": { "status": "fail", "enabled": false },
"caa": { "status": "pass", "count": 2 },
"tlsCert": { "status": "pass", "daysUntilExpiry": 87, "issuerOrganization": "Let's Encrypt" }
},
"discoveredAssets": {
"subdomains": ["mail.example.com", "www.example.com"],
"ips": ["93.184.216.34"],
"totalSubdomains": 2,
"totalIPs": 1
}
}const axios = require('axios');
async function scanDomain(domain, apiKey) {
// Which modules run is controlled by your tenant's enabled_modules
// configuration (set in the Partner Portal) — not by request params.
const res = await axios.post('https://guardian.itfortress.com/functions/widgetApi', {
action: 'scan',
domain
}, {
headers: {
'X-API-Key': apiKey,
'Content-Type': 'application/json'
}
});
const { scores, scanId, emailSecurity } = res.data;
console.log('Overall score:', scores.overall);
// DMARC RFC 9989 fields:
const dmarc = emailSecurity?.dmarc?.parsed;
console.log('DMARC compliance level:', dmarc?.complianceLevel);
console.log('DMARC RFC version:', dmarc?.rfcVersion);
console.log('DMARC test mode (t=):', dmarc?.isTestMode);
return res.data;
}
scanDomain('example.com', 'wgt_YOUR_API_KEY');Need help? Contact [email protected] or visit your Partner Portal.