Can I use urlscan.io as a CLI?

Yes. KosmoKrator exposes a urlscan.io CLI through kosmo integrations:call and the provider shortcut command. Commands can return JSON for scripts, CI, and coding agents.

Can I expose urlscan.io through MCP?

Yes. The KosmoKrator MCP gateway can expose selected urlscan.io tools to clients such as Claude Code, Cursor, Codex, and other MCP-compatible tools.

Where are urlscan.io credentials stored?

urlscan.io credentials are configured in KosmoKrator's local integration settings and reused by CLI, Lua, and MCP gateway surfaces.

Can I deny write access for urlscan.io MCP tools?

Yes. Start the gateway with --write=deny for read-only clients, or use ask/allow only for trusted workspaces.

data

urlscan.io CLI for AI Agents

Use the urlscan.io CLI from KosmoKrator to call urlscan.io tools headlessly, return JSON, inspect schemas, and automate workflows from coding agents, scripts, and CI.

urlscan.io CLI Setup

urlscan.io can be configured headlessly with `kosmokrator integrations:configure urlscan`.

Install, configure, and verify

# Install KosmoKrator first if it is not available on PATH.
curl -fsSL https://raw.githubusercontent.com/OpenCompanyApp/kosmokrator/main/install.sh | bash

# Configure and verify this integration.
kosmokrator integrations:configure urlscan --enable --read allow --write ask --json
kosmokrator integrations:doctor urlscan --json
kosmokrator integrations:status --json

Credentials

Authentication type: API key api_key. Configure credentials once, then reuse the same stored profile from scripts, coding CLIs, Lua, and MCP.

No credentials are required.

Command Patterns

The generic command is stable across every integration. The provider shortcut is shorter for humans.

Generic CLI call

kosmo integrations:call urlscan.urlscan_submit_scan '{"body":"example_body"}' --json

Provider shortcut

kosmo integrations:urlscan urlscan_submit_scan '{"body":"example_body"}' --json

Discovery

These commands return structured output for coding agents that need to inspect capabilities before choosing a function.

Discovery commands

kosmo integrations:docs urlscan --json
kosmo integrations:docs urlscan.urlscan_submit_scan --json
kosmo integrations:schema urlscan.urlscan_submit_scan --json
kosmo integrations:search "urlscan.io" --json
kosmo integrations:list --json

Automation Contexts

The same configured command surface works in these environments. The command does not change unless the host wrapper, credentials, or permissions change.

CI Run integration calls from CI jobs with JSON output, explicit credentials, and predictable exit status. Cron Jobs Schedule repeatable integration workflows from cron while keeping credentials in KosmoKrator config. Shell Scripts Call integration functions from shell scripts with stable JSON input and output. Headless Automation Use KosmoKrator as a non-interactive integration runtime for local automations and wrappers. Coding Agents Let coding agents discover schemas and execute integration functions through CLI commands or MCP.

CLI Functions

Every function below can be called headlessly. Commands are highlighted, copyable, and scroll horizontally when payloads are long.

`urlscan.urlscan_submit_scan`

Scan Official urlscan.io endpoint: POST /api/v1/scan.

Write write

Parameters: body

Generic call

kosmo integrations:call urlscan.urlscan_submit_scan '{"body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_submit_scan '{"body":"example_body"}' --json

`urlscan.urlscan_search_datasource`

Search Official urlscan.io endpoint: GET /api/v1/search.

Read read

Parameters: q, size, search_after, datasource, collapse

Generic call

kosmo integrations:call urlscan.urlscan_search_datasource '{"q":"example_q","size":1,"search_after":"example_search_after","datasource":"example_datasource","collapse":"example_collapse"}' --json

Shortcut

kosmo integrations:urlscan urlscan_search_datasource '{"q":"example_q","size":1,"search_after":"example_search_after","datasource":"example_datasource","collapse":"example_collapse"}' --json

`urlscan.urlscan_get_result`

Result Official urlscan.io endpoint: GET /api/v1/result/{scanId}/.

