urlscan.io

Scan URLs and retrieve security analysis results from urlscan.io.

Overview

urlscan.io is a free service to scan and analyse websites. It inspects the page by navigating to it like a regular user and records the activity that the page creates: JavaScript, requests, cookies, redirects, technologies, and more. This tool supports three operations on the Scan resource: Perform (submit a URL for asynchronous scanning), Get (retrieve results of a completed scan by ID), and Get Many (search scans using Elasticsearch query syntax with cursor-based pagination). Authentication is via API key passed in the API-KEY header. Base URL: https://urlscan.io/api/v1. Note that scan:perform is asynchronous — the scan takes 10-30 seconds to complete before results can be retrieved.

Category: Development
Tool Name: url_scan_io
Version: 1

Appearance: Icon: lucide-ScanSearch | Color: #354A5F

Node Type

Action — processes input items and produces output

Input / Output

Direction	Port(s)
Input	Input
Output	Output, Error

Credentials

This tool requires urlscan.io API credentials. See the Credentials Guide for setup instructions.

Resources

Resource	Value
Scan	scan

Operations

Operation	Value	Description
Get	get	Get a scan result
Get Many	getAll	Search and retrieve many scans
Perform	perform	Submit a URL for scanning

Parameters

Scan: Get

Parameter	Type	Required	Default	Description
Scan ID	string	Yes	—	ID of the scan to retrieve. This is the UUID returned by the Perform operation. Supports expressions like {{ $json.scanId }}.

Scan: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. Supports expressions. (shown when Return All is false)
Filters	collection	No	{}	Search filters to narrow down scan results.
— Query	string	No	—	Search query using Elasticsearch Query String syntax. Supported fields include: domain, ip, page.server, page.status, task.tags, date, filename, and more. See https://urlscan.io/docs/search/ for full documentation.

Scan: Perform

Parameter	Type	Required	Default	Description
URL	string	Yes	—	URL to scan. The scan is asynchronous and typically takes 10-30 seconds to complete. Supports expressions like {{ $json.url }}.
Additional Fields	collection	No	{}	Optional parameters for the scan submission.
— Custom Agent	string	No	—	User-Agent header to set for this scan. Defaults to the urlscan.io scanner agent.
— Override Safety	string	No	—	Disable reclassification of URLs with potential PII in them.
— Referer	string	No	—	HTTP referer to set for this scan.
— Tags	string	No	—	Comma-separated list of user-defined tags to add to this scan. Limited to 10 tags.
— Visibility	options	No	private	Scan visibility level. Private scans are only visible to you, public scans are listed in the public feed, unlisted scans are accessible via direct link.
				Options: private, public, unlisted

All Operations

Parameter	Type	Required	Default	Description
Max Concurrency	number	No	10	Maximum number of items to process concurrently.

Output Data

The urlscan.io response is merged onto the input item JSON — fields already on the item pass through and the result is written on top of them. Binary data is forwarded unchanged.

Operation	Output items per input item
perform	One item confirming the submission, including the scan’s scanId and the API URLs to poll
get	One item carrying the full scan result (page, lists, verdicts, task, stats, and related sections)
getAll	Fans out — one item per matching scan

Scan identifiers are normalised: urlscan.io reports uuid on a submission and _id on a search hit, and both are rewritten to scanId before the item is written, so one expression works everywhere. If a search matches nothing, the input item still passes through as a single output item with nothing added.

perform is asynchronous — it returns as soon as the scan is queued, not when it finishes. Wait 10-30 seconds, then feed {{ $json.scanId }} into a second node running get.

With Return All on, getAll pages through the whole result set with the search cursor; with it off, it fetches pages until it has Limit results and trims to that.

Reference the result downstream by expression, e.g. {{ $json.scanId }}.

Usage Examples

• Submit a URL for security scanning on urlscan.io
• Get the full results of a completed urlscan.io scan
• Search urlscan.io for scans of a specific domain
• List recent scans matching an Elasticsearch query
• Scan a suspicious URL and check security verdicts

Example Configuration

Submit a URL for a private scan and tag it:

{
  "type": "url_scan_io",
  "parameters": {
    "resource": "scan",
    "operation": "perform",
    "url": "{{ $json.url }}",
    "additionalFields": {
      "visibility": "private",
      "tags": "security, phishing-check",
      "referer": "https://example.com"
    }
  }
}

Retrieve the results of a completed scan:

{
  "type": "url_scan_io",
  "parameters": {
    "resource": "scan",
    "operation": "get",
    "scanId": "{{ $json.scanId }}"
  }
}

Search recent scans for a domain, capped at 25 results:

{
  "type": "url_scan_io",
  "parameters": {
    "resource": "scan",
    "operation": "getAll",
    "returnAll": false,
    "limit": 25,
    "filters": {
      "query": "domain:{{ $json.domain }}"
    }
  }
}

Page through every scan matching a query:

{
  "type": "url_scan_io",
  "parameters": {
    "resource": "scan",
    "operation": "getAll",
    "returnAll": true,
    "filters": {
      "query": "page.country:US AND task.tags:phishing"
    }
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

Submit URLs to urlscan.io for security scanning and retrieve detailed website analysis results including network activity, technologies, and security verdicts.