List malware scan findings

GET

https://api.modulards.com/api/public/v1/site-scan-items

GET

/api/public/v1/site-scan-items

curl https://api.modulards.com/api/public/v1/site-scan-items \
     -H "Authorization: Bearer <token>"

200200 - Scan findings list

{
  "data": [
    {
      "attributes": {
        "column_name": null,
        "created_at": "2026-09-18T09:12:00.000000Z",
        "path": "wp-content/uploads/2026/09/shell.php",
        "severity": "critical",
        "site_scan_id": 3021,
        "status": "detected",
        "table_name": null,
        "threat_category": "infected",
        "type": "file"
      },
      "id": "9931",
      "type": "site-scan-items"
    },
    {
      "attributes": {
        "column_name": "post_content",
        "created_at": "2026-09-18T09:13:00.000000Z",
        "path": null,
        "severity": "medium",
        "site_scan_id": 3021,
        "status": "detected",
        "table_name": "wp_posts",
        "threat_category": "suspicious",
        "type": "database"
      },
      "id": "9932",
      "type": "site-scan-items"
    }
  ],
  "jsonapi": {
    "version": "1.1"
  },
  "links": {
    "first": "{{base_url}}/api/public/v1/site-scan-items?page%5Bnumber%5D=1",
    "last": "{{base_url}}/api/public/v1/site-scan-items?page%5Bnumber%5D=1",
    "next": null,
    "prev": null
  },
  "meta": {
    "current_page": 1,
    "from": 1,
    "last_page": 1,
    "links": [
      {
        "active": false,
        "label": "&laquo; Previous",
        "url": null
      },
      {
        "active": true,
        "label": "1",
        "url": "{{base_url}}/api/public/v1/site-scan-items?page%5Bnumber%5D=1"
      },
      {
        "active": false,
        "label": "Next &raquo;",
        "url": null
      }
    ],
    "path": "{{base_url}}/api/public/v1/site-scan-items",
    "per_page": 15,
    "to": 2,
    "total": 2
  }
}

Lists the findings of your malware scans, newest first. Use filter[site_scan][] for the findings of one scan, or filter[site][] for every finding of a website across scans.

Each finding is a file or a database threat. Its threat_category says what it needs: infected is cleaned by replacing content, malicious is deleted or truncated and suspicious needs a human decision. The raw file hash and the malware signature name are never exposed.

Authentication

AuthorizationBearer

Personal access token created in the Modular DS dashboard; read-only tokens can only call GET endpoints.

Query parameters

filter[id][]stringOptional

Exact finding ids. Repeat the parameter for several.

filter[site_scan][]stringOptional

Exact scan ids: the findings of those scans. Repeat the parameter for several.

filter[site][]stringOptional

Exact website ids: every finding of those websites across scans. Repeat the parameter for several.

filter[type][]stringOptional

Where the finding came from: file or database. Repeat the parameter for several.

filter[severity][]stringOptional

low, medium, high or critical. Repeat the parameter for several.

filter[threat_category][]stringOptional

infected, malicious or suspicious. Repeat the parameter for several.

filter[status][]stringOptional

detected, ignored or failed. Repeat the parameter for several.

sortstringOptional

created_at or severity; prefix with - for descending. Default: -created_at. -severity lists critical findings first.

page[number]stringOptional

Page number, starting at 1. Default 1.

page[size]stringOptional

Items per page, 1 to 50. Default 15.

Response

200 - Scan findings list

datalist of objectsOptional

jsonapiobjectOptional

linksobjectOptional

metaobjectOptional