ProjectDiscovery (projectdiscovery/docs)

ProjectDiscovery

https://github.com/projectdiscovery/docs
Admin
ProjectDiscovery is a comprehensive security platform offering open-source tools and cloud services...

Tokens:277,751
Snippets:3,313
Trust Score:9.7
Update:1 day ago
Show doc for...
Context Summary (auto-generated)
Raw
# ProjectDiscovery Documentation

ProjectDiscovery Documentation is the official source for [docs.projectdiscovery.io](https://docs.projectdiscovery.io), a Mintlify-powered documentation site covering the full ProjectDiscovery ecosystem. The platform spans two major pillars: open-source security tools (Nuclei, httpx, subfinder, naabu, katana, interactsh, and more) and the ProjectDiscovery Cloud Platform (PDCP), a SaaS offering that extends those tools with managed scanning, asset discovery, credential monitoring, and a REST API. The documentation is built from MDX content files, an OpenAPI 3.1 YAML specification, and auto-generated JavaScript SDK reference pages, all wired together through a `mint.json` navigation manifest.

The core functionality documented here includes: running Nuclei vulnerability scans both from the CLI and through the cloud API; authoring and sharing YAML-based Nuclei templates across every supported protocol (HTTP, DNS, TCP, file, JavaScript, headless browser); managing the full lifecycle of cloud scans, vulnerabilities, asset enumerations, and leak monitoring via a REST API authenticated with `X-Api-Key`; and configuring integrations such as GitHub, GitLab, Jira, Elasticsearch, Splunk, and MongoDB for automated ticketing and reporting. The repository also documents ancillary open-source tools—subfinder, httpx, naabu, dnsx, katana, interactsh, uncover, cvemap, alterx, notify, cloudlist, pdtm, chaos—each with installation, usage, and CLI reference pages.

---

## Nuclei CLI — Install

Nuclei is a fast, template-based vulnerability scanner. It can be installed via Go, Homebrew, Docker, or from pre-built binaries.

```bash
# Go (recommended)
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Homebrew (macOS/Linux)
brew install nuclei

# Docker
docker pull projectdiscovery/nuclei:latest

# Docker — scan a single host and output JSONL
docker run --rm projectdiscovery/nuclei -u google.com -jsonl

# Docker — scan a list of URLs and write results to host filesystem
docker run --rm -v ./:/app/ projectdiscovery/nuclei \
  -l /app/urls.txt -jsonl /app/results.jsonl
```

---

## Nuclei CLI — Basic Scanning

Running Nuclei against targets using default community templates, with filtering and output options.

```bash
# Scan a single host with all default templates
nuclei -u https://example.com

# Scan a list of hosts
nuclei -list targets.txt

# Scan with specific template directories
nuclei -u https://example.com -t cves/ -t exposures/

# Filter by severity and tags
nuclei -u https://example.com -severity critical,high -tags cve

# Combined tag/severity/author filter (AND logic)
nuclei -u https://example.com -tags cve -severity critical,high -author geeknik

# DSL-based template condition filter
nuclei -tc "contains(tags,'cve') && contains(tags,'ssrf')" -u https://example.com

# JSON export
nuclei -u https://example.com -json-export output.json

# SARIF export (for GitHub Code Scanning upload)
nuclei -list urls.txt -t cves/ -sarif-export report.sarif

# Markdown export with request/response pairs
nuclei -list urls.txt -t cves/ -include-rr -markdown-export reports/

# Upload results to ProjectDiscovery Cloud dashboard
export PDCP_API_KEY=your-api-key-here
nuclei -u https://example.com -dashboard

# Run only new templates from the latest nuclei-templates release
nuclei -u https://example.com -new-templates
```

---

## Nuclei CLI — AI-Powered Template Generation (`-ai`)

Generate and immediately run Nuclei templates on-the-fly from a natural language description, powered by the ProjectDiscovery API.

```bash
# Authenticate once
nuclei -auth
# Enter your PDCP API key when prompted, or set via environment variable:
export PDCP_API_KEY=your-pdcp-api-key

# Find sensitive information leaks
nuclei -list targets.txt -ai "Find admin_api_key in response"

# Detect exposed stack traces
nuclei -list targets.txt -ai "Detect exposed stack traces in error messages"

# Discover admin login endpoints
nuclei -list targets.txt -ai "Find admin login endpoints"

# Identify secrets in responses
nuclei -list urls.txt -ai "Detect secrets in response"

# Extract page titles from a target list
nuclei -list targets.txt -ai "Extract page titles"
# Note: 100 AI queries/day per user; generated templates are saved locally
# and to your PDCP cloud account for reuse.
```

