Developer Domains1.0.0-beta.1

Request a domain security audit

Queues an audit for an existing domain in the token’s Space or reuses the current run during the domain cooldown. Send an empty JSON object and reuse the same key for retries. The beta allows 10 new audit jobs and 100 distinct receipt keys per Space per UTC day. Receipts are available for seven days. The Location header points to the current audit status.

POST/api/v1/domains/{domain}/security-audits

Workspace automation for approved Dashio products. Each token is scoped to one Space and independently granted operations. Requests spend shared minute credits, and selected operation groups also share hourly quotas.

Required token scope is domains:security:write. Scopes are independent.

This operation uses 8 credits from a shared budget of 60 credits per token and 300 per Space each UTC minute. The provider group shares 40 requests per token and 100 per Space each UTC hour.

Run these examples on a trusted server with DASHIO_API_TOKEN configured. Use a private terminal when inspecting response data. Examples send one request with a bounded timeout and do not retry automatically.

Set DASHIO_IDEMPOTENCY_KEY to the persisted key for this logical write. Reuse it only for an identical retry.

Authentication

Dashio developer token (HTTP Bearer) API authentication guide

Path parameters

domainstringRequired: Registered domain in lowercase ASCII or punycode.
Example"example.com"

Query parameters

None documented.

Header parameters

Idempotency-KeystringRequired: Use 16 to 128 ASCII letters, digits, underscores or hyphens. Reuse the same key when retrying this domain audit. Minimum length: 16. Maximum length: 128. Pattern: ^[A-Za-z0-9_-]+$.
Example"61d9263e-143b-4407-90fd-e3b54df67c96"

Request body

application/json · Required

An empty JSON object, up to 256 bytes. The URL determines the registered domain.

valueobjectOptional: No field description supplied.

Request & response examples

Copy an example in your preferred language.

request.sh

: "${DASHIO_API_TOKEN:?Set DASHIO_API_TOKEN before running this example}"
: "${DASHIO_IDEMPOTENCY_KEY:?Set DASHIO_IDEMPOTENCY_KEY before running this example}"

curl --fail-with-body --include --silent --show-error --connect-timeout 10 --max-time 30 \
  --request POST 'https://app.dashio.net/api/v1/domains/{domain}/security-audits' \
  --header "Authorization: Bearer $DASHIO_API_TOKEN" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $DASHIO_IDEMPOTENCY_KEY" \
  --data '{}'

Replace URL parameters, credentials, and schema placeholders before running. No request is sent by this page.

Schema-generated example; not a captured response.

{
  "audit": {
    "auditId": "d40beec9-3477-45cb-92e4-152f5b9d0686",
    "domain": "<domain>",
    "status": "queued",
    "requestedAt": "2026-01-01T12:00:00Z",
    "startedAt": "2026-01-01T12:00:00Z",
    "finishedAt": "2026-01-01T12:00:00Z"
  },
  "replayed": false
}

Run examples on a trusted server. Configure the environment variables and replace URL or schema placeholders. For a write, reuse its saved idempotency key only when retrying the identical request.

Responses

Headers on every response

X-Request-Idstring (uuid)Optional: Server-generated ID to include in a support request.

200

A terminal audit receipt reused during the cooldown or replayed from the same key.

Response headers

RateLimit-LimitintegerOptional: Per-token capacity in the reported gateway window, expressed in requests of this operation. A shared Space budget also applies. Present when the request reaches the authenticated gateway. Minimum: 1.
RateLimit-RemainingintegerOptional: Requests of this operation remaining under the current token, Space and applicable operation-group quotas. Present when the request reaches the authenticated gateway. Minimum: 0.
RateLimit-ResetintegerOptional: Unix timestamp in seconds when the reported gateway quota resets. Present when the request reaches the authenticated gateway. Minimum: 0.
Locationstring (uri-reference)Required: Relative URL to poll the current audit status.
Idempotency-ReplayedstringOptional: Present as true when returning the original acceptance receipt for the supplied key. Required value: "true".

application/json

auditobjectRequired: No field description supplied.
replayedbooleanRequired: True for a replay of the original acceptance receipt.

202

Audit queued or already running. Poll the Location URL for current status.

Response headers

RateLimit-LimitintegerOptional: Per-token capacity in the reported gateway window, expressed in requests of this operation. A shared Space budget also applies. Present when the request reaches the authenticated gateway. Minimum: 1.
RateLimit-RemainingintegerOptional: Requests of this operation remaining under the current token, Space and applicable operation-group quotas. Present when the request reaches the authenticated gateway. Minimum: 0.
RateLimit-ResetintegerOptional: Unix timestamp in seconds when the reported gateway quota resets. Present when the request reaches the authenticated gateway. Minimum: 0.
Locationstring (uri-reference)Required: Relative URL to poll the current audit status.
Idempotency-ReplayedstringOptional: Present as true when returning the original acceptance receipt for the supplied key. Required value: "true".

application/json

Uses the same response body schema as HTTP 200.

400

Invalid domain, JSON body, or missing or malformed idempotency key.

application/json

statusCodeintegerRequired: Minimum: 400. Maximum: 599.
statusMessagestringOptional: A safe explanation suitable for display.
dataobjectRequired: No field description supplied.

401

Developer token is missing or invalid.