API and webhooks

The Page Lookout API lets your own systems, such as a CI job, a script or a back office, start scans of your organization’s sites and read what they found. Webhooks work the other way round: Page Lookout sends a signed request to your own HTTPS endpoint whenever a scan finishes.

The full guides and the generated reference are published with the platform, so they always match the version you are using. This page is the short map.

What you can do

• Start a scan of a site and wait for it to finish.
• Read results: scan runs and their tasks, comparisons with the previous scan, and findings, issues and the rules behind them, per scan, per site or across the organization.
• Read the consent inventory of a site, or merged across your sites, as JSON or as a CSV file you can open in a spreadsheet. See Inventory.
• Read the approved third-party list and the findings it raises. See Approved third parties. The list itself is changed in the app by an organization admin, not through the API.
• Read report snapshots and download PDF reports.
• Be told when a scan finishes with a webhook, instead of polling.

API keys

An organization admin creates keys on the Integrations screen of the app. A key belongs to one organization and holds one or more permissions, called scopes, that you choose when you create it. Scopes are independent of each other.

Scope	Lets the key
scans:read	list sites, read scans, comparisons, consent inventories and the approved list, and summaries
scans:write	start a scan of a site
findings:read	read findings, issues and the rules behind them
reports:read	read report snapshots and PDF report states, and download the PDFs

The key is shown once when you create it, so store it in your secret store straight away. Page Lookout keeps only a one-way hash of it and cannot show it again. The Integrations screen also shows the API base URL and your organization id, which every call needs.

Webhooks

Admins add endpoints on the same Integrations screen. Each delivery is signed, so your receiver can check that it came from Page Lookout. A Test button sends a sample event right away, so you can check your verification before relying on a real one. The webhooks guide covers the events, the headers, signature verification with examples, retries and rotating the signing secret.

Where the documentation lives

• Overview: the API in one page, with the list of operations.
• Getting started: create a key, find your ids, start a scan and read its findings with three curl calls.
• Errors and limits: what a refusal looks like and how to handle rate limits.
• Webhooks: events, signatures, retries and secrets.
• Versioning and the changelog: what a version number promises and how changes are announced.
• API reference: every operation, parameter and field.
• OpenAPI document: the machine-readable description, for generating a client.

These pages need no sign-in.