API tokens and webhooks

Availability

The API and webhooks are part of the plans that include them (see the pricing page). If your plan does not, the page API and webhooks says so. Only owners and admins can open it.

Create a token

1. Open API and webhooks and find Tokens.
2. Enter a Token name, for example "our CRM". By default the token can only read. Tick Can add sites and start checks if the tool needs to write.
3. Click Create a token and copy the token at once: it is shown only once. If you lose it, delete it and create a new one.

Delete a token you no longer use; the list shows when each one was last used.

Call the API

The base address and a link to the OpenAPI description are in the block How to start. Send the token in the header:

curl -H "Authorization: Bearer $TOKEN" -H "Accept: application/json" https://pandus.online/api/v1/sites

With the API you can list sites, add and remove them, start a check, and fetch a check, its report and the PDF. A token may send up to 60 requests a minute.

Webhooks

A webhook tells your system when something happens, so you do not have to ask. Click Add a webhook, enter an https address and choose the events: a finished check (scan.completed) and new problems found (issues.new). A team can have up to five addresses.

Each message is signed. In the header Pandus-Signature you find a time and a HMAC-SHA256 signature made with your Signing secret. Check it before you trust the message.

Use Send a test to try the address. The Delivery log lists every attempt. A message that fails is tried again up to six times over about a day; you can also retry it by hand. An address that keeps failing is switched off after 20 failures in a row. Addresses that point to a private network are refused.