Read read

Parameters: scan_id

Generic call

kosmo integrations:call urlscan.urlscan_get_result '{"scan_id":"example_scan_id"}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_result '{"scan_id":"example_scan_id"}' --json

`urlscan.urlscan_get_screenshot`

Screenshot Official urlscan.io endpoint: GET /screenshots/{scanId}.png.

Read read

Parameters: scan_id

Generic call

kosmo integrations:call urlscan.urlscan_get_screenshot '{"scan_id":"example_scan_id"}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_screenshot '{"scan_id":"example_scan_id"}' --json

`urlscan.urlscan_get_dom`

DOM Official urlscan.io endpoint: GET /dom/{scanId}/.

Read read

Parameters: scan_id

Generic call

kosmo integrations:call urlscan.urlscan_get_dom '{"scan_id":"example_scan_id"}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_dom '{"scan_id":"example_scan_id"}' --json

`urlscan.urlscan_get_response`

Response Official urlscan.io endpoint: GET /responses/{fileHash}/.

Read read

Parameters: file_hash

Generic call

kosmo integrations:call urlscan.urlscan_get_response '{"file_hash":"example_file_hash"}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_response '{"file_hash":"example_file_hash"}' --json

`urlscan.urlscan_update_result_visibility`

Update Result Visibility Official urlscan.io endpoint: PUT /api/v1/result/{scanId}/visibility/.

Write write

Parameters: scan_id, body

Generic call

kosmo integrations:call urlscan.urlscan_update_result_visibility '{"scan_id":"example_scan_id","body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_update_result_visibility '{"scan_id":"example_scan_id","body":"example_body"}' --json

`urlscan.urlscan_delete_result_visibility`

Reset to original visibility Official urlscan.io endpoint: DELETE /api/v1/result/{scanId}/visibility/.

Write write

Parameters: scan_id

Generic call

kosmo integrations:call urlscan.urlscan_delete_result_visibility '{"scan_id":"example_scan_id"}' --json

Shortcut

kosmo integrations:urlscan urlscan_delete_result_visibility '{"scan_id":"example_scan_id"}' --json

`urlscan.urlscan_get_available_countries`

Available Countries Official urlscan.io endpoint: GET /api/v1/availableCountries.

Read read

Parameters: none

Generic call

kosmo integrations:call urlscan.urlscan_get_available_countries '{}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_available_countries '{}' --json

`urlscan.urlscan_get_user_agents`

Available User Agents Official urlscan.io endpoint: GET /api/v1/userAgents.

Read read

Parameters: none

Generic call

kosmo integrations:call urlscan.urlscan_get_user_agents '{}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_user_agents '{}' --json

`urlscan.urlscan_get_quotas`

API Quotas Official urlscan.io endpoint: GET /api/v1/quotas.

Read read

Parameters: none

Generic call

kosmo integrations:call urlscan.urlscan_get_quotas '{}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_quotas '{}' --json

`urlscan.urlscan_get_available_brands`

Available Brands Official urlscan.io endpoint: GET /api/v1/pro/availableBrands.

Read read

Parameters: none

Generic call

kosmo integrations:call urlscan.urlscan_get_available_brands '{}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_available_brands '{}' --json

`urlscan.urlscan_get_brand_summary`

Brands Official urlscan.io endpoint: GET /api/v1/pro/brands.

Read read

Parameters: none

Generic call

kosmo integrations:call urlscan.urlscan_get_brand_summary '{}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_brand_summary '{}' --json

`urlscan.urlscan_get_phishfeed`

Phishfeed Official urlscan.io endpoint: GET /api/v1/pro/phishfeed.

Read read

Parameters: q, limit, format

Generic call

kosmo integrations:call urlscan.urlscan_get_phishfeed '{"q":"example_q","limit":1,"format":"example_format"}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_phishfeed '{"q":"example_q","limit":1,"format":"example_format"}' --json

`urlscan.urlscan_get_livescan_scanners`

Live Scanners Official urlscan.io endpoint: GET /api/v1/livescan/scanners/.

