Authentication

Every endpoint requires a token. Tokens start with chs_live_ and are shown once at creation — only a hash is stored.

Scopes

read

Query domains, subdomains, platforms, scans, stats and exports.

write

Additionally queue scans and trigger a full re-scan. Without it those calls return 403 insufficient_scope.

Rotating a token

Create the replacement first, deploy it, then revoke the old one on your account page. Revocation takes effect on the next request.

Keep tokens server-side

A token grants access to everything this monitor has collected. Never ship one in browser code or a public repository. The console on these pages keeps your key in the current browser tab only.

Quickstart

Pagination

Sending the token

curl "https://chaos.thescope.top/api/v1/me" \
  -H "Authorization: Bearer chs_live_xxxxxxxxxxxx"

# equivalent
curl "https://chaos.thescope.top/api/v1/me" -H "X-API-Key: chs_live_xxxxxxxxxxxx"