Malware scan API

Run the same malware scans over HTTP.

Base URL https://hashzyn.onrender.com. Auth: Authorization: Bearer hz_live_… or a Supabase session token.

Create API key View pricing Get started

Quickstart

Create a free account and sign in.
Open Account → API keys and create a key (shown once).
Call any scan endpoint with Authorization: Bearer hz_live_…

Base URL https://hashzyn.onrender.com

Authentication

Send a Bearer token on every request. API keys are for servers and CI; session tokens work for apps you control.

API key

API key (recommended)

Create hz_live_ keys in your account. Prefix is listed later; the full secret is shown only at creation.

Session

Supabase session

After login, pass the access token the same way. Useful for first-party frontends.

Authorization: Bearer hz_live_xxxxxxxx
Content-Type: application/json

Endpoints

All scan routes return a single verdict plus source breakdown. Samples are not stored after the request.

Verdicts: clean · suspicious · malicious · unknown

POST/v1/scan/lookup

Hash lookup

Look up a SHA-256 without uploading the file. If unknown, response may include needsUpload: true.

curl -s https://hashzyn.onrender.com/v1/scan/lookup \
  -H "Authorization: Bearer hz_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","filename":"empty"}'

Example response

{
  "id": "scn_…",
  "status": "done",
  "verdict": "unknown",
  "sha256": "e3b0…",
  "needsUpload": true,
  "sources": [
    { "engine": "hash_intel", "verdict": "unknown", "found": false }
  ]
}

POST/v1/scan/file

File scan

Multipart upload. Free plan max 3 MB; Starter/Pro max 10 MB. Sample bytes are discarded after the request — not archived.

curl -s https://hashzyn.onrender.com/v1/scan/file \
  -H "Authorization: Bearer hz_live_YOUR_KEY" \
  -F "file=@sample.bin" \
  -F "sha256=YOUR_SHA256"

POST/v1/scan/url

URL scan

Check a URL against threat feeds and page-source heuristics.

curl -s https://hashzyn.onrender.com/v1/scan/url \
  -H "Authorization: Bearer hz_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/suspicious"}'

POST/v1/scan/text

Text / code scan

Paste JavaScript, PHP, HTML, or other text for heuristic analysis.

curl -s https://hashzyn.onrender.com/v1/scan/text \
  -H "Authorization: Bearer hz_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content":"eval(atob(\"…\"))","language":"javascript"}'

GET/v1/scan/:id

Get scan by ID

Fetch a previously created scan result by id.

curl -s https://hashzyn.onrender.com/v1/scan/scn_YOUR_ID \
  -H "Authorization: Bearer hz_live_YOUR_KEY"

GET/v1/hash/:sha256

Public hash reputation

Read cached HashZyn reputation for a SHA-256 (no auth required). Also available as a shareable page on the site.

curl -s https://hashzyn.onrender.com/v1/hash/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

GET/v1/me

Account

Returns plan, credits, and dailyRemaining for the authenticated user.

curl -s https://hashzyn.onrender.com/v1/me \
  -H "Authorization: Bearer hz_live_YOUR_KEY"

Example response

{
  "id": "…",
  "email": "you@example.com",
  "plan": "free",
  "credits": 0,
  "dailyRemaining": 18
}

POST/v1/keys

Create API key

Creates a key. The full hz_live_… secret is returned once — store it securely. List with GET /v1/keys; revoke with DELETE /v1/keys/:id.

curl -s https://hashzyn.onrender.com/v1/keys \
  -H "Authorization: Bearer <session_or_key>" \
  -H "Content-Type: application/json" \
  -d '{"name":"ci"}'

Example response

{
  "id": "key_…",
  "name": "ci",
  "prefix": "hz_live_abcd1234",
  "key": "hz_live_…full_secret_once…"
}

GET/health

Health

Liveness check for uptime monitors.

curl -s https://hashzyn.onrender.com/health

Errors

401 — Missing or invalid Bearer token / API key.
402 — Daily free limit or credit balance exhausted.
429 — IP burst or daily scan cap — retry after a short wait.
400 — Invalid body (bad hash, URL, or missing file).

Limits & billing

One credit is one uncached file or URL scan. Hash cache hits and public hash reputation reads do not burn credits.

Free: 20 scans / day (UTC reset), 1 API key.
Starter / Pro: monthly credits — see pricing.
Guest requests (no auth) share stricter IP limits.
File uploads: Free max 3 MB; Starter/Pro max 10 MB.

Create API key View pricing