API keys & integration guide

Use a bearer key from a Pro or higher account. Store it in your secret manager; the full value is shown only at creation.

Authorization: Bearer $APK_SCANNER_KEY

GET /v1/app/:package retrieves the latest visible report without starting a scan. Check analysis.status and the recorded date before interpreting scores.

curl --fail-with-body https://apk-scanner.com/v1/app/com.example.app \
  -H "Authorization: Bearer $APK_SCANNER_KEY"

POST /v1/scan accepts app_id or a Google Play link. A recent result may be returned from cache; otherwise the APK is downloaded and statically analyzed. Responses identify cached results. Scan quotas and endpoint rate limits apply.

curl --fail-with-body https://apk-scanner.com/v1/scan \
  -H "Authorization: Bearer $APK_SCANNER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"app_id":"com.example.app"}'

POST /v1/scan-upload accepts multipart field apk. Uploaded reports belong to your account and receive an upload.* identity. Use the returned scan_id and export URLs to keep CI evidence tied to the exact build.

curl --fail-with-body https://apk-scanner.com/v1/scan-upload \
  -H "Authorization: Bearer $APK_SCANNER_KEY" \
  -F "apk=@app-release.apk"

Add Prefer: respond-async to an APK upload for a 202 response containing job_id and status_url. Fetch that status URL with the same bearer key. Queued/running is not completion; inspect the result and analysis coverage after the job finishes.

GET /v1/jobs/:job_id
Authorization: Bearer $APK_SCANNER_KEY

POST /v1/verdict evaluates recorded scan evidence. A policy verdict is not compliance certification. Treat missing, incomplete, or unknown analysis as a failed gate; a grade alone is insufficient. For private uploads, retrieve the returned authenticated scan exports and evaluate that build.

curl --fail-with-body https://apk-scanner.com/v1/verdict \
  -H "Authorization: Bearer $APK_SCANNER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"app_id":"com.example.app","policy":{"max_grade":"B","max_findings":{"critical":0,"high":0}}}'

Supported policy rules: max_grade, deny_verified_exposures, max_findings, max_trackers, deny_sdks, deny_risky_sdks, deny_identifiers, require_privacy_policy, deny_cleartext, deny_debuggable, deny_coppa_high.

Understand coverage and assessment limits

Public app exports are available at /app/:package. Private uploads require owner authentication. Prefer the /v1/scans/:scan_id URLs returned by scan-upload for immutable, authenticated CI evidence. Absence from a later scan does not establish a fix.

GET /v1/scans/:scan_id/findings.sarif
GET /v1/scans/:scan_id/proof.json
GET /v1/scans/:scan_id/coverage.json

GET /app/:package/sbom.cyclonedx.json
GET /app/:package/findings.csv
GET /app/:package/coverage.csv
GET /app/:package/diff.json

The SDK feed lists components that warrant contextual review. Shared certificate metadata is a grouping signal, not proof of publisher identity or APK signature validity.

GET /v1/risky-sdks
GET /v1/developer/by-app?app=com.example.app
Authorization: Bearer $APK_SCANNER_KEY

GET /app/:package/badge.svg returns an SVG of the latest recorded grade, cached for 30 minutes and regenerated when the app is re-scanned. No key is needed and no referrer is recorded. Link it to the report so a reader can see which build it covers and what the scan could not see — a grade with no route to its evidence invites the wrong conclusion. A grade can move when a new version is scanned or a detector is corrected; publish a signed Proof Capsule instead if you need a figure that cannot change. Each report page carries ready-made snippets under Export / share.

[![apk-scanner.com exposure grade](https://apk-scanner.com/app/com.example.app/badge.svg)](https://apk-scanner.com/app/com.example.app)

401 means authentication is needed; 403 means access is unavailable; 404 means the record was not found; 429 means a quota or rate limit was reached. Other failures should not be treated as clean scans. Supported API routes limit requests to 60 per minute per key; daily scan allowances depend on your plan.