Create Site

POST /api/static/sites

Register a new Site for live-application monitoring and trigger its first scan. Sites are distinct from repository scans (/api/static/scan) — instead of scanning source code, Sites continuously monitor a live domain for exposed backends, DNS misconfiguration, SEO issues, and accessibility problems. Requires an API key with the read-and-scan scope.

Request

Headers:

x-api-key (required): Your Rafter security API key, scope read-and-scan
Content-Type: application/json

Body:

{
  "url": "https://example.com"
}

Fields:

Field	Type	Required	Description
`url`	string	Yes	The URL of the site to monitor

Example Request

curl -X POST \
  -H "Content-Type: application/json" \
  -H "x-api-key: RFabc-your-api-key-here" \
  -d '{"url": "https://example.com"}' \
  https://rafter.so/api/static/sites

Response

Success (200 OK — new site):

{
  "site": {
    "id": "b1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "user_id": "u_abc123",
    "registrable_domain": "example.com",
    "preferred_base_url": "https://example.com",
    "scope_type": "domain",
    "scope_value": "example.com",
    "is_archived": false,
    "github_repos": [],
    "created_at": "2026-07-24T00:00:00.000+00:00",
    "updated_at": "2026-07-24T00:00:00.000+00:00"
  },
  "run": {
    "id": "r_1a2b3c4d",
    "project_id": "b1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "user_id": "u_abc123",
    "status": "running",
    "started_at": "2026-07-24T00:00:00.000+00:00",
    "finished_at": null,
    "progress_total": 0,
    "progress_done": 0,
    "created_at": "2026-07-24T00:00:00.000+00:00",
    "updated_at": "2026-07-24T00:00:00.000+00:00"
  },
  "created": true
}

If the site was created but its initial scan failed to start, the response includes a scan_error string alongside "created": true and "run": null.

Success (200 OK — site already existed):

{
  "site": {
    "id": "b1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "is_archived": false
  },
  "run": null,
  "created": false
}

Error (400 Bad Request — missing, invalid, or blocked URL):

{
  "error": "Invalid or blocked URL."
}

Error (401 Unauthorized):

{
  "error": "Invalid or inactive API key."
}

Error (403 Forbidden — wrong scope):

{
  "error": "API key does not have read-and-scan scope."
}

Error (403 Forbidden — plan or site limit reached):

{
  "error": "You have reached your site limit for this billing period."
}

Error (429 Too Many Requests):

{
  "error": "Rate limit exceeded",
  "message": "Too many requests. Please try again later.",
  "retryAfter": 30
}

Error (500 Internal Server Error):

{
  "error": "An unexpected error occurred."
}

Response Fields

Field	Type	Description
`site.id`	string	Unique identifier for the site (project id)
`site.user_id`	string	Owning user’s id (omitted when `created` is `false`)
`site.registrable_domain`	string	The site’s registrable domain
`site.preferred_base_url`	string	The canonical base URL used for scanning
`site.scope_type`	string	How the site’s scan scope is defined
`site.scope_value`	string	The value for `scope_type`
`site.is_archived`	boolean	Whether the site has been archived
`site.github_repos`	array	Linked GitHub repos for this site (empty until configured)
`site.created_at`	string	ISO 8601 timestamp when the site was created
`site.updated_at`	string	ISO 8601 timestamp when the site was last updated
`run`	object \| null	The first scan run that was kicked off, or `null` if the site already existed or the scan failed to start
`run.status`	string	The run’s status. The initial run created here starts as `running` (its steps are enqueued synchronously); it can also be `queued`, `succeeded`, or `failed` at other points in its lifecycle
`run.updated_at`	string	ISO 8601 timestamp when the run was last updated
`created`	boolean	`true` if this call created a new site, `false` if the site already existed
`scan_error`	string	Present only when `created` is `true` but the initial scan failed to start

Rate Limiting

The API implements rate limiting to ensure fair usage:

Rate Limit: 100 requests per minute per IP address
Quota: Based on your subscription plan

Examples

JavaScript

const response = await fetch('https://rafter.so/api/static/sites', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-api-key': 'RFabc-your-api-key-here'
  },
  body: JSON.stringify({ url: 'https://example.com' })
});

const data = await response.json();
console.log(`Site ID: ${data.site.id}`);

Python

import requests

response = requests.post(
    'https://rafter.so/api/static/sites',
    headers={
        'Content-Type': 'application/json',
        'x-api-key': 'RFabc-your-api-key-here'
    },
    json={'url': 'https://example.com'}
)

data = response.json()
print(f"Site ID: {data['site']['id']}")

Next Steps

After creating a site, you can:

Check status and findings using the site id with the Get Site endpoint
Trigger a re-scan later with the Scan Site endpoint
List all your sites with the List Sites endpoint

API documentation

Endpoints

POST /api/static/sites

Request

Example Request

Response

Response Fields

Rate Limiting

Examples

JavaScript

Python

Next Steps

​POST /api/static/sites

​Request

​Example Request

​Response

​Response Fields

​Rate Limiting

​Examples

​JavaScript

​Python

​Next Steps

POST /api/static/sites

Request

Example Request

Response

Response Fields

Rate Limiting

Examples

JavaScript

Python

Next Steps