---

## Nuclei CLI — Authenticated Scans (Secret File)

Nuclei v3.2.0+ supports a YAML-based `Secret File` for managing static and dynamic authentication across thousands of targets.

```yaml
# secrets.yaml — static API key example
static:
  - type: bearerauth
    domains:
      - api.example.com
    value: "Bearer eyJhbGciOiJIUzI1NiJ9..."

  - type: basicauth
    domains:
      - legacy.example.com
    username: admin
    password: s3cr3t

# Dynamic authentication (login flow via nuclei-templates)
dynamic:
  - template: default-login/wordpress-login.yaml
    domains-regex: ".*\\.wordpress-site\\.com"
    variables:
      username: admin
      password: wp-password-here
```

```bash
# Run with secrets file
nuclei -list targets.txt -secret-file secrets.yaml

# Pre-fetch secrets at start (avoids mid-scan delays)
nuclei -list targets.txt -secret-file secrets.yaml -prefetch-secrets
```

---

## Nuclei CLI — Uncover Integration (Internet Databases)

Scan hosts discovered from Shodan, Censys, Fofa, Hunter, ZoomEye, and other internet databases.

```bash
# Set API keys
export SHODAN_API_KEY=xxx
export CENSYS_API_ID=xxx
export CENSYS_API_SECRET=xxx
export FOFA_EMAIL=xxx
export FOFA_KEY=xxx

# Run a specific CVE template against Shodan results for that CVE
nuclei -id 'CVE-2021-26855' -uq 'vuln:CVE-2021-26855' -ue shodan

# Use template-defined shodan-query metadata automatically
nuclei -t cves/2021/CVE-2021-26855.yaml -uncover

# Scan all CVE templates, auto-fetching targets from Shodan metadata
nuclei -tags cve -uncover
```

---

## Nuclei CLI — Rate Limiting and Performance

Control scan speed with rate limiting, concurrency, and bulk-size flags.

```bash
# Rate-limit to 100 requests/sec, 50 hosts per template in parallel,
# 50 templates in parallel
nuclei -u https://example.com \
  -rate-limit 100 \
  -bulk-size 50 \
  -concurrency 50

# Configuration file at $HOME/.config/nuclei/config.yaml
cat > $HOME/.config/nuclei/config.yaml << 'EOF'
header:
  - 'X-BugBounty-Hacker: h1/yourhandle'

templates:
  - cves/
  - vulnerabilities/
  - misconfiguration/

tags: exposures,cve
severity: critical,high,medium

exclude-tags: info
include-tags: dos,fuzz

rate-limit: 500
bulk-size: 50
concurrency: 50
EOF

# Use custom config
nuclei -config myproject.yaml -list urls.txt
```

---

## Nuclei CLI — Reporting Integrations

Forward findings to GitHub Issues, GitLab Issues, Jira, Elasticsearch, Splunk HEC, or MongoDB.

```yaml
# issue-tracker.yaml — GitHub
github:
  username: 'myuser'
  owner: 'myorg'
  token: 'ghp_xxxxxxxxxxxx'
  project-name: 'security-findings'
  issue-label: 'Nuclei'
  duplicate-issue-check: true

# issue-tracker.yaml — Jira (append or replace as needed)
jira:
  cloud: true
  update-existing: false
  url: https://myorg.atlassian.net
  account-id: 123456789abcdef
  email: security@myorg.com
  token: jira-api-token
  project-name: SEC
  issue-type: Bug
  severity-as-label: true
  status-not: Closed
  custom_fields:
    customfield_10001:
      freeform: $CVSSScore
    customfield_10002:
      freeform: $CVEID

# issue-tracker.yaml — Elasticsearch
elasticsearch:
  ip: 127.0.0.1
  port: 9200
  index-name: nuclei

# issue-tracker.yaml — Splunk HEC
splunkhec:
  host: splunk.myorg.com
  port: 8088
  index-name: nuclei
  ssl: true
  ssl-verification: true
  token: 'splunk-hec-token'

# issue-tracker.yaml — MongoDB
mongodb:
  connection-string: "mongodb://root:pass@localhost:27017/nuclei?authSource=admin"
  collection-name: findings
  omit-raw: false
  batch-size: 100

# Allow only high/critical; deduplicate across periodic scans
allow-list:
  severity: high,critical
```

```bash
# Run scan and create tickets, deduplicate via local DB
nuclei -list urls.txt -t cves/ -rc issue-tracker.yaml -rdb prod
```

