# Developers

> Run Vigilbase security checks from code or an AI agent with the public Agent API, free API keys, badges and machine-readable discovery files.

Source: https://docs.vigilbase.com/tools/developers

vigilbase.com has a public API for AI agents, scripts and CI. It runs the [Security headers](https://docs.vigilbase.com/tools/security-headers) and [Email security](https://docs.vigilbase.com/tools/email-security) checks over HTTP, serves [security badges](https://docs.vigilbase.com/tools/developers/badges), and publishes files that tell agents what the tools do. You can call it without an account; a free API key raises the rate limit.

## Quickstart

Grade a site's HTTP security headers with no key and no sign-in:

:::code-group
```bash filename=Security headers
curl -sS -X POST https://vigilbase.com/api/v1/agent/tools/security-headers/execute \
  -H 'content-type: application/json' \
  -d '{"target":"https://example.com"}'
```

```bash filename=Email security
curl -sS -X POST https://vigilbase.com/api/v1/agent/tools/email-security/execute \
  -H 'content-type: application/json' \
  -d '{"target":"example.com"}'
```

```bash filename=CLI
npx @vigilbase/cli run security-headers https://example.com --json
```
:::

The response has a `grade`, a `gradeScore` out of 100 and the full scan `result`. See [Agent API](https://docs.vigilbase.com/tools/developers/agent-api) for the request and response format.

## When to use the API

- Grade HTTP security headers or email authentication (SPF, DKIM and DMARC) from an agent or a script without driving a browser.
- Embed a domain's latest verified Website Security grade as a [badge](https://docs.vigilbase.com/tools/developers/badges).
- Let an agent find the tools and how to run them through the [skills index](https://docs.vigilbase.com/tools/developers/agent-skills-and-discovery).

Intrusive tools such as [Website Security](https://docs.vigilbase.com/tools/website-security) and [React2Shell](https://docs.vigilbase.com/tools/react2shell) are not on the Agent API. Run them in the browser with email verification, or through Vigilbase One with a signed-in [CLI](https://docs.vigilbase.com/tools/cli/install-and-sign-in).

## At a glance

| Topic | Details |
| --- | --- |
| Base URL | `https://vigilbase.com/api/v1/` |
| Authentication | None, or a developer API key in `Authorization: Bearer <key>` or `X-Api-Key: <key>` |
| Scopes | `tools:read`, `tools:execute` and `badges:read`, with or without a key |
| Rate limit | 10 requests a minute per IP without a key, 30 a minute per key |
| Errors | `application/problem+json` (RFC 9457) with a machine-readable `code` and an optional `hint` |
| Versioning | `API-Version: 1`; breaking changes will ship under `/api/v2/` |
| OpenAPI | `https://vigilbase.com/openapi.json` |

## Pages

:::cards
- [Agent API](https://docs.vigilbase.com/tools/developers/agent-api) Endpoints, authentication, rate limits, errors and versioning.
- [API keys](https://docs.vigilbase.com/tools/developers/api-keys) Create a free key in Vigilbase One to raise the rate limit.
- [Skills and discovery](https://docs.vigilbase.com/tools/developers/agent-skills-and-discovery) Agent skills, llms.txt, the API catalog and the MCP server card.
- [Badges](https://docs.vigilbase.com/tools/developers/badges) Embed an SVG badge with a domain's Website Security grade.
- [API reference](https://docs.vigilbase.com/tools/developers/api-reference) Every endpoint and field, from the OpenAPI document.
- [Vigilbase CLI](https://docs.vigilbase.com/tools/cli/install-and-sign-in) Run the tools from a terminal.
:::