Scanner

Scanner is a cloud-native security data platform that indexes security logs directly in Amazon S3 to deliver full-text search across petabytes, continuous streaming threat detection, and programmatic and agent-native access to security data — an alternative to traditional SIEMs and data lakes. Its REST API (v1) covers searchable indexes, detection rules, event sinks, lookup tables, ad hoc queries, and query-capacity info, and it ships a hosted Model Context Protocol (MCP) server plus a detection-rules-as-code CLI (scanner-cli). Authentication is a Scanner API key presented as an HTTP Bearer token; console SSO is brokered by Stytch (Okta, Google Workspace, Microsoft Entra, SCIM). SOC 2 Type II certified and GDPR compliant. Backed by CRV.

Scanner publishes 6 APIs on the APIs.io network, including Ad Hoc Queries API, Detection Rules API, Event Sinks API, and 3 more. Tagged areas include Company, Security, SIEM, Log Analytics, and Threat Detection.

The Scanner catalog on APIs.io includes 1 event-driven AsyncAPI specification.

Scanner’s developer surface includes documentation, API reference, getting-started guide, engineering blog, pricing, signup flow, changelog, and 23 more developer resources.

🌐 Visit website 📡 Source on GitHub
57.7/100 developing ▬ flat Agent 71/100 agent native Full breakdown ↓
scored 2026-07-27 · rubric v0.5
AccessSelf serve
6 APIs 1 MCP Servers
CompanySecuritySIEMLog AnalyticsThreat DetectionSecurity OperationsObservabilityMCP

Kin Score

Kin Score Kin Score How this is scored →
scored 2026-07-27 · rubric v0.5
Composite quality — 57.7/100 · developing
Contract Quality 18.6 / 25
Developer Ergonomics 13.9 / 20
Commercial Clarity 12.1 / 20
Operational Transparency 3.1 / 13
Governance 0.0 / 12
Discoverability 10.0 / 10
Agent readiness — 71/100 · agent native
Machine-Readable Contract 18 / 18
Agentic Access Contract 15 / 15
MCP Server 12 / 12
Machine-Readable Auth 10 / 10
Idempotency 0 / 9
Stable Error Semantics 8 / 8
Request/Response Examples 0 / 7
Rate-Limit Signaling 0 / 7
Typed Event Surface 6 / 6
Agent Skills 5 / 5
Well-Known Catalog 0 / 4
Consent & Bot Identity 0 / 3
Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. This rating is computed from github.com/api-evangelist/scanner: open an issue to ask a question, or submit a pull request to add artifacts. Want it done for you? Prioritized profiling — $2,500 →

APIs 6

Individual APIs this provider publishes, each with its own machine-readable definition.

Scanner Ad Hoc Queries API

Run asynchronous or blocking full-text queries over indexed logs.

Scanner Detection Rules API

Create, list, update, and delete streaming detection rules.

Scanner Event Sinks API

Manage alert destinations (Slack, Webhook, PagerDuty).

Scanner Indexes API

List and retrieve searchable indexes for a tenant.

Scanner Info API

Account and query-capacity metrics.

Scanner Lookup Tables API

Upload, manage, and download lookup table files for enrichment.

MCP Servers 1

Model Context Protocol servers that expose these APIs to AI agents.

scanner-mcp.yml

MCP SERVER

Event Specifications 1

AsyncAPI definitions for this provider's event-driven and streaming APIs.

Scanner Webhooks

ASYNCAPI

Security Posture 3

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Scanner Authentication

http · 1 scheme

SECURITY

Scanner Domain Security

TLSv1.3 · HSTS · DMARC

SECURITY

Scanner Trust Center

SOC 2 Type II, GDPR

SECURITY

Agentic Access 1

Recommended x-agentic-access execution contracts for AI agents.

Scanner Agentic Access

25 operations · 13 acting

25 operations · 13 acting

AGENTIC

Resources

Get Started 4

Portal, sign-up, and the first successful call

DeveloperPortal
DeveloperPortal
 GettingStarted
GettingStarted
 SignUp
SignUp
 Login
Login

Documentation 2

Reference material describing how the API behaves

Documentation
Documentation
 APIReference
APIReference

Agent Surfaces 4

MCP servers, agent skills, and machine-readable catalogs

MCPServer
MCPServer
 AgentSkill
AgentSkill
 LLMsTxt
LLMsTxt
 AgenticAccess
AgenticAccess

Design & Contract 6

Pagination, idempotency, versioning, errors, and events

Conventions
Conventions
 ErrorCatalog
ErrorCatalog
 Lifecycle
Lifecycle
 DataModel
DataModel
 Conformance
Conformance
 Webhooks
Webhooks

Build 2

SDKs, sample code, and the tooling you integrate with

CLI
CLI
 Packages
Packages

Access & Security 4

Authentication, authorization, and security posture

Authentication
Authentication
 Compliance
Compliance
 TrustCenter
TrustCenter
 DomainSecurity
DomainSecurity

