Close Incident
Stop ongoing scans for an active urlscan Pro incident and transition it to the closed state. Closing does not delete the incident or its history, and the incident can later be restarted.
ActionTry it
Integrate urlscan.io
with your AI CRM
Submit and retrieve website scans, search urlscan.io data, and manage urlscan Pro resources for threat intelligence and security investigations.
Explore Triggers and Actions
Copy Incident
Create a separate urlscan Pro incident from an existing incident's configuration. This create operation can consume incident capacity and does not copy the source incident's stored state history; use the distinct fork operation when history must be preserved. The provider does not document whether the copied incident immediately activates ongoing scans or alerts.
ActionTry it
Create Alert Subscription
Create a persistent scheduled or live alert subscription for saved searches. This Pro-only operation has external notification side effects: an active subscription can send email, invoke configured channels or webhooks, and create incidents. Confirm all recipients and channel or incident settings before calling.
ActionTry it
Create Incident
Create a Pro incident that persistently monitors an observable. This high-impact operation starts ongoing external scans and can send alerts through every supplied notification channel; confirm the observable, visibility, channels, cadence, and expiration settings before calling. The operation is contract-only because the connected build account lacks the urlscan Pro Incidents entitlement.
ActionTry it
Create Live Scan Task
Start a non-blocking temporary Live Scan on a selected scanner and return its UUID immediately without waiting for completion. This external scan side effect requires the separate urlscan.io Live Scanning entitlement; a generic Pro plan may not include it.
ActionTry it
Create Notification Channel
Create a Pro notification channel. This operation configures external effects: active webhook channels send requests to the supplied secret URL, and active email channels send messages to the supplied recipients. Confirm the destination and activation settings before calling.
ActionTry it
Create Saved Search
Create a reusable scans or hostnames search definition. This operation creates a persistent saved search and requires urlscan Pro; the hostnames datasource may require an additional product entitlement.
ActionTry it
Delete Alert Subscription
Permanently delete an alert subscription by ID. This destructive operation cannot be undone and requires urlscan Pro subscriptions access plus ownership or team write permission. Use it only for a subscription created or explicitly selected by the current workflow.
ActionTry it
Delete Saved Search
Permanently delete a saved search by ID. This destructive operation cannot be undone and requires urlscan Pro saved-search access plus ownership or team write permission. Use it only for a saved search created or explicitly selected by the current workflow.
ActionTry it
Delete Scan Result
Permanently delete a scan owned by the connected user or team. This destructive operation cannot be reversed and requires urlscan Pro.
ActionTry it
Download Captured File
Retrieve a captured binary file by its SHA-256 hash as a password-encrypted ZIP archive. This operation requires urlscan Pro access.
ActionTry it
Fork Incident
Create a new Pro incident by copying an existing incident's configuration and complete stored state history. This creates a separate persistent incident; history volume and whether monitoring starts immediately are not documented.
ActionTry it
Get Account Capabilities
Get non-sensitive plan, product, feature, visibility, submission, and limit information for the connected urlscan.io API key.
ActionTry it
Get API Quotas
Get current products, features, query capabilities, and per-action minute, hour, and day quota usage.
ActionTry it
Get Available Brands
List brand identifiers and metadata tracked by urlscan.io brand and phishing detection. Requires urlscan Pro brand/phishing access; the exact product and minimum plan are not documented.
ActionTry it
Get Available Scan Countries
List scanner country codes currently accepted by the Scan API.
ActionTry it
Get Brand Summary
Return detectable brands with detected-page totals and latest hits. This operation requires urlscan Pro access and uses the official contract only; the provider does not document its response fields.
ActionTry it
Get Captured Response Content
Return textual content captured in a scan response, addressed by its SHA-256 hash.
ActionTry it
Get Data Dump Download Link
Generate a temporary download URL for a path returned by LIST_DATA_DUMPS. Data Dumps require an Enterprise or Ultimate urlscan.io plan.
ActionTry it
Get Deprecated Phishing Feed
Retrieve the deprecated urlscan Pro phishing feed in JSON, CSV, or TSV. Prefer SEARCH_SCANS for new workflows, as recommended by urlscan.io.
ActionTry it
Get Hostname History
Return one page of historical Pro Hostnames observations for a hostname.
ActionTry it
Get Incident
Get one incident's configuration, source, runtime state, and timestamps.
ActionTry it
Get Incident States
Retrieve the stored state history for an incident.
ActionTry it
Get Live Scan Resource
Retrieve one temporary result, DOM, screenshot, captured response, or download from the separate urlscan.io Live Scanning product. JSON and text are returned inline; binary content is offloaded as a downloadable file.
ActionTry it
Get Notification Channel
Get one urlscan Pro notification channel by ID while preserving provider-specific metadata and removing webhook destinations or credentials.
ActionTry it
Get Saved Search Results
Run a urlscan Pro saved search and return its current Search API results. The provider redirect is followed automatically; this operation does not expose pagination controls.
ActionTry it
Get Scan DOM
Return the plain-text DOM snapshot captured for a completed scan.
ActionTry it
Get Scan Result
Retrieve the complete metadata and captured request data for a completed scan UUID.
ActionTry it
Get Scan Screenshot
Retrieve a completed urlscan.io scan screenshot as a downloadable PNG file reference.
ActionTry it
Get Scan User Agents
List grouped browser user-agent strings available for scan submission.
ActionTry it
Get Similar Scan Results
Find one page of scan results structurally similar to a specified scan. Requires urlscan Pro access.
ActionTry it
Get Subscription Results
Resolve a urlscan Pro alert subscription and datasource to its current Search API results. The provider redirect is followed automatically; this operation does not expose pagination controls.
