vigilbase.com has a public API for AI agents, scripts and CI. It runs the Security headers and Email security checks over HTTP, serves security badges, and publishes files that tell agents what the tools do. You can call it without an account; a free API key raises the rate limit.
Quickstart
Grade a site's HTTP security headers with no key and no sign-in:
curl -sS -X POST https://vigilbase.com/api/v1/agent/tools/security-headers/execute \
-H 'content-type: application/json' \
-d '{"target":"https://example.com"}'
curl -sS -X POST https://vigilbase.com/api/v1/agent/tools/email-security/execute \
-H 'content-type: application/json' \
-d '{"target":"example.com"}'
npx @vigilbase/cli run security-headers https://example.com --json
The response has a grade, a gradeScore out of 100 and the full scan result. See Agent API for the request and response format.
When to use the API
- Grade HTTP security headers or email authentication (SPF, DKIM and DMARC) from an agent or a script without driving a browser.
- Embed a domain's latest verified Website Security grade as a badge.
- Let an agent find the tools and how to run them through the skills index.
Intrusive tools such as Website Security and React2Shell are not on the Agent API. Run them in the browser with email verification, or through Vigilbase One with a signed-in CLI.
At a glance
| Topic | Details |
|---|---|
| Base URL | https://vigilbase.com/api/v1/ |
| Authentication | None, or a developer API key in Authorization: Bearer <key> or X-Api-Key: <key> |
| Scopes | tools:read, tools:execute and badges:read, with or without a key |
| Rate limit | 10 requests a minute per IP without a key, 30 a minute per key |
| Errors | application/problem+json (RFC 9457) with a machine-readable code and an optional hint |
| Versioning | API-Version: 1; breaking changes will ship under /api/v2/ |
| OpenAPI | https://vigilbase.com/openapi.json |
Pages
Agent APIEndpoints, authentication, rate limits, errors and versioning.API keysCreate a free key in Vigilbase One to raise the rate limit.Skills and discoveryAgent skills, llms.txt, the API catalog and the MCP server card.BadgesEmbed an SVG badge with a domain's Website Security grade.API referenceEvery endpoint and field, from the OpenAPI document.Vigilbase CLIRun the tools from a terminal.