---

## Nuclei Templates — Structure

A Nuclei template is a YAML file with a unique `id`, an `info` block, protocol-specific request definitions, matchers, and optional extractors.

```yaml
id: git-config-exposure

info:
  name: Git Config File Exposure
  author: Ice3man
  severity: medium
  description: Searches for exposed .git/config files on web servers.
  reference: https://www.acunetix.com/vulnerabilities/web/git-repository-found/
  tags: git,config,exposure
  metadata:
    shodan-query: 'http.title:"Index of" ".git"'

http:
  - method: GET
    path:
      - "{{BaseURL}}/.git/config"
    redirects: true
    max-redirects: 3
    headers:
      User-Agent: "Mozilla/5.0 (compatible; SecurityScanner/1.0)"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "[core]"
      - type: status
        status:
          - 200
    extractors:
      - type: regex
        name: repo_url
        regex:
          - 'url\s*=\s*(https?://[^\s]+)'
```

---

## Nuclei Templates — HTTP Protocol (Multi-Step / Request Condition)

Multi-step HTTP templates correlate data across requests using numbered attribute suffixes.

```yaml
id: wordpress-rce-chain

info:
  name: WordPress Auth + RCE Chain
  author: example
  severity: critical
  tags: wordpress,rce,auth

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&redirect_to=%2Fwp-admin%2F&testcookie=1
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: {{cookie}}

        action=upload_plugin&nonce={{nonce}}&pluginzip=@shell.zip

    cookie-reuse: true

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 302"
          - "status_code_2 == 200 && contains(body_2, 'success')"
        condition: and
```

---

## Nuclei Templates — HTTP Fuzzing / DAST

Run dynamic application security testing (DAST) with fuzzing templates.

```bash
# Enable DAST mode
nuclei -u https://example.com -dast

# Fuzzing aggression levels: low (default), medium, high
nuclei -u https://example.com -dast -fuzz-aggression medium

# Limit fuzzing scope with regex
nuclei -u https://example.com -dast \
  -fuzz-scope "https://example\.com/api/.*" \
  -fuzz-out-scope "https://example\.com/logout"
```

```yaml
# DAST fuzzing template example
id: sqli-fuzz-get

info:
  name: SQL Injection Fuzzing
  severity: high
  tags: sqli,fuzz,dast

http:
  - method: GET
    path:
      - "{{BaseURL}}/search?q={{injection}}"
    fuzzing:
      - part: query
        type: replace
        mode: single
        fuzz:
          - "'"
          - "1 OR 1=1--"
          - "' UNION SELECT NULL--"
    matchers:
      - type: word
        words:
          - "SQL syntax"
          - "mysql_fetch"
          - "ORA-01756"
        condition: or
```

---

## Nuclei Templates — Custom Templates from GitHub/GitLab/S3/Azure

Host and auto-sync private templates from cloud storage or version control.

```bash
# GitHub private repo
export GITHUB_TOKEN=ghp_xxxxxxxxxxxx
export GITHUB_TEMPLATE_REPO=my-private-nuclei-templates
nuclei -update-templates
nuclei -t github/my-private-nuclei-templates -u https://example.com

# GitLab
export GITLAB_SERVER_URL=https://gitlab.com
export GITLAB_TOKEN=glpat-xxxxxxxxxxxx
export GITLAB_REPOSITORY_IDS=12345678
nuclei -update-templates

# AWS S3
export AWS_ACCESS_KEY=AKIAXXXXXXXX
export AWS_SECRET_KEY=xxxxxxxxxx
export AWS_REGION=us-east-1
export AWS_TEMPLATE_BUCKET=my-nuclei-templates
nuclei -update-templates

# Azure Blob Storage
export AZURE_TENANT_ID=00000000-0000-0000-0000-000000000000
export AZURE_CLIENT_ID=00000000-0000-0000-0000-000000000000
export AZURE_CLIENT_SECRET=xxxxxxxxxx
export AZURE_SERVICE_URL=https://myaccount.blob.core.windows.net/
export AZURE_CONTAINER_NAME=nuclei-templates
nuclei -update-templates

# Disable specific download sources
export DISABLE_NUCLEI_TEMPLATES_PUBLIC_DOWNLOAD=true
```

