TrustSek API

The API is small today, and this page documents exactly what it does. It has one endpoint. It creates a company in your organisation and can start a scan in the same call. The scan then runs as it would from the app, and you read the results in the app.

API version: 1.0.0.

Authentication

Every request needs an API key, sent as a Bearer token in the Authorization header.

• Keys are created in the app under Settings → API Keys. Only the organisation owner can create one.
• A key starts with es_. It is shown once, when you create it, so store it in your secret manager straight away.
• A key belongs to your organisation. Everything it creates lands in that organisation.
• A revoked key stops working immediately.

A missing, malformed, unknown or revoked key returns 401.

Base URL

https://api.trustsek.com/v1

Add a company and start a scan

POST /v1/subjects creates a company (a “subject”) in your organisation. Add ?scan=true to start a scan as soon as it is created.

curl -X POST "https://api.trustsek.com/v1/subjects?scan=true" \
  -H "Authorization: Bearer es_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Example Ltd", "primaryDomain": "example.com"}'

Request body

Query parameters

Response

A successful request returns 201 Created:

{
  "id": "3f1c2a9e-7b4d-4e7a-9c1f-2d8e5b6a0c41",
  "name": "Example Ltd",
  "primaryDomain": "example.com",
  "createdAt": "2026-09-27T09:30:00.000Z",
  "runId": "9a7e4c10-5d2b-4f3e-8a61-0b9c7d2e4f58"
}

• id is the new company's ID.
• runId is the ID of the scan that was started. It is null when you did not pass scan=true. It is also null if the company was created but the scan could not be queued, so check it rather than assume a scan is running.

The IDs above are examples.

Errors

Each call creates a new company. The endpoint does not check whether the domain is already in your organisation, so avoid retrying a request that may already have succeeded.

What the API does not do yet

The API does not return scores, findings or scan status. There are no endpoints to list, update or delete companies, and no webhooks. After you start a scan, you see the result in the app, the same as a scan started there.

There are no published rate limits, SDKs or service levels for the API.

If you need something the API does not do yet, tell us. Requests shape what we build next.

How the scan is scored

A scan started through the API uses the same six modules, weights and scoring policy as one started in the app. The methodology explains how evidence becomes a score, and what the score cannot see.

Who uses it

IT partners use it to add a batch of client domains without typing each one into the app; see for IT partners. Insurers and brokers use it to add the domains they quote; see for insurers.

To get a key, sign up or log in to the app and open Settings → API Keys. Pricing explains who pays for what. Questions about the API go to contact.