mlab docs

API Reference

The mlab.sh REST API - authentication, endpoints, schemas and live examples.

Authentication check

GET
/api/v1/

Authorization

ApiKeyAuth
Authorization<token>

Your API key, prefixed with token . Example: Authorization: token mlab_your_api_key_here.

In: header

Response Body

application/json

application/json

curl -X GET "https://example.com/api/v1/"
{  "auth": "api_key",  "message": "Hello, Acme Corp!",  "organization": "Acme Corp",  "plan": "pro"}
{  "status": "error",  "message": "Invalid or missing API key."}

Launch a domain scan

POST
/api/v1/scan/domain

Authorization

ApiKeyAuth
Authorization<token>

Your API key, prefixed with token . Example: Authorization: token mlab_your_api_key_here.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

curl -X POST "https://example.com/api/v1/scan/domain" \  -H "Content-Type: application/json" \  -d '{    "domain": "example.com"  }'
{  "status": "success",  "message": "Domain scan has been started."}

{  "status": "error",  "message": "Provided domain is invalid."}

{  "status": "error",  "message": "Invalid or missing API key."}

Check scan status

GET
/api/v1/scan/domain/status

Authorization

ApiKeyAuth
Authorization<token>

Your API key, prefixed with token . Example: Authorization: token mlab_your_api_key_here.

In: header

Query Parameters

domain*string

The domain in question.

Response Body

application/json

application/json

curl -X GET "https://example.com/api/v1/scan/domain/status?domain=example.com"

{  "status": "pending",  "message": "Domain scan is still pending."}

{  "status": "error",  "message": "Invalid or missing API key."}

Get scan results

GET
/api/v1/scan/domain/results

Authorization

ApiKeyAuth
Authorization<token>

Your API key, prefixed with token . Example: Authorization: token mlab_your_api_key_here.

In: header

Query Parameters

domain*string

The domain in question.

Response Body

application/json

application/json

curl -X GET "https://example.com/api/v1/scan/domain/results?domain=example.com"
{  "domain": "example.com",  "scan_date": "2026-07-05 16:13:00 UTC",  "status": "completed",  "results": {    "subdomains": [      "www.example.com",      "example.org",      "example.net"    ],    "subdomains_suspicious": [      {        "keyword": "admin",        "subdomain": "admin.example.com"      }    ],    "dns": {      "resolve": [        {          "domain": "www.example.com",          "a": [            "104.20.23.154",            "172.66.147.243"          ],          "aaaa": [            "2606:4700:10::6814:179a"          ],          "cname": null        }      ],      "txt": {        "raw": [          "v=spf1 -all"        ],        "spf": "v=spf1 -all",        "dmarc": null,        "dkim": []      }    },    "ssl": [      {        "domain": "example.com",        "id": 13769145126,        "issuer_ca_id": 0,        "issuer_name": "C=US, O=DigiCert Inc, CN=DigiCert Global CA G2",        "common_name": "www.example.com",        "name_value": "www.example.com",        "entry_timestamp": "2026-02-11T21:22:07Z",        "not_before": "2026-01-15T00:00:00",        "not_after": "2027-01-15T23:59:59",        "serial_number": "",        "result_count": 1      }    ],    "files": {      "robots_txt": "User-agent: *\nDisallow:",      "security_txt": ""    }  }}
{  "status": "error",  "message": "Invalid or missing API key."}

Capture network requests

GET
/api/v1/scan/domain/loadnetworkrequest

Authorization

ApiKeyAuth
Authorization<token>

Your API key, prefixed with token . Example: Authorization: token mlab_your_api_key_here.

In: header

Query Parameters

url*string

Target URL to load. https:// is prepended if no scheme is present. Must be http or https.

Response Body

application/json

application/json

curl -X GET "https://example.com/api/v1/scan/domain/loadnetworkrequest?url=https%3A%2F%2Fexample.com"
{  "url": "https://example.com/",  "captureMs": 10000,  "count": 1,  "totalBytes": 632,  "requests": [    {      "requestId": "E51577303D719753FF104B65E699F860",      "url": "https://example.com/",      "method": "GET",      "resourceType": "Document",      "initiator": "other",      "status": 200,      "mimeType": "text/html",      "protocol": "http/1.1",      "remoteIP": "93.184.216.34",      "encodedBytes": 632,      "startMs": 0,      "endMs": 77,      "failed": false,      "errorText": null    }  ]}
{  "status": "error",  "message": "Invalid or missing API key."}

Look up an IP address or CIDR range

GET
/api/v1/scan/ip

Authorization

ApiKeyAuth
Authorization<token>

Your API key, prefixed with token . Example: Authorization: token mlab_your_api_key_here.

