Introduction

Notra runs verified security audits — every finding is reproduced with proof before it reaches a report. This is the programmatic side of that: the same audits, findings, and reports your team sees in the dashboard, callable from your own code, CI pipeline, or an AI assistant.

What you can do

• Start and poll audits from a script, a cron job, or a deploy pipeline.
• Gate a merge on severity — fail the build if a critical or high finding ships.
• Pull findings and reports into your own tooling.
• Let an AI assistant do it via the MCP server — six tools, same API underneath.

Requirements

An API-access plan (Pro, Agency, or Enterprise) and a key from Settings → API keys. Every request needs the domain you're auditing to already be authorized in the dashboard — the API doesn't skip that gate.

Quickstart

curl -X POST https://your-notra-domain/api/v1/scans \
  -H "Authorization: Bearer notra_live_..." \
  -H "content-type: application/json" \
  -d '{"url": "example.com", "depth": "standard"}'

# 201 { "runId": "...", "host": "example.com" }

Poll /api/v1/scans/:id until status is done, then read /api/v1/scans/:id/findings for the verified results. See Authentication for how keys work, or jump straight to the API reference for every endpoint.