Read read

Parameters: none

Generic call

kosmo integrations:call urlscan.urlscan_get_livescan_scanners '{}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_livescan_scanners '{}' --json

`urlscan.urlscan_create_livescan_task`

Non-Blocking Trigger Live Scan Official urlscan.io endpoint: POST /api/v1/livescan/{scannerId}/task/.

Write write

Parameters: scanner_id, body

Generic call

kosmo integrations:call urlscan.urlscan_create_livescan_task '{"scanner_id":"example_scanner_id","body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_create_livescan_task '{"scanner_id":"example_scanner_id","body":"example_body"}' --json

`urlscan.urlscan_create_livescan_scan`

Trigger Live Scan Official urlscan.io endpoint: POST /api/v1/livescan/{scannerId}/scan/.

Write write

Parameters: scanner_id, body

Generic call

kosmo integrations:call urlscan.urlscan_create_livescan_scan '{"scanner_id":"example_scanner_id","body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_create_livescan_scan '{"scanner_id":"example_scanner_id","body":"example_body"}' --json

`urlscan.urlscan_get_livescan_resource`

Live Scan Get Resource Official urlscan.io endpoint: GET /api/v1/livescan/{scannerId}/{resourceType}/{resourceId}.

Read read

Parameters: scanner_id, resource_type, resource_id

Generic call

kosmo integrations:call urlscan.urlscan_get_livescan_resource '{"scanner_id":"example_scanner_id","resource_type":"example_resource_type","resource_id":"example_resource_id"}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_livescan_resource '{"scanner_id":"example_scanner_id","resource_type":"example_resource_type","resource_id":"example_resource_id"}' --json

`urlscan.urlscan_store_livescan_result`

Store Live Scan Result Official urlscan.io endpoint: PUT /api/v1/livescan/{scannerId}/{scanId}/.

Read read

Parameters: scanner_id, scan_id, body

Generic call

kosmo integrations:call urlscan.urlscan_store_livescan_result '{"scanner_id":"example_scanner_id","scan_id":"example_scan_id","body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_store_livescan_result '{"scanner_id":"example_scanner_id","scan_id":"example_scan_id","body":"example_body"}' --json

`urlscan.urlscan_discard_livescan_result`

Purge Live Scan Result Official urlscan.io endpoint: DELETE /api/v1/livescan/{scannerId}/{scanId}/.

Read read

Parameters: scanner_id, scan_id

Generic call

kosmo integrations:call urlscan.urlscan_discard_livescan_result '{"scanner_id":"example_scanner_id","scan_id":"example_scan_id"}' --json

Shortcut

kosmo integrations:urlscan urlscan_discard_livescan_result '{"scanner_id":"example_scanner_id","scan_id":"example_scan_id"}' --json

`urlscan.urlscan_get_hostname_history`

Hostname History Official urlscan.io endpoint: GET /api/v1/hostname/{hostname}.

Read read

Parameters: hostname, limit, page_state

Generic call

kosmo integrations:call urlscan.urlscan_get_hostname_history '{"hostname":"example_hostname","limit":1,"page_state":"example_page_state"}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_hostname_history '{"hostname":"example_hostname","limit":1,"page_state":"example_page_state"}' --json

`urlscan.urlscan_get_pro_username`

User Information Official urlscan.io endpoint: GET /api/v1/pro/username.

Read read

Parameters: none

Generic call

kosmo integrations:call urlscan.urlscan_get_pro_username '{}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_pro_username '{}' --json

`urlscan.urlscan_get_similar_results`

Structure Search Official urlscan.io endpoint: GET /api/v1/pro/result/{scanId}/similar/.