---

## PDCP REST API — Authentication

All PDCP API endpoints at `https://api.projectdiscovery.io` require an `X-Api-Key` header. Obtain your key from [cloud.projectdiscovery.io/settings/api-key](https://cloud.projectdiscovery.io/settings/api-key).

```bash
# Get current API key
curl -s https://api.projectdiscovery.io/v1/user/apikey \
  -H "X-Api-Key: YOUR_API_KEY"
# Response: {"api_key":"YOUR_API_KEY","created_at":"2024-01-15T10:00:00Z"}

# Create API key (no-op if one already exists)
curl -s -X POST https://api.projectdiscovery.io/v1/user/apikey \
  -H "X-Api-Key: YOUR_API_KEY"

# Rotate API key
curl -s -X POST https://api.projectdiscovery.io/v1/user/apikey/rotate \
  -H "X-Api-Key: YOUR_API_KEY"
# Response: {"api_key":"NEW_ROTATED_KEY"}

# Delete API key
curl -s -X DELETE https://api.projectdiscovery.io/v1/user/apikey \
  -H "X-Api-Key: YOUR_API_KEY"
```

---

## PDCP REST API — Scans: Create, List, Get, Stop, Delete

Full scan lifecycle management via the REST API.

```bash
API_KEY="your-api-key"
TEAM_ID="your-team-id"   # optional; from cloud.projectdiscovery.io/settings/team

# List scans (paginated, filterable)
curl -s "https://api.projectdiscovery.io/v1/scans?limit=10&offset=0&status=finished" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Create a scan
curl -s -X POST https://api.projectdiscovery.io/v1/scans \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Weekly CVE Scan",
    "targets": ["https://example.com", "https://api.example.com"],
    "template_ids": ["cve-2021-26855", "cve-2021-44228"],
    "config_id": "config-uuid-here"
  }'
# Response: {"scan_id":"scan-abc123","message":"Scan triggered"}

# Get scan details
curl -s "https://api.projectdiscovery.io/v1/scans/scan-abc123" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Stop a running scan
curl -s -X POST "https://api.projectdiscovery.io/v1/scans/scan-abc123/stop" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Rescan (re-run) an existing scan
curl -s -X POST "https://api.projectdiscovery.io/v1/scans/scan-abc123/rescan" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Delete a single scan
curl -s -X DELETE "https://api.projectdiscovery.io/v1/scans/scan-abc123" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Delete scans in bulk
curl -s -X DELETE https://api.projectdiscovery.io/v1/scans \
  -H "X-Api-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"scan_ids":["scan-abc123","scan-def456"]}'
```

---

## PDCP REST API — Scan Schedules

Automate periodic scans with cron-based scheduling.

```bash
# Get all scan schedules
curl -s "https://api.projectdiscovery.io/v1/scans/schedule" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Create a weekly schedule (every Monday at 02:00 UTC)
curl -s -X POST https://api.projectdiscovery.io/v1/scans/schedule \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "scan_id": "scan-abc123",
    "cron": "0 2 * * 1",
    "timezone": "UTC"
  }'

# Delete a schedule
curl -s -X DELETE "https://api.projectdiscovery.io/v1/scans/schedule?scan_id=scan-abc123" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"
```

---

## PDCP REST API — Scan Results (Vulnerabilities)

Retrieve, manage, and export individual vulnerability findings.

```bash
# Get a specific vulnerability by ID
curl -s "https://api.projectdiscovery.io/v1/scans/vuln/vuln-abc123" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Get all vulnerabilities (v2 full-text search endpoint)
curl -s "https://api.projectdiscovery.io/v2/vulnerability/search?q=log4j&limit=50&offset=0" \
  -H "X-Api-Key: $API_KEY"
# Response includes: results[], total, count, facets

# Get available filters for vulnerabilities
curl -s "https://api.projectdiscovery.io/v2/vulnerability/filters" \
  -H "X-Api-Key: $API_KEY"

# Get vulnerability timeline
curl -s "https://api.projectdiscovery.io/v2/vulnerability/vuln-abc123/timeline" \
  -H "X-Api-Key: $API_KEY"

# Get changelogs for a specific vulnerability
curl -s "https://api.projectdiscovery.io/v1/scans/vuln/vuln-abc123/changelogs?time=last_week" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Batch update vulnerability status
curl -s -X PATCH https://api.projectdiscovery.io/v1/scans/vulns \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "ids": ["vuln-abc123", "vuln-def456"],
    "status": "fixed"
  }'

# Batch update vulnerability labels
curl -s -X PATCH https://api.projectdiscovery.io/v1/scans/vulns/labels \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/json" \
  -d '{"ids":["vuln-abc123"],"labels":["triaged","p1"]}'

# Retest a specific vulnerability
curl -s -X POST "https://api.projectdiscovery.io/v1/scans/vuln-abc123/retest" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/json" \
  -d '{"socks5_proxy":"","agent_id":""}'
```

