<!-- BusyBot node reference — https://busybot.net/tools/url-scan-io/ -->

> Node: urlscan.io (`url_scan_io`) · Action · v1
> Category: Development · Credentials: urlscan.io API (`urlScanIoApi`)
> Updated: 2026-08-16

# urlscan.io

> Scan URLs and retrieve security analysis results from urlscan.io.

## Overview

urlscan.io is a free service to scan and analyse websites. It inspects the page by navigating to it like a regular user and records the activity that the page creates: JavaScript, requests, cookies, redirects, technologies, and more. This tool supports three operations on the Scan resource: Perform (submit a URL for asynchronous scanning), Get (retrieve results of a completed scan by ID), and Get Many (search scans using Elasticsearch query syntax with cursor-based pagination). Authentication is via API key passed in the API-KEY header. Base URL: https://urlscan.io/api/v1. Note that scan:perform is asynchronous — the scan takes 10-30 seconds to complete before results can be retrieved.

**Category:** Development  
**Tool Name:** `url_scan_io`  
**Version:** 1

**Appearance:** Icon: `lucide-ScanSearch` | Color: `#354A5F`

## Node Type

**Action** — processes input items and produces output

## Input / Output

| Direction | Port(s) |
|-----------|--------|
| Input | `Input` |
| Output | `Output`, `Error` |

## Credentials

This tool requires **urlscan.io API** credentials.
See the [Credentials Guide](https://busybot.net/credentials/url-scan-io-api/) for setup instructions.

### Resources

| Resource | Value |
|----------|-------|
| Scan | `scan` |

### Operations

| Operation | Value | Description |
|-----------|-------|-------------|
| Get | `get` | Get a scan result |
| Get Many | `getAll` | Search and retrieve many scans |
| Perform | `perform` | Submit a URL for scanning |

### Parameters

#### Scan: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Scan ID | `string` | Yes | — | ID of the scan to retrieve. This is the UUID returned by the Perform operation. Supports expressions like {{ $json.scanId }}. |

#### Scan: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. Supports expressions. _(shown when Return All is `false`)_ |
| Filters | `collection` | No | `{}` | Search filters to narrow down scan results. |
| — Query | `string` | No | — | Search query using Elasticsearch Query String syntax. Supported fields include: domain, ip, page.server, page.status, task.tags, date, filename, and more. See https://urlscan.io/docs/search/ for full documentation. |

#### Scan: Perform

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| URL | `string` | Yes | — | URL to scan. The scan is asynchronous and typically takes 10-30 seconds to complete. Supports expressions like {{ $json.url }}. |
| Additional Fields | `collection` | No | `{}` | Optional parameters for the scan submission. |
| — Custom Agent | `string` | No | — | User-Agent header to set for this scan. Defaults to the urlscan.io scanner agent. |
| — Override Safety | `string` | No | — | Disable reclassification of URLs with potential PII in them. |
| — Referer | `string` | No | — | HTTP referer to set for this scan. |
| — Tags | `string` | No | — | Comma-separated list of user-defined tags to add to this scan. Limited to 10 tags. |
| — Visibility | `options` | No | `private` | Scan visibility level. Private scans are only visible to you, public scans are listed in the public feed, unlisted scans are accessible via direct link. |
| | | | | Options: `private`, `public`, `unlisted` |

#### All Operations

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Max Concurrency | `number` | No | `10` | Maximum number of items to process concurrently. |

## Output Data

The urlscan.io response is **merged onto the input item JSON** — fields already on the item pass through and the result is written on top of them. Binary data is forwarded unchanged.

| Operation | Output items per input item |
|-----------|-----------------------------|
| `perform` | One item confirming the submission, including the scan's `scanId` and the API URLs to poll |
| `get` | One item carrying the full scan result (page, lists, verdicts, task, stats, and related sections) |
| `getAll` | **Fans out** — one item per matching scan |

Scan identifiers are normalised: urlscan.io reports `uuid` on a submission and `_id` on a search hit, and both are rewritten to **`scanId`** before the item is written, so one expression works everywhere. If a search matches nothing, the input item still passes through as a single output item with nothing added.

`perform` is asynchronous — it returns as soon as the scan is queued, not when it finishes. Wait 10-30 seconds, then feed `{{ $json.scanId }}` into a second node running `get`.

With Return All on, `getAll` pages through the whole result set with the search cursor; with it off, it fetches pages until it has Limit results and trims to that.

Reference the result downstream by expression, e.g. `{{ $json.scanId }}`.

## Usage Examples

- Submit a URL for security scanning on urlscan.io
- Get the full results of a completed urlscan.io scan
- Search urlscan.io for scans of a specific domain
- List recent scans matching an Elasticsearch query
- Scan a suspicious URL and check security verdicts

## Example Configuration

Submit a URL for a private scan and tag it:

```json
{
  "type": "url_scan_io",
  "parameters": {
    "resource": "scan",
    "operation": "perform",
    "url": "{{ $json.url }}",
    "additionalFields": {
      "visibility": "private",
      "tags": "security, phishing-check",
      "referer": "https://example.com"
    }
  }
}
```

Retrieve the results of a completed scan:

```json
{
  "type": "url_scan_io",
  "parameters": {
    "resource": "scan",
    "operation": "get",
    "scanId": "{{ $json.scanId }}"
  }
}
```

Search recent scans for a domain, capped at 25 results:

```json
{
  "type": "url_scan_io",
  "parameters": {
    "resource": "scan",
    "operation": "getAll",
    "returnAll": false,
    "limit": 25,
    "filters": {
      "query": "domain:{{ $json.domain }}"
    }
  }
}
```

Page through every scan matching a query:

```json
{
  "type": "url_scan_io",
  "parameters": {
    "resource": "scan",
    "operation": "getAll",
    "returnAll": true,
    "filters": {
      "query": "page.country:US AND task.tags:phishing"
    }
  }
}
```

### Error Handling

| Mode | Behavior |
|------|----------|
| **stop** | Halts workflow on first error |
| **continue** | Skips failed items, passes successful ones through |
| **errorPort** | Routes failed items to Error output port |

## Tips

Submit URLs to urlscan.io for security scanning and retrieve detailed website analysis results including network activity, technologies, and security verdicts.