Read read

Parameters: q, size, search_after, scan_id

Generic call

kosmo integrations:call urlscan.urlscan_get_similar_results '{"q":"example_q","size":1,"search_after":"example_search_after","scan_id":"example_scan_id"}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_similar_results '{"q":"example_q","size":1,"search_after":"example_search_after","scan_id":"example_scan_id"}' --json

`urlscan.urlscan_list_saved_searches`

Saved Searches Official urlscan.io endpoint: GET /api/v1/user/searches/.

Read read

Parameters: none

Generic call

kosmo integrations:call urlscan.urlscan_list_saved_searches '{}' --json

Shortcut

kosmo integrations:urlscan urlscan_list_saved_searches '{}' --json

`urlscan.urlscan_create_saved_search`

Create Saved Search Official urlscan.io endpoint: POST /api/v1/user/searches/.

Write write

Parameters: body

Generic call

kosmo integrations:call urlscan.urlscan_create_saved_search '{"body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_create_saved_search '{"body":"example_body"}' --json

`urlscan.urlscan_update_saved_search`

Update Saved Search Official urlscan.io endpoint: PUT /api/v1/user/searches/{searchId}/.

Write write

Parameters: search_id, body

Generic call

kosmo integrations:call urlscan.urlscan_update_saved_search '{"search_id":"example_search_id","body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_update_saved_search '{"search_id":"example_search_id","body":"example_body"}' --json

`urlscan.urlscan_delete_saved_search`

Delete Saved Search Official urlscan.io endpoint: DELETE /api/v1/user/searches/{searchId}/.

Write write

Parameters: search_id

Generic call

kosmo integrations:call urlscan.urlscan_delete_saved_search '{"search_id":"example_search_id"}' --json

Shortcut

kosmo integrations:urlscan urlscan_delete_saved_search '{"search_id":"example_search_id"}' --json

`urlscan.urlscan_get_saved_search_results`

Saved Search Search Results Official urlscan.io endpoint: GET /api/v1/user/searches/{searchId}/results/.

Read read

Parameters: search_id

Generic call

kosmo integrations:call urlscan.urlscan_get_saved_search_results '{"search_id":"example_search_id"}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_saved_search_results '{"search_id":"example_search_id"}' --json

`urlscan.urlscan_list_subscriptions`

Subscriptions Official urlscan.io endpoint: GET /api/v1/user/subscriptions/.

Read read

Parameters: none

Generic call

kosmo integrations:call urlscan.urlscan_list_subscriptions '{}' --json

Shortcut

kosmo integrations:urlscan urlscan_list_subscriptions '{}' --json

`urlscan.urlscan_create_subscription`

Create Subscription Official urlscan.io endpoint: POST /api/v1/user/subscriptions/.

Write write

Parameters: body

Generic call

kosmo integrations:call urlscan.urlscan_create_subscription '{"body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_create_subscription '{"body":"example_body"}' --json

`urlscan.urlscan_update_subscription`

Update Subscription Official urlscan.io endpoint: PUT /api/v1/user/subscriptions/{subscriptionId}/.

Write write

Parameters: subscription_id, body

Generic call

kosmo integrations:call urlscan.urlscan_update_subscription '{"subscription_id":"example_subscription_id","body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_update_subscription '{"subscription_id":"example_subscription_id","body":"example_body"}' --json

`urlscan.urlscan_delete_subscription`

Delete Subscription Official urlscan.io endpoint: DELETE /api/v1/user/subscriptions/{subscriptionId}/.

Write write

Parameters: subscription_id

Generic call

kosmo integrations:call urlscan.urlscan_delete_subscription '{"subscription_id":"example_subscription_id"}' --json

Shortcut

kosmo integrations:urlscan urlscan_delete_subscription '{"subscription_id":"example_subscription_id"}' --json

`urlscan.urlscan_get_subscription_results`

Subscription Search Results Official urlscan.io endpoint: GET /api/v1/user/subscriptions/{subscriptionId}/results/{datasource}/.