---

## PDCP REST API — Export Scan Results

Export findings in JSON, CSV, or PDF format, with optional filters.

```bash
# Export all results for a scan (JSON)
curl -s "https://api.projectdiscovery.io/v1/scans/scan-abc123/export?type=json" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -o scan-results.json

# Export scan results as CSV
curl -s "https://api.projectdiscovery.io/v1/scans/scan-abc123/export?type=csv" \
  -H "X-Api-Key: $API_KEY" -o scan-results.csv

# Export filtered scan results (POST for filter body)
curl -s -X POST "https://api.projectdiscovery.io/v1/scans/scan-abc123/export?type=json" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "severity": ["critical","high"],
    "vuln_status": "open",
    "host": ["https://example.com"]
  }'

# Cross-scan filtered export with date range
curl -s -X POST "https://api.projectdiscovery.io/v1/scans/results/export?type=csv" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "severity": ["critical"],
    "scan_ids": ["scan-abc123","scan-def456"],
    "start_date": "2024-01-01",
    "end_date": "2024-03-31"
  }' \
  -o q1-critical.csv
```

---

## PDCP REST API — Import OSS Scan Results

Upload Nuclei JSONL output files directly to the cloud platform for visualization.

```bash
# Run nuclei locally and save JSONL
nuclei -list targets.txt -t cves/ -jsonl -output results.jsonl

# Import results to a named scan on PDCP
curl -s -X POST "https://api.projectdiscovery.io/v1/scans/import?name=My+OSS+Scan" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/octet-stream" \
  --data-binary @results.jsonl
# Response: {"scan_id":"scan-new-uuid","message":"Scan imported"}

# Append more results to an existing imported scan
curl -s -X PATCH "https://api.projectdiscovery.io/v1/scans/scan-new-uuid/import" \
  -H "X-Api-Key: $API_KEY" \
  -H "Content-Type: application/octet-stream" \
  --data-binary @more-results.jsonl
```

---

## PDCP REST API — Templates (CRUD + AI Generation)

Manage private templates and search the public template library.

```bash
# Search templates (v2, public + private)
curl -s "https://api.projectdiscovery.io/v2/template/search?q=log4j&scope=public_private&limit=20" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# List private templates
curl -s "https://api.projectdiscovery.io/v1/template?limit=50&offset=0" \
  -H "X-Api-Key: $API_KEY"

# Create a private template
curl -s -X POST "https://api.projectdiscovery.io/v1/template?filename=my-check.yaml&dir=custom" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "template": "id: my-check\ninfo:\n  name: My Custom Check\n  severity: info\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/health\"\n    matchers:\n      - type: status\n        status:\n          - 200\n"
  }'

# Get a private template by ID
curl -s "https://api.projectdiscovery.io/v1/template/tmpl-uuid-here" \
  -H "X-Api-Key: $API_KEY"

# Update a private template
curl -s -X PATCH https://api.projectdiscovery.io/v1/template \
  -H "X-Api-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"template_id":"tmpl-uuid-here","template":"id: my-check\n..."}'

# Delete a private template
curl -s -X DELETE "https://api.projectdiscovery.io/v1/template/tmpl-uuid-here" \
  -H "X-Api-Key: $API_KEY"

# Generate a template using the AI engine
curl -s -X POST https://api.projectdiscovery.io/v1/template/ai \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "Detect exposed .env files containing database credentials"}'
# Response: {"template_id":"ai-gen-uuid","template":"id: env-exposure\n..."}

# Share a template (link-share)
curl -s -X POST https://api.projectdiscovery.io/v1/template/share \
  -H "X-Api-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"template_id":"tmpl-uuid-here","ttl":"7d","share_type":"link"}'

# Get a shared template (no auth needed)
curl -s "https://api.projectdiscovery.io/v1/template/share/tmpl-uuid-here?fields=name,severity,template"
```

