Developer reference
ExploitShield API Docs
Endpoint-by-endpoint reference for the public FastAPI/OpenAPI bridge, signed customer dashboard routes, crawler scan controls, reports, billing, and administrator diagnostics.
FastAPI / OpenAPI
Connect your systems to the ExploitShield API
The production bridge exposes signed customer-report routes, crawler job controls, PDF export, public platform statistics, and admin diagnostics through the same web-md5.site gateway used by the dashboard.
Platform health
Public telemetry
Customer threat intelligence
Crawler operations
Reports and exports
Ownership and onboarding
Billing and entitlement
Threat operations
Audit and security
Administrator support
Payment callbacks
ES1 HMAC
Threat Dashboard
POST /v1/site/dashboard
Fetch a domain-scoped threat dashboard with severity/source filters, pagination, findings, charts, coverage, and analyst notes.
Group
Customer threat intelligence
Audience
Verified website owners and customer portals
Auth model
ES1 HMAC
Request fields
Required
hostlink_idflask_account_refOptional
severitysourcekindquerypagepage_sizePractical test
- 1.Verify the host on exploitshield.io Account first.
- 2.Use the exact link_id returned by account linking.
- 3.Filter by severity=High and page_size=20 to validate pagination.
Success response shape
okhostdashboardsummarythreatschartscoverageanalyst_notesentitlementCommon errors
- - 401 invalid_signature or stale_timestamp
- - 403 inactive entitlement or revoked website link
- - 404 unknown link_id/host pairing
Python sample
import hashlib, hmac, json, secrets, time, requests
secret = "YOUR_FLASK_SITE_API_SECRET"
path = "/v1/site/dashboard"
payload = {
"host": "example.com",
"link_id": "161b7341-430d-4e3a-960a-ab12f00484d6",
"flask_account_ref": "flask-account-reference",
"severity": "High",
"source": "Snort IDS",
"kind": "confirmed",
"query": "redirect",
"page": 1,
"page_size": 20
}
body = json.dumps(payload, separators=(",", ":")).encode()
stamp = str(int(time.time()))
nonce = secrets.token_urlsafe(24)
canonical = "\n".join(["ES1", stamp, nonce, "POST", path, hashlib.sha256(body).hexdigest()])
signature = hmac.new(secret.encode(), canonical.encode(), hashlib.sha256).hexdigest()
headers = {
"content-type": "application/json",
"x-exploitshield-timestamp": stamp,
"x-exploitshield-nonce": nonce,
"x-exploitshield-signature": signature,
}
response = requests.post("https://web-md5.site/v1/site/dashboard", headers=headers, data=body, timeout=45)
print(response.status_code, response.headers.get("content-type"))
print(response.content[:2000])For signed routes, generate a fresh timestamp and nonce for every retry. Never expose server-side API secrets in browser JavaScript.