In: header

Query Parameters

ip*string

IPv4 or IPv6 address, or a CIDR range, to look up.

Response Body

application/json

application/json

curl -X GET "https://example.com/api/v1/scan/ip?ip=8.8.8.8"

{  "ip": "8.8.8.8",  "reserved": false,  "isp": "Google LLC",  "org": "Google Public DNS",  "as": "AS15169 Google LLC",  "city": "Ashburn",  "region": "Virginia",  "country": "United States",  "country_code": "US",  "continent": "North America",  "continent_code": "NA",  "timezone": "America/New_York",  "zip": "20149",  "lat": 39.03,  "lon": -77.5,  "currency": "USD",  "proxy": false,  "hosting": true,  "mobile": false,  "rdns": {    "ip": "8.8.8.8",    "found": true,    "names": [      "dns.google"    ],    "name": "dns.google",    "forward_confirmed": true,    "forward_addresses": [      "8.8.8.8"    ]  },  "rdap": {    "ip": "8.8.8.8",    "found": true,    "name": "GOGL",    "cidr": "8.8.8.0/24",    "country": "US",    "holder": "Google LLC",    "abuse_email": "[email protected]"  },  "tor": {    "available": true,    "ip": "8.8.8.8",    "is_tor": false  },  "ikwyd": {    "exists": true,    "confidence": "low",    "observations": 3,    "source": "antitor/peer",    "has_porno": false,    "has_child_porno": false,    "first_seen": "2026-06-25T08:50:11.591+0000",    "last_seen": "2026-07-04T13:18:21.998+0000",    "detail_url": "https://iknowwhatyoudownload.com/en/peer/?ip=8.8.8.8",    "categories": [      {        "name": "Movies",        "count": 3      }    ],    "torrents": [      {        "name": "The Dragon Prince",        "category": "Movies",        "size": 7138520122,        "start_date": "2026-07-04T13:18:21.998+0000",        "end_date": "2026-07-04T13:18:21.998+0000"      }    ]  },  "status": "success"}

{  "status": "error",  "message": "Invalid or missing API key."}

Look up a blockchain address

GET
/api/v1/scan/crypto

Authorization

ApiKeyAuth
Authorization<token>

Your API key, prefixed with token . Example: Authorization: token mlab_your_api_key_here.

In: header

Query Parameters

address*string

The blockchain address to look up.

chain?string

Chain ID. Auto-detected for EVM (0x…), BTC (1…/3…/bc1…) and TRX (T…) addresses.

Value in

  • "ETH"
  • "BSC"
  • "POLYGON"
  • "ARBITRUM"
  • "OPTIMISM"
  • "BASE"
  • "AVAX"
  • "BTC"
  • "TRX"
  • "SOL"
  • "TON"
  • "DOGE"

Response Body

application/json

application/json

curl -X GET "https://example.com/api/v1/scan/crypto?address=0x722122df12d4e14e13ac3b6895a86e84145b6967"
{  "address": "0x722122df12d4e14e13ac3b6895a86e84145b6967",  "chain": "ETH",  "chain_source": "default",  "chain_ambiguous": true,  "chain_candidates": [    "ETH",    "BSC",    "POLYGON",    "ARBITRUM",    "OPTIMISM",    "BASE",    "AVAX",    "BLAST",    "FLARE",    "LINEA",    "MANTA",    "MANTLE",    "SONIC"  ],  "address_info": {    "family": "evm",    "kind": "account",    "checksum": "absent",    "testnet": false  },  "intel": {    "type": "contract",    "categories": [      "contract",      "mixer"    ],    "labels": [      {        "name": "Tornado Cash: Proxy",        "source": "community"      }    ],    "sanctions": {      "is_sanctioned": false    },    "risk_score": 80,    "risk_level": "critical"  }}
{  "status": "error",  "message": "Invalid or missing API key."}
Empty

Look up a batch of blockchain addresses

POST
/api/v1/scan/crypto

Authorization

ApiKeyAuth
Authorization<token>

Your API key, prefixed with token . Example: Authorization: token mlab_your_api_key_here.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

curl -X POST "https://example.com/api/v1/scan/crypto" \  -H "Content-Type: application/json" \  -d '{    "addresses": [      "string"    ]  }'
{  "count": 0,  "results": [    {      "address": "string",      "chain": "BTC",      "chain_source": "detected",      "chain_ambiguous": true,      "chain_candidates": [        "string"      ],      "address_info": {        "family": "evm",        "kind": "p2pkh",        "checksum": "valid",        "testnet": true      },      "note": "string",      "intel": {}    }  ],  "invalid": [    {}  ],  "deferred": [    {}  ]}
Empty

Upload a file for analysis

POST
/upload/file

Authorization

ApiKeyAuth
Authorization<token>

Your API key, prefixed with token . Example: Authorization: token mlab_your_api_key_here.