---

## PDCP REST API — Asset Discovery (Enumerations)

Discover and continuously monitor the attack surface of an organization through automated enumeration.

```bash
# List all enumerations
curl -s "https://api.projectdiscovery.io/v1/asset/enumerate?limit=20&sort_desc=created_at" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Create a new enumeration
curl -s -X POST https://api.projectdiscovery.io/v1/asset/enumerate \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme Corp External Assets",
    "root_domains": ["acme.com", "acmecorp.io"],
    "steps": [
      "dns_resolve",
      "dns_bruteforce",
      "port_scan",
      "http_probe",
      "http_screenshot",
      "tls_scan"
    ],
    "enumeration_ports": "80,443,8080,8443",
    "automatic_vuln_scans": true,
    "exclusions": ["*.staging.acme.com", "*.dev.acme.com"]
  }'
# Response: {"id":"enum-abc123","is-public":false}

# Get enumeration details
curl -s "https://api.projectdiscovery.io/v1/asset/enumerate/enum-abc123" \
  -H "X-Api-Key: $API_KEY"

# Re-run an existing enumeration
curl -s -X POST "https://api.projectdiscovery.io/v1/asset/enumerate/enum-abc123/rescan" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Export discovered assets (CSV) with filters
curl -s "https://api.projectdiscovery.io/v1/asset/enumerate/enum-abc123/export?format=csv&port=443,8443&is_tech=true" \
  -H "X-Api-Key: $API_KEY" \
  -o assets.csv

# Schedule recurring enumeration (weekly on Sundays at 01:00)
curl -s -X POST https://api.projectdiscovery.io/v1/enumeration/schedule \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/json" \
  -d '{"enumeration_id":"enum-abc123","cron":"0 1 * * 0"}'

# Create an asset group from enumeration data
curl -s -X POST https://api.projectdiscovery.io/v1/asset/enumerate/group \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Critical External APIs",
    "filters": {"port":["443"],"technologies":["nginx"],"labels":["p1"]}
  }'
```

---

## PDCP REST API — Scan Configurations

Create reusable scan configurations with custom headers, template variables, rate limits, and Interactsh settings.

```bash
# List configurations (filter by type: scan, reporting, template, alerting, etc.)
curl -s "https://api.projectdiscovery.io/v1/scans/config?type=scan" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Create a scan configuration
curl -s -X POST https://api.projectdiscovery.io/v1/scans/config \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "WordPress Auth Config",
    "config_type": "scan",
    "global": false,
    "config": "{\"rate_limit\":30,\"headers\":{\"Authorization\":\"Bearer token123\"},\"vars\":{\"username\":\"admin\",\"password\":\"wp-password\"}}"
  }'

# Update a configuration
curl -s -X PATCH "https://api.projectdiscovery.io/v1/scans/config/config-uuid-here" \
  -H "X-Api-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"WordPress Auth Config v2","global":true}'

# Delete a configuration
curl -s -X DELETE "https://api.projectdiscovery.io/v1/scans/config/config-uuid-here" \
  -H "X-Api-Key: $API_KEY"
```

---

## PDCP REST API — Credential Leak Monitoring

Monitor for leaked credentials associated with your organization's domains and email addresses.

```bash
# Get all leaked credentials
curl -s "https://api.projectdiscovery.io/v1/leaks?limit=50&offset=0" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Get domain-level leak statistics
curl -s "https://api.projectdiscovery.io/v1/leaks/domain-stats" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Get email-level leak statistics
curl -s "https://api.projectdiscovery.io/v1/leaks/email-stats" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Get detailed info for a specific leak
curl -s "https://api.projectdiscovery.io/v1/leaks/leak-uuid-here" \
  -H "X-Api-Key: $API_KEY"

# Update leak status (e.g., mark as resolved)
curl -s -X PATCH "https://api.projectdiscovery.io/v1/leaks/leak-uuid-here" \
  -H "X-Api-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"status":"resolved"}'

# Export leaks to CSV
curl -s "https://api.projectdiscovery.io/v1/leaks/export" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -o leaks.csv
```

