POKEXSS REST API

Queue a scan against a target URL or a raw HTTP request. Returns a job_id immediately; the scan runs in the background. Poll /api/jobs/{id} for progress and findings.

curl -X POST https://pokexss.com/api/scan \
  -H "X-API-Key: pk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://target.example.com/search?q=test",
    "modes": ["reflected", "dom", "blind"],
    "extra_params": ["ref", "lang"],
    "cookies": {"session": "abc123"}
  }'

# Save Burp request to req.txt — mark the field to fuzz with {INJECT}
curl -X POST https://pokexss.com/api/scan \
  -H "X-API-Key: pk_live_..." \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile r req.txt '{raw_request: $r, raw_use_https: true}')"

{
  "job_id": "j_8f2a91c4",
  "state": "queued",
  "modes": ["reflected", "dom", "blind"],
  "tier": "Pro",
  "raw": false,
  "quota_remaining": 197
}

Poll the job. While state is queued or running, keep polling (every 1–3 seconds is reasonable). When it flips to done, the findings array holds the result. Jobs are scoped to the calling key — you cannot read another account’s job.

curl https://pokexss.com/api/jobs/j_8f2a91c4 \
  -H "X-API-Key: pk_live_..."

{
  "id": "j_8f2a91c4",
  "url": "https://target.example.com/search?q=test",
  "modes": ["reflected", "dom"],
  "state": "done",
  "created_at": "2026-05-28T12:34:56Z",
  "finished_at": "2026-05-28T12:35:11Z",
  "findings": [
    {
      "mode": "reflected",
      "severity": "high",
      "parameter": "q",
      "payload": "\"><svg/onload=confirm(1)>",
      "context": "html_body",
      "sink": null,
      "poc_url": "https://target.example.com/search?q=%22%3E%3Csvg%2Fonload%3Dconfirm(1)%3E",
      "evidence": "alert() fired in headless replay",
      "poc_html": null
    }
  ],
  "log": ["[12:34:56] crawling...", "..."],
  "error": null
}

Returns a compact list of every scan you’ve queued — useful for surfacing recent activity in your own tooling. Older jobs auto-purge after one hour.

curl https://pokexss.com/api/jobs \
  -H "X-API-Key: pk_live_..."

# Response
[
  {
    "id": "j_8f2a91c4",
    "url": "https://target.example.com/search?q=test",
    "state": "done",
    "findings": 1,
    "created_at": "2026-05-28T12:34:56Z"
  }
]

Explicit one-shot wipe — removes the job, all findings, log entries, and any cached request bodies from memory. Privacy-first: this is the same data path the automatic one-hour purge uses.

curl -X DELETE https://pokexss.com/api/jobs/j_8f2a91c4 \
  -H "X-API-Key: pk_live_..."

# Response
{"forgotten": "j_8f2a91c4"}

Identity + tier + quota in one call. Use it to detect quota exhaustion before submitting, or to confirm a key is live.

curl https://pokexss.com/api/me -H "X-API-Key: pk_live_..."

# Response
{
  "authenticated": true,
  "email": "you@example.com",
  "tier": "pro",
  "tier_label": "Pro",
  "is_paid": true,
  "expires_at": "2026-08-26T12:34:56Z",
  "quota_used": 3,
  "quota_daily": 200
}