Operate 2

Status, limits, changes, and where to get help

ChangeLog
ChangeLog
 ChangeLog
ChangeLog

Commercial 3

Pricing, plans, and the legal terms of use

Pricing
Pricing
 TermsOfService
TermsOfService
 PrivacyPolicy
PrivacyPolicy

Company 2

The organization behind the API

Blog
Blog
 Website
Website

Other 1

Properties that don't map to a standard resource type

Overlay
Overlay

Source (apis.yml)

apis.yml Raw ↑ 
aid: scanner
accessModel:
  pricing: unknown
  onboarding: self-serve
  trial: false
  try_now: false
  public: false
  label: Self-serve signup
  confidence: medium
  source:
  - authentication
  generated: '2026-07-22'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/scanner.png
name: Scanner
description: Scanner is a cloud-native security data platform that indexes security logs directly in Amazon S3 to deliver
  full-text search across petabytes, continuous streaming threat detection, and programmatic and agent-native access to security
  data — an alternative to traditional SIEMs and data lakes. Its REST API (v1) covers searchable indexes, detection rules,
  event sinks, lookup tables, ad hoc queries, and query-capacity info, and it ships a hosted Model Context Protocol (MCP)
  server plus a detection-rules-as-code CLI (scanner-cli). Authentication is a Scanner API key presented as an HTTP Bearer
  token; console SSO is brokered by Stytch (Okta, Google Workspace, Microsoft Entra, SCIM). SOC 2 Type II certified and GDPR
  compliant. Backed by CRV.
url: https://raw.githubusercontent.com/api-evangelist/scanner/refs/heads/main/apis.yml
x-type: company
x-source: vc-portfolio
x-backed-by:
- crv
x-tier: stub
x-tier-reason: portfolio-lead
specificationVersion: '0.20'
created: '2026-07-17'
modified: '2026-07-21'
tags:
- Company
- Security
- SIEM
- Log Analytics
- Threat Detection
- Security Operations
- Observability
- MCP
apis:
- aid: scanner:scanner-ad-hoc-queries-api
  name: Scanner Ad Hoc Queries API
  description: Run asynchronous or blocking full-text queries over indexed logs.
  humanURL: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api
  baseURL: https://app.scanner.dev
  tags:
  - Ad Hoc Queries
  properties:
  - type: OpenAPI
    url: openapi/scanner-ad-hoc-queries-api-openapi.yml
  - type: APIReference
    url: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api
- aid: scanner:scanner-detection-rules-api
  name: Scanner Detection Rules API
  description: Create, list, update, and delete streaming detection rules.
  humanURL: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api
  baseURL: https://app.scanner.dev
  tags:
  - Detection Rules
  properties:
  - type: OpenAPI
    url: openapi/scanner-detection-rules-api-openapi.yml
  - type: APIReference
    url: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api
- aid: scanner:scanner-event-sinks-api
  name: Scanner Event Sinks API
  description: Manage alert destinations (Slack, Webhook, PagerDuty).
  humanURL: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api
  baseURL: https://app.scanner.dev
  tags:
  - Event Sinks
  properties:
  - type: OpenAPI
    url: openapi/scanner-event-sinks-api-openapi.yml
  - type: APIReference
    url: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api
- aid: scanner:scanner-indexes-api
  name: Scanner Indexes API
  description: List and retrieve searchable indexes for a tenant.
  humanURL: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api
  baseURL: https://app.scanner.dev
  tags:
  - Indexes
  properties:
  - type: OpenAPI
    url: openapi/scanner-indexes-api-openapi.yml
  - type: APIReference
    url: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api
- aid: scanner:scanner-info-api
  name: Scanner Info API
  description: Account and query-capacity metrics.
  humanURL: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api
  baseURL: https://app.scanner.dev
  tags:
  - Info
  properties:
  - type: OpenAPI
    url: openapi/scanner-info-api-openapi.yml
  - type: APIReference
    url: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api
- aid: scanner:scanner-lookup-tables-api
  name: Scanner Lookup Tables API
  description: Upload, manage, and download lookup table files for enrichment.
  humanURL: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api
  baseURL: https://app.scanner.dev
  tags:
  - Lookup Tables
  properties:
  - type: OpenAPI
    url: openapi/scanner-lookup-tables-api-openapi.yml
  - type: APIReference
    url: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- type: DeveloperPortal
  url: https://docs.scanner.dev/scanner/
- type: Documentation
  url: https://docs.scanner.dev/scanner/
- type: APIReference
  url: https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/developer-tools/api
- type: GettingStarted
  url: https://docs.scanner.dev/scanner/getting-started/quick-setup-overview
- type: Blog
  url: https://scanner.dev/blog
- type: Pricing
  url: https://scanner.dev/pricing
- type: SignUp
  url: https://app.scanner.dev/
- type: Login
  url: https://app.scanner.dev/
- type: TermsOfService
  url: https://scanner.dev/terms
- type: PrivacyPolicy
  url: https://scanner.dev/privacy
- type: ChangeLog
  url: https://scanner.dev/changelog
- type: ChangeLog
  url: changelog/scanner-changelog.yml
- type: Authentication
  url: authentication/scanner-authentication.yml
- type: MCPServer
  url: mcp/scanner-mcp.yml
- type: AgentSkill
  url: skills/_index.yml
- type: CLI
  url: cli/scanner-cli.yml
- type: Packages
  url: packages/scanner-packages.yml
- type: Conventions
  url: conventions/scanner-conventions.yml
- type: ErrorCatalog
  url: errors/scanner-problem-types.yml
- type: Lifecycle
  url: lifecycle/scanner-lifecycle.yml
- type: DataModel
  url: data-model/scanner-data-model.yml
- type: Conformance
  url: conformance/scanner-conformance.yml
- type: Compliance
  url: https://scanner.dev/trust
- type: Webhooks
  url: asyncapi/scanner-webhooks.yml
- type: Overlay
  url: overlays/scanner-overlay.yaml
- type: LLMsTxt
  url: llms/scanner-llms.txt
- type: AgenticAccess
  url: agentic-access/scanner-agentic-access.yml
- type: TrustCenter
  url: security/scanner-trust-center.yml
- type: DomainSecurity
  url: security/scanner-domain-security.yml
- type: Website
  url: https://scanner.dev/
x-enrichment:
  date: '2026-07-21'
  status: enriched
  artifacts_added: 19
  pass: local-v1