Read read

Parameters: subscription_id, datasource

Generic call

kosmo integrations:call urlscan.urlscan_get_subscription_results '{"subscription_id":"example_subscription_id","datasource":"example_datasource"}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_subscription_results '{"subscription_id":"example_subscription_id","datasource":"example_datasource"}' --json

`urlscan.urlscan_list_channels`

Channels Official urlscan.io endpoint: GET /api/v1/user/channels/.

Read read

Parameters: none

Generic call

kosmo integrations:call urlscan.urlscan_list_channels '{}' --json

Shortcut

kosmo integrations:urlscan urlscan_list_channels '{}' --json

`urlscan.urlscan_create_channel`

Create Channel Official urlscan.io endpoint: POST /api/v1/user/channels/.

Write write

Parameters: body

Generic call

kosmo integrations:call urlscan.urlscan_create_channel '{"body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_create_channel '{"body":"example_body"}' --json

`urlscan.urlscan_get_channel`

Channel Search Results Official urlscan.io endpoint: GET /api/v1/user/channels/{channelId}.

Read read

Parameters: channel_id

Generic call

kosmo integrations:call urlscan.urlscan_get_channel '{"channel_id":"example_channel_id"}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_channel '{"channel_id":"example_channel_id"}' --json

`urlscan.urlscan_update_channel`

Update Channel Official urlscan.io endpoint: PUT /api/v1/user/channels/{channelId}.

Write write

Parameters: channel_id, body

Generic call

kosmo integrations:call urlscan.urlscan_update_channel '{"channel_id":"example_channel_id","body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_update_channel '{"channel_id":"example_channel_id","body":"example_body"}' --json

`urlscan.urlscan_create_incident`

Create Incident Official urlscan.io endpoint: POST /api/v1/user/incidents.

Write write

Parameters: body

Generic call

kosmo integrations:call urlscan.urlscan_create_incident '{"body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_create_incident '{"body":"example_body"}' --json

`urlscan.urlscan_get_incident`

Get Incident Official urlscan.io endpoint: GET /api/v1/user/incidents/{incidentId}.

Read read

Parameters: incident_id

Generic call

kosmo integrations:call urlscan.urlscan_get_incident '{"incident_id":"example_incident_id"}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_incident '{"incident_id":"example_incident_id"}' --json

`urlscan.urlscan_update_incident`

Update Incident options Official urlscan.io endpoint: PUT /api/v1/user/incidents/{incidentId}.

Write write

Parameters: incident_id, body

Generic call

kosmo integrations:call urlscan.urlscan_update_incident '{"incident_id":"example_incident_id","body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_update_incident '{"incident_id":"example_incident_id","body":"example_body"}' --json

`urlscan.urlscan_close_incident`

Close Incident Official urlscan.io endpoint: PUT /api/v1/user/incidents/{incidentId}/close.

Read read

Parameters: incident_id, body

Generic call

kosmo integrations:call urlscan.urlscan_close_incident '{"incident_id":"example_incident_id","body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_close_incident '{"incident_id":"example_incident_id","body":"example_body"}' --json

`urlscan.urlscan_restart_incident`

Restart Incident Official urlscan.io endpoint: PUT /api/v1/user/incidents/{incidentId}/restart.

Read read

Parameters: incident_id, body

Generic call

kosmo integrations:call urlscan.urlscan_restart_incident '{"incident_id":"example_incident_id","body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_restart_incident '{"incident_id":"example_incident_id","body":"example_body"}' --json

`urlscan.urlscan_copy_incident`

Copy Incident Official urlscan.io endpoint: POST /api/v1/user/incidents/{incidentId}/copy.

Read read

Parameters: incident_id, body

Generic call

kosmo integrations:call urlscan.urlscan_copy_incident '{"incident_id":"example_incident_id","body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_copy_incident '{"incident_id":"example_incident_id","body":"example_body"}' --json

`urlscan.urlscan_fork_incident`

Fork Incident Official urlscan.io endpoint: POST /api/v1/user/incidents/{incidentId}/fork.

