Skip to content
Wholisphere Docs

Hosted scanning

Hosted scanning lets Wholisphere run scans on your behalf. There’s no CLI to install and no runner for you to operate — you enqueue a job and our fleet claims, executes, and reports it back.

Enqueue a scan

Dashboard: open Hosted scans → Scan a site, paste a URL, and watch the status move Queued → Scanning… → Done.

API (dashboard session, editor role or higher — hosted-scan routes are session-authenticated, not API-key):

Terminal window
curl -X POST https://api.wholisphere.ai/v1/orgs/{orgId}/hosted-scans \
  -H "cookie: whs_session=$SESSION" \
  -H "content-type: application/json" \
  -d '{ "productName": "Acme App", "urls": ["https://example.com"] }'
# → { "ok": true, "scanId": "…", "jobId": "…", "status": "queued" }

Pass exactly one of urls (up to 500) or sitemap. Optional: productVersion, browserMode (Playwright for SPA/auth-walled pages), assessFacilitation.

List jobs and their status (any org member):

Terminal window
curl https://api.wholisphere.ai/v1/orgs/{orgId}/hosted-scans \
  -H "cookie: whs_session=$SESSION"

See the OpenAPI spec for the exact request/response fields.

How it works

  • The job goes into a lease-based claim queue. A runner claims it with a short lease and a unique token; if a runner crashes, its lease expires and the job is reclaimed (capped at 3 attempts).
  • The runner holds no customer credentials — it’s scoped to the claimed job’s org and only submits findings and completion for that job.
  • Completion runs the same finalize path as a self-run scan, so regression detection, email alerts, and GitHub issue creation behave identically.

SPA and signed-in pages

The browser runner loads JS-rendered pages and can sign in with a stored session, so scans see what a logged-in user sees. Ask us to configure an authenticated hosted scan for gated flows (checkout, admin, dashboards).