API Documentation

v0.2.0 · Updated 2026-05-03

The ShadowCypher API is a Cloudflare Worker exposing JSON over HTTPS. Use it to build custom integrations, automate scans, or replace the dashboard entirely.

Authentication

Every endpoint except /v1/health and /v1/billing/webhook requires a Bearer token:

Authorization: Bearer sc_live_<48 hex chars>

Get your key from your dashboard. To rotate, call POST /v1/keys/rotate — old key invalidated immediately.

Base URL

https://api.shadowcypher.site

The legacy workers.dev endpoint (https://shadowcypher-api.shadowcypher.workers.dev) is still active but deprecated — migrate to the custom domain.

Users

Example: GET /v1/me

$ curl https://shadowcypher-api.shadowcypher.workers.dev/v1/me \
    -H "Authorization: Bearer sc_live_..."

{
  "id": "uuid",
  "email": "you@example.com",
  "handle": "you",
  "plan": "community",
  "effective_plan": "guardian_pro",
  "in_trial": true,
  "trial_days_remaining": 11,
  "subscription_status": null
}

Guardian (devices, scans, incidents)

Plan limits

Notifications

AI assistant

Quotas (platform AI only — BYOK and Ollama are unmetered)

• Community: 0 (assistant locked)
• Guardian Pro: 50 / month
• Operator: 500 / month

Threat feed (CVE)

Live CVE data from the NIST NVD API. No API key required. Responses are cached at the edge for 1 hour.

Example response — GET /v1/threats?severity=CRITICAL&limit=5

{
  "cves": [
    {
      "id": "CVE-2025-12345",
      "description": "...",
      "severity": "CRITICAL",
      "cvss": 9.8,
      "published": "2025-05-01T00:00:00.000Z",
      "modified": "2025-05-02T12:00:00.000Z",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12345",
      "cwe": "CWE-787"
    }
  ],
  "total": 5,
  "days": 7,
  "as_of": "2025-05-08T00:00:00.000Z"
}

Outbound webhooks

Pro feature. Forward incidents to Slack / Discord / PagerDuty / any HTTPS URL. Each webhook is signed with a per-webhook HMAC-SHA256 secret.

Verifying signatures (your receiver)

const sig = req.headers.get('X-ShadowCypher-Signature').slice(7); // strip "sha256="
const expected = hmacSha256Hex(YOUR_SIGNING_SECRET, await req.text());
if (!constantTimeEqual(sig, expected)) throw new Error('invalid signature');

Integration recipes

Datadog: Create a webhook to https://http-intake.logs.datadoghq.com/api/v2/logs?dd-api-key=YOUR_KEY. ShadowCypher incidents map to Datadog log entries with service:shadowcypher.

Splunk HEC: Point the webhook at https://YOUR_SPLUNK_HOST:8088/services/collector/event with header Authorization: Splunk YOUR_HEC_TOKEN. Use a middleware relay to reformat the payload if needed.

ConnectWise / ServiceNow: Use the generic HTTPS webhook to hit the platform's REST API. Set min_severity=warning to avoid ticket noise from info-level events.

PagerDuty: Create an Events API v2 integration in PagerDuty, copy the Integration Key, and register https://events.pagerduty.com/v2/enqueue as your webhook URL with min_severity=critical.

Teams (Operator only)

Members of an Operator team automatically inherit Operator-tier features.

Billing

Error responses

All errors return JSON: {"error": "code", "message": "..."} with appropriate HTTP status.

Source: github.com/jakes1345/ShadowCypher · Home · Blog · Self-Host · Privacy · Terms