Read read

Parameters: incident_id, body

Generic call

kosmo integrations:call urlscan.urlscan_fork_incident '{"incident_id":"example_incident_id","body":"example_body"}' --json

Shortcut

kosmo integrations:urlscan urlscan_fork_incident '{"incident_id":"example_incident_id","body":"example_body"}' --json

`urlscan.urlscan_get_watchable_attributes`

Get Watchable Attributes Official urlscan.io endpoint: GET /api/v1/user/watchableAttributes.

Read read

Parameters: none

Generic call

kosmo integrations:call urlscan.urlscan_get_watchable_attributes '{}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_watchable_attributes '{}' --json

`urlscan.urlscan_get_incident_states`

Get Incident States Official urlscan.io endpoint: GET /api/v1/user/incidentstates/{incidentId}/.

Read read

Parameters: incident_id

Generic call

kosmo integrations:call urlscan.urlscan_get_incident_states '{"incident_id":"example_incident_id"}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_incident_states '{"incident_id":"example_incident_id"}' --json

`urlscan.urlscan_list_datadumps`

List Data Dump Files Official urlscan.io endpoint: GET /api/v1/datadump/list/{timeWindow}/{fileType}/{date}.

Read read

Parameters: time_window, file_type, date

Generic call

kosmo integrations:call urlscan.urlscan_list_datadumps '{"time_window":"example_time_window","file_type":"example_file_type","date":"example_date"}' --json

Shortcut

kosmo integrations:urlscan urlscan_list_datadumps '{"time_window":"example_time_window","file_type":"example_file_type","date":"example_date"}' --json

`urlscan.urlscan_get_datadump_link`

Get Data Dump Download Link Official urlscan.io endpoint: GET /api/v1/datadump/link/{path}.

Read read

Parameters: path

Generic call

kosmo integrations:call urlscan.urlscan_get_datadump_link '{"path":"example_path"}' --json

Shortcut

kosmo integrations:urlscan urlscan_get_datadump_link '{"path":"example_path"}' --json

`urlscan.urlscan_download_file`

Download a file Official urlscan.io endpoint: GET /downloads/{fileHash}.

Read read

Parameters: file_hash, password, filename

Generic call

kosmo integrations:call urlscan.urlscan_download_file '{"file_hash":"example_file_hash","password":"example_password","filename":"example_filename"}' --json

Shortcut

kosmo integrations:urlscan urlscan_download_file '{"file_hash":"example_file_hash","password":"example_password","filename":"example_filename"}' --json

`urlscan.urlscan_lookup_malicious_observable`

Malicious observable lookup Official urlscan.io endpoint: GET /api/v1/malicious/{type}/{value}.

Read read

Parameters: type, value

Generic call

kosmo integrations:call urlscan.urlscan_lookup_malicious_observable '{"type":"example_type","value":"example_value"}' --json

Shortcut

kosmo integrations:urlscan urlscan_lookup_malicious_observable '{"type":"example_type","value":"example_value"}' --json

Function Schemas

Use these parameter tables when building CLI payloads without calling integrations:schema first.

urlscan.urlscan_submit_scan 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_submit_scan --json

Parameter	Type	Required	Description
`body`	object	yes	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_search_datasource 5 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_search_datasource --json

Parameter	Type	Required	Description
`q`	string	no	Search Query (Elasticsearch Query String)
`size`	number	no	Number of results to return
`search_after`	string	no	For retrieving the next batch of results, send the value of the `sort` attribute of the last (oldest) result you received (comma-separated) from the previous call.
`datasource`	string	no	Datasources to search: scans (urlscan.io), hostnames, incidents, notifications, certificates (urlscan Pro)
`collapse`	string	no	Field to collapse results on. Only works on current page of results.

urlscan.urlscan_get_result 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_result --json

Parameter	Type	Required	Description
`scan_id`	string	yes	UUID of scan result

urlscan.urlscan_get_screenshot 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_screenshot --json

Parameter	Type	Required	Description
`scan_id`	string	yes	UUID of scan result

urlscan.urlscan_get_dom 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_dom --json