ActionTry it
Get Watchable Incident Attributes
List attribute values accepted when configuring incident change monitoring. Requires urlscan Pro Incidents capability; the exact minimum plan or product is not documented.
ActionTry it
List Alert Subscriptions
List alert subscriptions configured for the current user. This operation requires urlscan Pro subscriptions access.
ActionTry it
List Data Dumps
List available urlscan.io data-dump files for a time window, file type, and date. Requires an Enterprise or Ultimate plan; availability can vary by window and file type.
ActionTry it
List Live Scanners
List Live Scanning nodes available to the connected account and their current metadata. This requires the separate urlscan.io Live Scanning product; a generic urlscan Pro plan may not include it.
ActionTry it
List Notification Channels
List email and webhook notification channels for the current user without returning webhook URLs or embedded credentials. This operation requires urlscan Pro channels access.
ActionTry it
List Saved Searches
List saved searches owned by or shared with the current user. This operation requires urlscan Pro saved-search access.
ActionTry it
Lookup Malicious Observable
Look up malicious-scan occurrence counts and first/last seen timestamps for an IP, hostname, domain, or exact URL. Requires urlscan Pro malicious-observable access.
ActionTry it
Purge Live Scan Result
Permanently delete a temporary result from the separate urlscan.io Live Scanning product before its normal expiration. This destructive operation cannot be undone; only use it to clean up a temporary result created by the current workflow.
ActionTry it
Reset Scan Visibility
Remove an owned scan's visibility override and restore the visibility originally assigned at submission. This resets an override; it does not delete the scan. Requires urlscan Pro.
ActionTry it
Restart Incident
Restart a closed urlscan Pro incident and extend its expiry. This resumes ongoing external monitoring, begins recording new incident states, and can resume alerts through the incident's configured notification channels; confirm the incident should become active again before calling. This operation is contract-only because the connected build account lacks Pro Incidents access.
ActionTry it
Run Blocking Live Scan
Run a temporary Live Scan synchronously and return only after the provider finishes the scan. This requires the separate Live Scanning product.
ActionTry it
Search Scans
Search urlscan.io data with Elasticsearch Query String syntax and return one controllable page of results.
ActionTry it
Store Live Scan Result
Permanently store an existing temporary Live Scan result with the selected visibility. This updates the temporary result into a durable snapshot and requires the separate urlscan.io Live Scanning entitlement; a generic urlscan Pro plan may not include it.
ActionTry it
Submit Scan
Submit a URL for asynchronous external scanning, creating persistent result state and consuming quota. Visibility defaults to public, and free accounts have no cleanup operation. Returns the scan UUID for result and asset retrieval.
ActionTry it
Update Alert Subscription
Replace the complete configuration of an existing alert subscription. This Pro-only PUT requires every mandatory field, not only changed values. It has external notification side effects: activating the subscription or changing recipients, channels, webhooks, or incident settings can send notifications or create incidents. Confirm the complete replacement configuration before calling.
ActionTry it
Update Incident
Replace an existing incident's monitoring configuration and runtime options. This Pro-only PUT requires observable, visibility, and the complete channel set, not only changed values. Updating it changes ongoing external scanning and can redirect or trigger future channel alerts; confirm the complete replacement configuration before calling.
ActionTry it
Update Notification Channel
Replace the complete configuration of an existing Pro notification channel. This operation can redirect external effects: active webhook channels send requests to the supplied secret URL, and active email channels send messages to the supplied recipients. Confirm the complete destination and activation settings before calling.
ActionTry it
Update Saved Search
Replace the complete definition and metadata of an existing saved search. This PUT operation requires urlscan Pro saved-search access and write permission; the hostnames datasource may require an additional entitlement.
ActionTry it
Update Scan Visibility
Change the visibility of a scan owned by the connected user or team. This operation requires a paid urlscan Pro entitlement and is contract-only, not live verified. Use DELETE_RESULT for permanent deletion.
ActionTry it
How the urlscan.io integration works
The urlscan.io integration connects your Dench AI CRM directly to urlscan.io, so agents can read and act on your urlscan.io data as part of everyday work — answering questions in chat, keeping your CRM in sync, and running automations without anyone copying data between tools.
51 actions are available for agents to invoke on your behalf. Every call runs through urlscan.io's own authorization, scoped to the account you connect.
Set up urlscan.io in Dench
- 1
Sign in to your Dench workspace and open Integrations.
- 2
Find urlscan.io and click Connect — you'll authorize access through urlscan.io's own sign-in flow. No API keys or code required.
- 3
Ask an agent to use urlscan.io in chat, or call it from an automation.
- 4
Manage or disconnect the connection any time from workspace settings.
Frequently asked questions
How does the urlscan.io integration work with Dench?
The Dench urlscan.io integration connects your AI CRM to urlscan.io, so AI agents can work with your urlscan.io data as part of chats, automations, and CRM workflows. You connect your account once, and every agent in your workspace can use it — governed by your workspace permissions.
What actions can AI agents perform with urlscan.io via Dench?
The urlscan.io integration currently exposes 51 actions, including Close Incident, Copy Incident, Create Alert Subscription, Create Incident, Create Live Scan Task, and Create Notification Channel. Agents invoke them on your behalf from chat or from automations.
Do I need to write code to connect urlscan.io to Dench?
No. You connect urlscan.io from your Dench workspace using urlscan.io's own sign-in and authorization flow — no API keys to copy, no glue code to maintain.
Is the urlscan.io integration secure?
Connections are authorized through urlscan.io's own authentication flow, and Dench stores only the authorization needed to act on your behalf. You can review and disconnect the urlscan.io connection from your workspace settings at any time.