Skip to content

API Reference Summary

Quick reference for key WebDecoy API endpoints.


The WebDecoy API uses REST architecture with JSON payloads. All endpoints require authentication via Bearer token (API key or Auth0 JWT).

https://api.webdecoy.com/api
Authorization: Bearer sk_live_your_api_key

Or for user sessions:

Authorization: Bearer <auth0_jwt_token>

POST /auth/callback
Authorization: Bearer <auth0_jwt>

Response:

{
"id": "user-uuid",
"auth0_id": "auth0|123",
"email": "user@example.com",
"name": "User Name"
}
GET /auth/me
Authorization: Bearer <token>

POST /organizations
Authorization: Bearer <token>
{
"name": "My Organization"
}
GET /organizations?page=1&page_size=50
Authorization: Bearer <token>
GET /organizations/{organization_id}
Authorization: Bearer <token>
PUT /organizations/{organization_id}
Authorization: Bearer <token>
{
"name": "Updated Name"
}

POST /organizations/{organization_id}/properties
Authorization: Bearer <token>
{
"name": "Production Website"
}
GET /organizations/{organization_id}/properties?page=1&page_size=50
Authorization: Bearer <token>
GET /properties/{property_id}
Authorization: Bearer <token>

POST /organizations/{organization_id}/domains
Authorization: Bearer <token>
{
"domain": "decoy.example.com",
"record_type": "A"
}
GET /organizations/{organization_id}/domains
Authorization: Bearer <token>
POST /domains/{domain_id}/verify
Authorization: Bearer <token>
POST /domains/{domain_id}/ssl/request
Authorization: Bearer <token>
POST /domains/{domain_id}/ssl-status
Authorization: Bearer <token>

POST /decoys
Authorization: Bearer <token>
{
"custom_domain_id": "domain-uuid",
"name": "Admin Backup Trap",
"path": "/admin/backup.zip",
"trigger_action": "log",
"decoy_type": "link"
}
GET /decoys?page=1&page_size=50
Authorization: Bearer <token>
GET /decoys/{decoy_id}
Authorization: Bearer <token>
PATCH /decoys/{decoy_id}
Authorization: Bearer <token>
{
"name": "Updated Name",
"trigger_action": "block"
}
DELETE /decoys/{decoy_id}
Authorization: Bearer <token>

POST /organizations/{organization_id}/bot-scanners
Authorization: Bearer <token>
{
"name": "Main Scanner",
"enabled": true,
"sensitivity": "medium"
}
GET /organizations/{organization_id}/bot-scanners
Authorization: Bearer <token>
GET /organizations/{organization_id}/bot-scanners/{scanner_id}/snippet
Authorization: Bearer <token>
PATCH /organizations/{organization_id}/bot-scanners/{scanner_id}/toggle
Authorization: Bearer <token>

GET /organizations/{organization_id}/detections?page=1&page_size=50
Authorization: Bearer <token>

Query Parameters:

ParameterDescription
property_idFilter by property
sourceDetection source (decoy_link, endpoint, bot_scanner)
min_bot_scoreMinimum bot score
max_bot_scoreMaximum bot score
countryCountry code(s)
is_proxytrue/false
is_vpntrue/false
is_tortrue/false
start_dateISO 8601 date
end_dateISO 8601 date
sort_bytimestamp, bot_score
sort_orderasc, desc
GET /organizations/{organization_id}/detections/{detection_id}
Authorization: Bearer <token>
GET /organizations/{organization_id}/detections/stats
Authorization: Bearer <token>
GET /organizations/{organization_id}/detections/stats/hourly
Authorization: Bearer <token>
GET /organizations/{organization_id}/detections/filter-options
Authorization: Bearer <token>

GET /mitre/tactics
GET /organizations/{organization_id}/mitre/stats
Authorization: Bearer <token>

POST /organizations/{organization_id}/integrations/cloudflare
Authorization: Bearer <token>
{
"api_token": "cloudflare_token",
"account_id": "account_id",
"zone_id": "zone_id",
"zone_name": "example.com"
}
POST /organizations/{organization_id}/integrations/cloudflare/rules
Authorization: Bearer <token>
{
"decoy_id": "decoy-uuid",
"rule_type": "block_all"
}
POST /organizations/{organization_id}/integrations/webhooks
Authorization: Bearer <token>
{
"name": "My Webhook",
"url": "https://example.com/webhook",
"on_detection": true,
"min_bot_score": 70
}
POST /organizations/{organization_id}/integrations/webhooks/{webhook_id}/test
Authorization: Bearer <token>

POST /organizations/{organization_id}/api-keys
Authorization: Bearer <token>
{
"name": "Production SDK",
"scopes": ["detections:read", "detections:write"],
"expires_in": 365
}

Response:

{
"id": "key-uuid",
"name": "Production SDK",
"api_key": "sk_live_xxxxxxx",
"key_prefix": "sk_live_xxx",
"scopes": ["detections:read", "detections:write"]
}

Important: The full api_key is only returned once. Store it securely.

GET /organizations/{organization_id}/api-keys
Authorization: Bearer <token>
DELETE /organizations/{organization_id}/api-keys/{key_id}
Authorization: Bearer <token>

GET /billing/plans
Authorization: Bearer <token>
POST /billing/checkout-session
Authorization: Bearer <token>
{
"organization_id": "org-uuid",
"price_id": "price_xxx",
"success_url": "https://app.example.com/billing/success",
"cancel_url": "https://app.example.com/billing"
}
GET /organizations/{organization_id}/subscription
Authorization: Bearer <token>
GET /organizations/{organization_id}/billing/usage
Authorization: Bearer <token>

{
"data": { ... },
"total": 100,
"page": 1,
"page_size": 50
}
{
"error": "Error message",
"code": "ERROR_CODE",
"status": 400
}
CodeMeaning
200Success
201Created
400Bad Request
401Unauthorized
403Forbidden
404Not Found
429Rate Limited
500Server Error

Endpoint TypeLimit
Read operations100/minute
Write operations30/minute
Detection submission1000/minute

Rate limit headers:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1642680000