Parameter	Type	Required	Description
`scan_id`	string	yes	UUID of scan result

urlscan.urlscan_get_response 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_response --json

Parameter	Type	Required	Description
`file_hash`	string	yes	SHA256 hash of response

urlscan.urlscan_update_result_visibility 2 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_update_result_visibility --json

Parameter	Type	Required	Description
`scan_id`	string	yes	UUID of scan result
`body`	object	yes	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_delete_result_visibility 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_delete_result_visibility --json

Parameter	Type	Required	Description
`scan_id`	string	yes	UUID of scan result

urlscan.urlscan_get_available_countries 0 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_available_countries --json

Parameter	Type	Required	Description
No parameters.

urlscan.urlscan_get_user_agents 0 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_user_agents --json

Parameter	Type	Required	Description
No parameters.

urlscan.urlscan_get_quotas 0 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_quotas --json

Parameter	Type	Required	Description
No parameters.

urlscan.urlscan_get_available_brands 0 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_available_brands --json

Parameter	Type	Required	Description
No parameters.

urlscan.urlscan_get_brand_summary 0 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_brand_summary --json

Parameter	Type	Required	Description
No parameters.

urlscan.urlscan_get_phishfeed 3 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_phishfeed --json

Parameter	Type	Required	Description
`q`	string	no	q
`limit`	number	no	How many results to return
`format`	string	no	Can be one of csv, tsv, or json

urlscan.urlscan_get_livescan_scanners 0 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_livescan_scanners --json

Parameter	Type	Required	Description
No parameters.

urlscan.urlscan_create_livescan_task 2 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_create_livescan_task --json

Parameter	Type	Required	Description
`scanner_id`	string	yes	scannerId
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_create_livescan_scan 2 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_create_livescan_scan --json

Parameter	Type	Required	Description
`scanner_id`	string	yes	scannerId
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_get_livescan_resource 3 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_livescan_resource --json

Parameter	Type	Required	Description
`scanner_id`	string	yes	scannerId
`resource_type`	string	yes	resourceType
`resource_id`	string	yes	* For result, screenshot, dom: UUID of the scan * For response, download: The SHA256 of the resource

urlscan.urlscan_store_livescan_result 3 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_store_livescan_result --json

Parameter	Type	Required	Description
`scanner_id`	string	yes	scannerId
`scan_id`	string	yes	scanId
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_discard_livescan_result 2 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_discard_livescan_result --json

Parameter	Type	Required	Description
`scanner_id`	string	yes	scannerId
`scan_id`	string	yes	scanId

urlscan.urlscan_get_hostname_history 3 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_hostname_history --json

Parameter	Type	Required	Description
`hostname`	string	yes	The hostname to query
`limit`	number	no	Return at most this many results. Minimum 10 Maximum 10000 Default 1000
`page_state`	string	no	Returns additional results starting from this page state from the previous API call.

urlscan.urlscan_get_pro_username 0 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_pro_username --json

Parameter	Type	Required	Description
No parameters.

urlscan.urlscan_get_similar_results 4 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_similar_results --json

Parameter	Type	Required	Description
`q`	string	no	Additional query filter
`size`	number	no	Maximum results per call
`search_after`	string	no	Parameter to iterate over older results
`scan_id`	string	yes	The original scan to compare to

urlscan.urlscan_list_saved_searches 0 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_list_saved_searches --json

Parameter	Type	Required	Description
No parameters.

urlscan.urlscan_create_saved_search 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_create_saved_search --json

Parameter	Type	Required	Description
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_update_saved_search 2 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_update_saved_search --json

Parameter	Type	Required	Description
`search_id`	string	yes	searchId
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_delete_saved_search 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_delete_saved_search --json

Parameter	Type	Required	Description
`search_id`	string	yes	searchId

urlscan.urlscan_get_saved_search_results 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_saved_search_results --json

Parameter	Type	Required	Description
`search_id`	string	yes	searchId

urlscan.urlscan_list_subscriptions 0 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_list_subscriptions --json

