---
title: "urlscan.io integration for LuumenAI"
url: "https://www.luumen.ai/integrations/urlscan-io/"
entity: SoftwareIntegration
category: "Identity & security"
audience: "SRE, DevOps, platform engineering, IT operations"
---

# urlscan.io integration for LuumenAI

Scan suspicious URLs, search urlscan data, and run Pro incidents from the terminal

## What LuumenAI can do with urlscan.io

LuumenAI connects to urlscan.io with an API token and exposes 50 tools (28 read-only · 17 write · 5 destructive). For connected tools, admins configure which actions may run automatically and which require approval, within the access granted to the user.

## Key facts

- Authentication: API token
- Tools available: 50 tools (28 read-only · 17 write · 5 destructive)
- Deployment: scoped as part of your Pilot, Platform, or Managed rollout
- Category: Identity & security

## About urlscan.io with LuumenAI

Connect urlscan.io and your agent can pull scan evidence while you work — DOM snapshots, captured response content, hostname history, brand detections, and current API quota. When an investigation needs a new scan or a monitored incident, the agent writes to urlscan as a previewed step you approve. Luumen authenticates with an API key.

## Example tools

Read-only (28 in total):

- `URLSCANIO_DOWNLOAD_FILE` — Retrieve a captured binary file by its SHA-256 hash as a password-encrypted ZIP archive.
- `URLSCANIO_GET_ACCOUNT_CAPABILITIES` — Get non-sensitive plan, product, feature, visibility, submission, and limit information for the connected urlscan.io API key.
- `URLSCANIO_GET_BRAND_SUMMARY` — Return detectable brands with detected-page totals and latest hits.
- `URLSCANIO_GET_CHANNEL` — Get one urlscan Pro notification channel by ID while preserving provider-specific metadata and removing webhook destinations or credentials.
- `URLSCANIO_GET_DATA_DUMP_LINK` — Generate a temporary download URL for a path returned by LIST_DATA_DUMPS.
- `URLSCANIO_GET_DOM` — Return the plain-text DOM snapshot captured for a completed scan.
- `URLSCANIO_GET_HOSTNAME_HISTORY` — Return one page of historical Pro Hostnames observations for a hostname.
- `URLSCANIO_GET_INCIDENT` — Get one incident's configuration, source, runtime state, and timestamps.

Write and destructive (22 in total, subject to configured approval policy):

- `URLSCANIO_CLOSE_INCIDENT` — Stop ongoing scans for an active urlscan Pro incident and transition it to the closed state.
- `URLSCANIO_COPY_INCIDENT` — Create a separate urlscan Pro incident from an existing incident's configuration.
- `URLSCANIO_CREATE_CHANNEL` — Create a Pro notification channel.
- `URLSCANIO_CREATE_INCIDENT` — Create a Pro incident that persistently monitors an observable.
- `URLSCANIO_CREATE_LIVE_SCAN_BLOCKING` — Run a temporary Live Scan synchronously and return only after the provider finishes the scan.
- `URLSCANIO_CREATE_LIVE_SCAN_TASK` — Start a non-blocking temporary Live Scan on a selected scanner and return its UUID immediately without waiting for completion.
- `URLSCANIO_CREATE_SAVED_SEARCH` — Create a reusable scans or hostnames search definition.
- `URLSCANIO_CREATE_SUBSCRIPTION` — Create a persistent scheduled or live alert subscription for saved searches.

## Frequently asked questions

### How does LuumenAI connect to urlscan.io?

Authorize once with API token. Luumen lists the scopes each action needs before you approve the connection, and credentials never appear in the chat.

### Can LuumenAI change things in urlscan.io on its own?

For connected tools, admins configure which actions may run automatically and which require approval, within the access granted to the user.

### Is there an audit trail?

Every call to urlscan.io — read or write, approved or declined — is recorded with the actor, the input, and the result.

Full page: https://www.luumen.ai/integrations/urlscan-io/