Recon API Reference

Base URL: the hosted beta at https://app.xcloak.tech, or http://localhost:8000 if self-hosting. Bearer-token auth via POST /api/v1/auth/login unless noted.

Authentication

Account creation and JWT/API-key issuance

Method	Path	Description
POST	/api/v1/auth/register	Create account
POST	/api/v1/auth/login	Get JWT tokens
GET	/api/v1/auth/me	Current user
POST	/api/v1/auth/api-keys	Create API key

Scanning

Start scans, watch them live, and approve AI-proposed follow-ups

Method	Path	Description
POST	/api/v1/hybrid/execute	Start a scan
GET	/api/v1/hybrid/status/{id}	Scan status + report
GET	/api/v1/hybrid/proposals/{id}	Pending AI proposals
POST	/api/v1/hybrid/approve/{id}	Approve/reject proposals
GET	/api/v1/hybrid/report/{id}/pdf	Download PDF report
WS	/api/v1/ws/scan/{id}	Live scan events

Findings

Search and aggregate findings across scans

Method	Path	Description
GET	/api/v1/auth/findings	Search findings (filters: severity, source, port, search)
GET	/api/v1/auth/findings/stats	Aggregated stats
GET	/api/v1/auth/scans/{id}/findings	Findings for a scan

Scheduled Scans

Cron-like recurring scans built from reusable templates

Method	Path	Description
POST	/api/v1/schedules/templates	Create scan template
GET	/api/v1/schedules/templates	List templates
POST	/api/v1/schedules/	Create scheduled scan
GET	/api/v1/schedules/	List schedules
PUT	/api/v1/schedules/{id}/toggle	Pause/resume

System

Runtime info, LLM provider switching, audit log, and target allowlist

Method	Path	Description
GET	/api/v1/system/info	System info + current LLM provider
POST	/api/v1/system/llm/switch	Switch LLM provider
GET	/api/v1/system/audit	Query audit logs
GET	/api/v1/system/targets	List target allowlist
POST	/api/v1/system/targets	Add a target to the allowlist