In: header

Request Body

multipart/form-data

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/upload/file" \  -F file="string"
{  "success": true,  "filename": "0c2c2762-4c33-4b49-8771-be36675c8a58.png",  "sha256": "5f31de7b7059acf773ba2fafcd318a2f46883d58deb9b323e74dfb20453ed3d0",  "job_launched": true,  "existingData": [],  "existingJobs": []}
{  "success": false,  "error": {    "code": 400,    "message": "invalid_content_type"  }}
{  "success": false,  "error": {    "code": 413,    "message": "file_too_large"  }}
{  "success": false,  "error": {    "code": 429,    "message": "rate_limited"  }}

Get file analysis results

GET
/api/v1/scan/file/results

Authorization

ApiKeyAuth
Authorization<token>

Your API key, prefixed with token . Example: Authorization: token mlab_your_api_key_here.

In: header

Query Parameters

sha256*string

The sha256 returned by the upload endpoint.

Response Body

application/json

application/json

application/json

curl -X GET "https://example.com/api/v1/scan/file/results?sha256=5f31de7b7059acf773ba2fafcd318a2f46883d58deb9b323e74dfb20453ed3d0"
{  "status": "completed",  "jobs_total": 3,  "jobs_completed": 3,  "file": {    "sha256": "5f31de7b7059acf773ba2fafcd318a2f46883d58deb9b323e74dfb20453ed3d0",    "md5": "d41d8cd98f00b204e9800998ecf8427e",    "ssdeep": "3:tk:tk",    "filename": "0c2c2762-4c33-4b49-8771-be36675c8a58.png",    "size": 70,    "mime_type": "image/png",    "created_at": "2026-07-05T16:13:54Z"  },  "analysis": [    {      "job_name": "binwalk",      "end_date": "2026-07-05T16:14:04+00:00",      "data": "Analyzed 1 file for 111 file signatures (251 magic patterns) in 405.0 milliseconds"    },    {      "job_name": "exiftool",      "end_date": "2026-07-05T16:14:04+00:00",      "data": "File Type : PNG\nMIME Type : image/png\nImage Width : 1\nImage Height : 1"    },    {      "job_name": "strings",      "end_date": "2026-07-05T16:14:05+00:00",      "data": "IHDR\nIDAT\nIEND"    }  ]}
{  "status": "error",  "message": "Invalid or missing API key."}
{  "error": "Not found"}

Get SSL certificate history

GET
/api/v1/domain/ssl

Authorization

ApiKeyAuth
Authorization<token>

Your API key, prefixed with token . Example: Authorization: token mlab_your_api_key_here.

In: header

Query Parameters

domain*string

The domain in question.

Response Body

application/json

application/json

curl -X GET "https://example.com/api/v1/domain/ssl?domain=example.com"
[  {    "domain": "google.com",    "id": 13769145126,    "issuer_ca_id": 0,    "issuer_name": "C=US, O=Google Trust Services, CN=WR4",    "common_name": "da-twd-8.da.ext.google.com",    "name_value": "da-twd-8.da.ext.google.com",    "entry_timestamp": "2026-02-11T21:22:07Z",    "not_before": "2026-02-11T21:22:07Z",    "not_after": "2026-05-12T21:22:06Z",    "serial_number": "",    "result_count": 1  }]
{  "status": "error",  "message": "Invalid or missing API key."}

Check remaining quota

GET
/api/v1/limit/{scan_type}

Authorization

ApiKeyAuth
Authorization<token>

Your API key, prefixed with token . Example: Authorization: token mlab_your_api_key_here.

In: header

Path Parameters

scan_type*string

The scan type to check.

Value in

  • "domain"
  • "ip"
  • "file"
  • "crypto"

Response Body

application/json

application/json

curl -X GET "https://example.com/api/v1/limit/domain"
{  "scan_type": "domain",  "remaining": 98,  "total": 100}
{  "status": "error",  "message": "Invalid or missing API key."}

Custom Scan

Run advanced, recurring security scans on domains you own to detect misconfigurations, expired certificates, and exposure.

Overview

Ways to plug mlab.sh into your stack - AI assistants, automation platforms, CI/CD, your editor and your browser.