---

## PDCP REST API — Asset Management (Labels and Policies)

Organize assets with labels and enforce security policies across your attack surface.

```bash
# Add labels to an asset
curl -s -X POST "https://api.projectdiscovery.io/v1/asset/asset-uuid-here/labels" \
  -H "X-Api-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"labels":["production","critical","pci-scope"]}'

# Modify asset labels (partial update)
curl -s -X PATCH "https://api.projectdiscovery.io/v1/asset/asset-uuid-here/labels" \
  -H "X-Api-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"add":["new-label"],"remove":["old-label"]}'

# Create an asset policy
curl -s -X POST https://api.projectdiscovery.io/v1/asset/policy \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "No Open RDP",
    "description": "Alert when port 3389 is discovered open",
    "conditions": {"port": "3389", "status": "open"},
    "severity": "high"
  }'

# List asset policies
curl -s "https://api.projectdiscovery.io/v1/asset/policy" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Get policy event history
curl -s "https://api.projectdiscovery.io/v1/asset/policy/policy-uuid-here/events" \
  -H "X-Api-Key: $API_KEY"
```

---

## PDCP REST API — Audit Logs

Retrieve team-level audit logs for compliance and security monitoring.

```bash
# Get audit logs (filter by user, action, time window)
curl -s "https://api.projectdiscovery.io/v1/team/audit_log?limit=100&offset=0&action=scan_created" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"

# Filter by specific user email
curl -s "https://api.projectdiscovery.io/v1/team/audit_log?email=user@example.com&limit=50" \
  -H "X-Api-Key: $API_KEY" \
  -H "X-Team-Id: $TEAM_ID"
```

---

## Nuclei Scan Metrics (Live)

Query real-time scan statistics from Nuclei's built-in metrics server.

```bash
# Start a scan with metrics enabled
nuclei -t cves/ -l urls.txt -stats

# Query metrics while scan runs (default port 9092)
curl -s localhost:9092/metrics | jq .
# Expected output:
# {
#   "duration": "0:00:03",
#   "errors": "2",
#   "hosts": "1",
#   "matched": "0",
#   "percent": "99",
#   "requests": "350",
#   "rps": "132",
#   "startedAt": "2024-01-15T18:02:18.886745+05:30",
#   "templates": "256",
#   "total": "352"
# }

# Custom metrics port
nuclei -u https://example.com -stats -metrics-port 9093
curl -s localhost:9093/metrics | jq .
```

---

## Building and Deploying the Documentation Site

The documentation site is built with Mintlify and includes auto-generated JS SDK docs and PDCP API reference pages.

```bash
# Local development
npm i -g mintlify@latest
cd /path/to/docs-repo
mintlify dev

# Generate JavaScript protocol docs (requires jsdoc-to-markdown)
npm install -g jsdoc-to-markdown
./bin/jsdocs.sh

# Download latest OpenAPI spec from PDCP
./bin/download-api.sh

# Generate API reference pages from OpenAPI spec
./bin/generate-api.sh

# Generate API docs excluding internal/admin endpoints
./bin/generate-filtered-api.sh

# After all generation steps, Mintlify handles deployment automatically
# when pushed to the configured deployment branch.
```

---

ProjectDiscovery documentation covers two tightly integrated layers of use: command-line security tooling and a cloud API that extends those tools into an enterprise-grade continuous security platform. The primary use cases are continuous attack surface monitoring (automated asset enumeration via PDCP enumerations + scheduled rescans), vulnerability scanning at scale (Nuclei CLI against large target lists, with results pushed to PDCP or external ticketing systems), credential leak surveillance (PDCP leak monitoring for org domains), and DevSecOps pipeline integration (Nuclei in CI/CD with SARIF output for GitHub Code Scanning, or API-driven scan triggering from pipeline automation). The templating system underpins all of these use cases, allowing teams to encode custom security checks in portable YAML that runs identically on-premises and in the cloud.

Integration patterns fall into three categories: direct Nuclei CLI with cloud upload (`-dashboard`, `-scan-id`, `-pdu`), full API-driven automation using the PDCP REST API (create scans, poll status, export results, ingest into SIEM/ticketing), and hybrid workflows where local Nuclei scans produce JSONL output that is imported via `POST /v1/scans/import` for cloud visualization and tracking. All three patterns share the same authentication model (`X-Api-Key`), the same vulnerability data model (severity, status, changelogs, labels), and the same template ecosystem, making it straightforward to migrate between local-only and fully managed execution without changing templates or downstream integrations.