Partner API

The API uses a per-partner bearer key. Keys are issued by the Wolfix team (no self-serve in v1) and shown to you exactly once at creation — store it securely; Wolfix only retains a hash and cannot recover the plaintext. Send it on every request:

Authorization: Bearer wpk_live_xxxxxxxxxxxxxxxxxxxxxxxx

Keys are scoped to your partner account: you can only read scans that were attributed to you via ?ref= referral. A missing or invalid key returns 401. A valid key reading a scan that isn't attributable to you returns 403. To rotate a key, contact the Wolfix team — rotation issues a new key and revokes the old one immediately.

GET https://wolfix.io/api/v1/partners/scans/{scanId}

scanId is the Wolfix scan UUID. Returns the scan summary if the scan exists and is attributable to your partner account.

A successful request returns 200 with this shape:

{
  "scan": {
    "id": "f3a1c2d4-...",
    "created_at": "2026-05-29T12:00:00.000Z",
    "scanned_url": "https://acme.app",
    "status": "complete",            // pending | running | complete | failed
    "completion_percentage": 100
  },
  "summary": { "blockers": 3, "issues": 7, "covered": 12 },
  "departments": [
    {
      "department": "legal",         // legal, security, technology,
      "status": "blockers",          //   brand, growth, operations (6, fixed order)
      "blocker_count": 2,            // status = worst severity present:
      "issue_count": 1,             //   blockers > issues > clear
      "covered_count": 3
    }
    // ... exactly 6 departments
  ],
  "meta": { "version": "v1", "partner": "lovable" }
}

Counts only populate once status is complete; while a scan is still running the counts are zero and completion_percentage reflects progress, so you can poll. Free-tier scans are included — a referred scan is attributable signal regardless of whether the user paid.

Never returned: gap titles or descriptions, code-level findings, referral recommendations, customer email, user id, or project name. The response is counts-only by design.

• 200Valid key; scan attributable to you.
• 400Malformed scan id.
• 401Missing, malformed, or revoked API key.
• 403Valid key, but the scan is not attributable to your partner account.
• 404Scan id does not exist.
• 429Rate limit exceeded. Includes a Retry-After header (seconds).

Browser requests are allowed only from the origins registered for your partner account. A request from a registered origin receives the reflected Access-Control-Allow-Origin header; other origins are blocked by the browser. Server-to-server calls (no Origin header) are always permitted with a valid key. Wolfix never responds with a wildcard * origin. To register an origin, contact the Wolfix team.

The default limit is 60 requests per minute per key, configurable per partner. Exceeding it returns 429 with a Retry-After header indicating how many seconds to wait.

The API is versioned in the path (/api/v1/). Additive, backward-compatible changes — new fields on existing objects — ship on v1 without notice; integrations should ignore unknown fields. Breaking changes (field removals or renames) ship under a new major version (/api/v2/) and v1 continues to be served during a deprecation window. The response meta.version echoes the served version.

A signed, embeddable scan-summary widget (drop-in iframe) is on the roadmap as a v2 addition; v1 is JSON only.