List Sites

GET /api/static/sites

List the Sites you own, paginated. Requires an API key with the read scope (a read-and-scan key also works, since read-and-scan implies read).

Request

Headers:

x-api-key (required): Your Rafter security API key, scope read or read-and-scan

Query Parameters:

Parameter	Type	Required	Description
`limit`	integer	No	Number of sites to return. Range `1`–`100`, default `25`.
`offset`	integer	No	Number of sites to skip. Default `0`.
`include_archived`	string	No	Set to `"true"` to include archived sites. Default excludes them.

Example Requests

curl -H "x-api-key: RFabc-your-api-key-here" \
  "https://rafter.so/api/static/sites?limit=25&offset=0"

# Include archived sites
curl -H "x-api-key: RFabc-your-api-key-here" \
  "https://rafter.so/api/static/sites?include_archived=true"

Response

Success (200 OK):

{
  "sites": [
    {
      "id": "b1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "registrable_domain": "example.com",
      "preferred_base_url": "https://example.com",
      "scope_type": "domain",
      "scope_value": "example.com",
      "is_archived": false,
      "created_at": "2026-07-24T00:00:00.000+00:00"
    }
  ],
  "limit": 25,
  "offset": 0,
  "has_more": false
}

Error (401 Unauthorized):

{
  "error": "Invalid or inactive API key."
}

Error (429 Too Many Requests):

{
  "error": "Rate limit exceeded",
  "message": "Too many requests. Please try again later.",
  "retryAfter": 30
}

Error (500 Internal Server Error):

{
  "error": "An unexpected error occurred."
}

Response Fields

Field	Type	Description
`sites`	array	Array of site objects (no `user_id`)
`sites[].id`	string	Unique identifier for the site
`sites[].registrable_domain`	string	The site’s registrable domain
`sites[].preferred_base_url`	string	The canonical base URL used for scanning
`sites[].scope_type`	string	How the site’s scan scope is defined
`sites[].scope_value`	string	The value for `scope_type`
`sites[].is_archived`	boolean	Whether the site has been archived
`sites[].created_at`	string	ISO 8601 timestamp when the site was created
`limit`	integer	The `limit` used for this page
`offset`	integer	The `offset` used for this page
`has_more`	boolean	Whether more sites exist beyond this page

Rate Limiting

The API implements rate limiting to ensure fair usage:

Rate Limit: 100 requests per minute per IP address
Quota: Based on your subscription plan

Examples

JavaScript

const response = await fetch('https://rafter.so/api/static/sites?limit=25&offset=0', {
  headers: { 'x-api-key': 'RFabc-your-api-key-here' }
});

const data = await response.json();
console.log(`Found ${data.sites.length} sites, more: ${data.has_more}`);

Python

import requests

response = requests.get(
    'https://rafter.so/api/static/sites',
    headers={'x-api-key': 'RFabc-your-api-key-here'},
    params={'limit': 25, 'offset': 0}
)

data = response.json()
print(f"Found {len(data['sites'])} sites, more: {data['has_more']}")

Next Steps

Use each site’s id with the Get Site endpoint to check status and findings, or with Scan Site to trigger a re-scan.

API documentation

Endpoints

GET /api/static/sites

Request

Example Requests

Response

Response Fields

Rate Limiting

Examples

JavaScript

Python

Next Steps

​GET /api/static/sites

​Request

​Example Requests

​Response

​Response Fields

​Rate Limiting

​Examples

​JavaScript

​Python

​Next Steps

GET /api/static/sites

Request

Example Requests

Response

Response Fields

Rate Limiting

Examples

JavaScript

Python

Next Steps