Parameter	Type	Required	Description
No parameters.

urlscan.urlscan_create_subscription 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_create_subscription --json

Parameter	Type	Required	Description
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_update_subscription 2 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_update_subscription --json

Parameter	Type	Required	Description
`subscription_id`	string	yes	subscriptionId
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_delete_subscription 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_delete_subscription --json

Parameter	Type	Required	Description
`subscription_id`	string	yes	subscriptionId

urlscan.urlscan_get_subscription_results 2 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_subscription_results --json

Parameter	Type	Required	Description
`subscription_id`	string	yes	subscriptionId
`datasource`	string	yes	datasource

urlscan.urlscan_list_channels 0 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_list_channels --json

Parameter	Type	Required	Description
No parameters.

urlscan.urlscan_create_channel 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_create_channel --json

Parameter	Type	Required	Description
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_get_channel 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_channel --json

Parameter	Type	Required	Description
`channel_id`	string	yes	channelId

urlscan.urlscan_update_channel 2 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_update_channel --json

Parameter	Type	Required	Description
`channel_id`	string	yes	channelId
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_create_incident 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_create_incident --json

Parameter	Type	Required	Description
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_get_incident 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_incident --json

Parameter	Type	Required	Description
`incident_id`	string	yes	ID of incident

urlscan.urlscan_update_incident 2 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_update_incident --json

Parameter	Type	Required	Description
`incident_id`	string	yes	ID of incident
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_close_incident 2 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_close_incident --json

Parameter	Type	Required	Description
`incident_id`	string	yes	ID of incident
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_restart_incident 2 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_restart_incident --json

Parameter	Type	Required	Description
`incident_id`	string	yes	ID of incident
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_copy_incident 2 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_copy_incident --json

Parameter	Type	Required	Description
`incident_id`	string	yes	ID of incident
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_fork_incident 2 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_fork_incident --json

Parameter	Type	Required	Description
`incident_id`	string	yes	ID of incident
`body`	object	no	JSON request body matching the official urlscan.io OpenAPI schema.

urlscan.urlscan_get_watchable_attributes 0 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_watchable_attributes --json

Parameter	Type	Required	Description
No parameters.

urlscan.urlscan_get_incident_states 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_incident_states --json

Parameter	Type	Required	Description
`incident_id`	string	yes	ID of incident

urlscan.urlscan_list_datadumps 3 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_list_datadumps --json

Parameter	Type	Required	Description
`time_window`	string	yes	Time window of the data dump
`file_type`	string	yes	Type of data dump file
`date`	string	yes	Date of the data dump in YYYYMMDD format

urlscan.urlscan_get_datadump_link 1 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_get_datadump_link --json

Parameter	Type	Required	Description
`path`	string	yes	Path of the data dump file

urlscan.urlscan_download_file 3 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_download_file --json

Parameter	Type	Required	Description
`file_hash`	string	yes	SHA256 hash of file
`password`	string	no	The password to use to encrypt the ZIP file. Using a password is mandatory, the default password is urlscan!
`filename`	string	no	Specify the name of the ZIP file that should be downloaded. This does not change the name of files within the ZIP archive. The default filename is $fileHash.zip

urlscan.urlscan_lookup_malicious_observable 2 parameters

Schema command

kosmo integrations:schema urlscan.urlscan_lookup_malicious_observable --json

Parameter	Type	Required	Description
`type`	string	yes	The type of observable to look up.
`value`	string	yes	The observable value. Format depends on `type`: - `ip`: an IP address (e.g. `192.0.2.1`) - `hostname`: a fully qualified hostname (e.g. `www.example.com`) - `domain`: an apex/registered domain (e.g. `example.com`) - `url`: a URL-encoded URL (e.g. `https%3A%2F%

Permissions

Headless calls still follow the integration read/write permission policy. Configure read/write defaults with integrations:configure. Add --force only for trusted automation that should bypass that policy.