Luna AI API

Autonomous security scanning via a simple REST API. Detect vulnerabilities, scan dependencies, and monitor uptime — all from your CI/CD pipeline or application.

The Luna AI API is built on Vercel serverless functions and uses Server-Sent Events (SSE) for real-time streaming of scan results. Results are delivered progressively as Luna analyzes each vulnerability, so you can display findings as they arrive.

Base URL: https://meet-luna-ai.vercel.app

Authentication

All scan endpoints require an API key passed via the x-api-key HTTP header. You can generate an API key from the Luna AI dashboard after signing in.

x-api-key: luna_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Keep your key secret. Never expose your API key in client-side JavaScript or public repositories. Use environment variables.

Getting an API Key

1. Sign in at meet-luna-ai.vercel.app
2. Open the Developer API panel
3. Click Generate Key
4. Copy and store your key securely — it won't be shown again

Endpoints

GET /api/scan

Scan a URL for security vulnerabilities including XSS, SQL injection, exposed secrets, outdated headers, and misconfigurations. Returns a streaming SSE response.

Parameter	Type	Required	Description
url	string	Required	The full URL to scan (must include scheme, e.g. https://)

POST /api/dep-scan

Scan a package.json manifest for known vulnerable dependencies using the OSV (Open Source Vulnerabilities) database. Streams results as findings are discovered.

Parameter	Type	Required	Description
packages	object	Required	Key-value map of package name to version (from dependencies)
devPackages	object	Optional	Key-value map from devDependencies

POST /api/monitor

Create, update, delete, or list uptime monitors. Monitors are checked every 5 minutes and results are stored in Supabase.

Parameter	Type	Required	Description
action	string	Required	create \| delete \| list
url	string	Optional	URL to monitor (required for create)
label	string	Optional	Human-readable name for the monitor
id	string	Optional	Monitor ID (required for delete)

Code Examples

Scan a URL

# Stream results in real-time
curl -N -H "x-api-key: YOUR_KEY" \
  "https://meet-luna-ai.vercel.app/api/scan?url=https://example.com"

Scan dependencies

curl -X POST \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"packages":{"express":"4.18.2","lodash":"4.17.20"}}' \
  "https://meet-luna-ai.vercel.app/api/dep-scan"

Create a monitor

curl -X POST \
  -H "x-api-key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"create","url":"https://example.com","label":"My Site"}' \
  "https://meet-luna-ai.vercel.app/api/monitor"

Scan a URL (streaming)

const response = await fetch(
  'https://meet-luna-ai.vercel.app/api/scan?url=https://example.com',
  { headers: { 'x-api-key': 'YOUR_KEY' } }
);

const reader = response.body.getReader();
const decoder = new TextDecoder();

while (true) {
  const { done, value } = await reader.read();
  if (done) break;
  const lines = decoder.decode(value).split('\n');
  for (const line of lines) {
    if (line.startsWith('data: ')) {
      const data = JSON.parse(line.slice(6));
      console.log(data);
    }
  }
}

Scan dependencies

const pkg = await import('./package.json', { assert: { type: 'json' } });

const res = await fetch(
  'https://meet-luna-ai.vercel.app/api/dep-scan',
  {
    method: 'POST',
    headers: {
      'x-api-key': 'YOUR_KEY',
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      packages: pkg.dependencies,
      devPackages: pkg.devDependencies
    })
  }
);

const result = await res.json();
console.log(result);

Scan a URL (streaming)

import requests

url = "https://meet-luna-ai.vercel.app/api/scan"
headers = {"x-api-key": "YOUR_KEY"}
params = {"url": "https://example.com"}

with requests.get(url, headers=headers, params=params, stream=True) as r:
    for line in r.iter_lines():
        if line.startswith(b"data: "):
            import json
            data = json.loads(line[6:])
            print(data)

Scan dependencies

import requests, json

with open("package.json") as f:
    pkg = json.load(f)

res = requests.post(
    "https://meet-luna-ai.vercel.app/api/dep-scan",
    headers={
        "x-api-key": "YOUR_KEY",
        "Content-Type": "application/json"
    },
    json={
        "packages": pkg.get("dependencies", {}),
        "devPackages": pkg.get("devDependencies", {})
    }
)
print(res.json())

Rate Limits

Rate limits are applied per API key per minute. Exceeding the limit returns a 429 Too Many Requests response.

Tier	Requests / min	Concurrent scans	Monitor slots
Free	5	1	3
Pro	Unlimited	5	50
Enterprise	Unlimited	Unlimited	Unlimited

Rate limit headers are included in every response:

X-RateLimit-Limit: 5
X-RateLimit-Remaining: 3
X-RateLimit-Reset: 1712345678

Response Format

Scan endpoints (/api/scan, /api/dep-scan) return Server-Sent Events (SSE) — a streaming text format where each event is a line starting with data: followed by JSON.

SSE Event Types

status

Scan lifecycle updates: scanning, analyzing, complete. Contains { type: "status", message: "..." }

finding

A single vulnerability finding. Contains severity, title, description, and remediation advice.

summary

Final scan summary with counts by severity. Sent after all findings.

error

Scan-level error (e.g. unreachable target, auth failure). Contains { type: "error", message: "..." }

Example SSE stream

data: {"type":"status","message":"Scanning https://example.com..."}

data: {"type":"finding","severity":"HIGH","title":"Missing Content-Security-Policy","description":"No CSP header found.","remediation":"Add a Content-Security-Policy header."}

data: {"type":"summary","critical":0,"high":1,"medium":2,"low":0,"info":3}

data: {"type":"status","message":"complete"}

Finding object schema

{
  "type":         "finding",
  "severity":     "CRITICAL" | "HIGH" | "MEDIUM" | "LOW" | "INFO",
  "title":        "string",
  "description": "string",
  "remediation": "string",
  "url":          "string (optional)",
  "package":      "string (dep-scan only)",
  "version":      "string (dep-scan only)",
  "cve":          "string (dep-scan only, e.g. CVE-2023-1234)"
}