> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rafter.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Sites

> Monitor live applications for exposed backends, DNS misconfiguration, SEO, and accessibility issues with the Rafter CLI.

## What Are Sites?

Sites are Rafter's live-application security monitoring feature. Instead of scanning your source code (that's what `rafter run` / `rafter scan` do — see [CLI Basics](/guides/basics)), Sites continuously monitor a **live, deployed domain** for:

* Exposed backends and misconfigured services
* DNS misconfiguration
* SEO issues
* Accessibility issues

Register a site once, then re-scan it any time — after a deploy, on a schedule, or before a launch.

<Warning>
  Your API key starts with `RF` and should be kept secure. Never commit it to version control (e.g. GitHub). Use [environment variables](https://configu.com/blog/environment-variables-how-to-use-them-and-4-critical-best-practices/) instead.
</Warning>

Sites require an API key with the `read-and-scan` scope to create sites or trigger scans, or the `read` scope to list and check them. A `read-and-scan` key can do both — that scope implies `read`.

## Basic Commands

<Warning>
  Make sure you configure an environment variable or pass in your `RAFTER_API_KEY` with the flag `--api-key` or `-k` (more details below).
</Warning>

### Register a Site with `rafter sites create`

Registers a site and kicks off its first scan:

```bash theme={null}
rafter sites create https://example.com
```

### Re-Scan a Site with `rafter sites scan`

Accepts either the site's id (from `rafter sites list` or `rafter sites create`) or its URL:

```bash theme={null}
# By project id
rafter sites scan b1b2c3d4-e5f6-7890-abcd-ef1234567890

# By URL
rafter sites scan https://example.com
```

### List Your Sites with `rafter sites list`

```bash theme={null}
rafter sites list

# Paginate
rafter sites list --limit 10 --offset 10

# Include archived sites
rafter sites list --include-archived
```

### Check a Site's Status with `rafter sites get`

Returns the site's status, latest run, and a findings summary:

```bash theme={null}
rafter sites get b1b2c3d4-e5f6-7890-abcd-ef1234567890
```

## Command Reference

| Command                                                       | Description                                           |
| ------------------------------------------------------------- | ----------------------------------------------------- |
| `rafter sites create <url>`                                   | Register a site and trigger its first scan            |
| `rafter sites scan <projectId-or-url>`                        | Trigger a re-scan of an existing site                 |
| `rafter sites list [--limit] [--offset] [--include-archived]` | List your sites, paginated                            |
| `rafter sites get <id>`                                       | Get a site's status, latest run, and findings summary |

All `rafter sites` commands support:

| Flag              | Description                                                            |
| ----------------- | ---------------------------------------------------------------------- |
| `-k`, `--api-key` | Pass your API key directly instead of reading it from `RAFTER_API_KEY` |
| `-f`, `--format`  | Output format: `json` (default) or `md`                                |
| `--quiet`         | Suppress non-essential output                                          |

## Output Formats

```bash theme={null}
# JSON (default) — for automation and scripting
rafter sites get <id> --format json

# Markdown — for human-readable reports
rafter sites get <id> --format md
```

## Error Handling

The Sites CLI reads the actual `error` field from API responses rather than assuming what a status code means — this differs from `rafter run`'s error handling, which treats every 403 as a quota issue.

| Exit Code | Meaning                                 |
| --------- | --------------------------------------- |
| 0         | Success                                 |
| 1         | General error                           |
| 2         | Not found or not owned (HTTP 404)       |
| 3         | Rate limited (HTTP 429)                 |
| 4         | Wrong scope or limit reached (HTTP 403) |

## Example Workflow

```bash theme={null}
# 1. Register a site and kick off its first scan
export RAFTER_API_KEY="RFabc-your-api-key-here"
rafter sites create https://example.com

# 2. Check status until the scan completes
rafter sites get <site-id>

# 3. Re-scan after fixing an issue
rafter sites scan <site-id>

# 4. List all your monitored sites
rafter sites list
```

## API Reference

For the underlying REST API, see the [Sites endpoints](/api-reference/endpoint/static/sites/create) in the API reference.

## Next Steps

<CardGroup cols={2}>
  <Card title="CLI Basics" icon="terminal" href="/guides/basics">
    Learn the fundamentals of using the Rafter CLI.
  </Card>

  <Card title="Advanced CLI" icon="terminal" href="/guides/advanced">
    Master advanced CLI features and automation.
  </Card>

  <Card title="API Reference" icon="code" href="/api-reference/introduction">
    Build custom integrations with the REST API.
  </Card>

  <Card title="CI/CD Integration" icon="git-merge" href="/guides/ci-cd">
    Set up automated scanning in your pipelines.
  </Card>
</CardGroup>