AKILI API

REST API with streaming agent investigations. AKILI plans tools, runs them, revises confidence, and can search the web — you watch the log in real time. This page is public; you only need an account or API key to run scans.

v1 Streaming Agentic Free tier

Base URL https://api.akili.com.ng

What others don't do

Planning-first — Groq builds a JSON tool plan per target before any check runs.
Confidence loops — After each tool, AKILI scores confidence and can add more tools until evidence is solid.
Web intel fallback — web_search when on-tool data is thin (CVE news, breaches, corroboration).
Tool chaining — e.g. tech fingerprint → CVE lookup, subdomains → link crawler on interesting hosts.
Live stream — Token lines (PLAN:, TOOL:, COMPLETE:) instead of waiting for a single JSON blob.

Authentication

Authenticated scans accept either:

Authorization: Bearer <jwt> — from POST /api/v1/auth/login or Google sign-in
X-API-Key: ak_live_… — create keys in the developer console

Guest endpoints under /api/v1/public/scan/* need no key. They use a lighter agent profile (fewer tools) and IP rate limits.

Streaming responses

Scan endpoints return text/plain streams. Each line is prefixed:

Prefix	Meaning
`AKILI:`	Agent narration
`PLAN:`	Investigation plan / tool choice
`TOOL:`	Tool execution
`THINK:`	Confidence revision
`COMPLETE:`	Final JSON report (parse this)

Public website scan

POST /api/v1/public/scan/website

Guest agent scan — no auth. Streams lite investigation (planning + up to 4 tools).

curl -N -X POST https://api.akili.com.ng/api/v1/public/scan/website \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

Public email scan

POST /api/v1/public/scan/email

Breach check and MX validation without an account.

curl -N -X POST https://api.akili.com.ng/api/v1/public/scan/email \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com"}'

Full website scan

POST /api/v1/scan/website

Deep agent: up to 10 planned tools, confidence follow-ups, CVE chaining.

curl -N -X POST https://api.akili.com.ng/api/v1/scan/website \
  -H "Content-Type: application/json" \
  -H "X-API-Key: ak_live_xxxx" \
  -d '{"url":"https://example.com"}'

Other scan endpoints

Same streaming format and auth. Replace path segment:

POST path	Body field
`/api/v1/scan/vulnerability`	`url`
`/api/v1/scan/subdomains`	`domain`
`/api/v1/scan/ip`	`ip`
`/api/v1/scan/organization`	`organization`
`/api/v1/scan/person`	`name` (+ optional keywords)
`/api/v1/scan/email`	`email`
`/api/v1/scan/domain`	`domain`
`/api/v1/scan/company`	`company`

History & reports

GET /api/v1/history

List saved scans (Bearer JWT required).

GET /api/v1/reports/{scan_id}

Fetch a report JSON by scan ID.

API keys

Create keys via POST /api/v1/keys (JWT). List with GET /api/v1/keys. Revoke with DELETE /api/v1/keys/{id}.

Only scan targets you own or have written permission to test.

OpenAPI (Swagger)

Machine-readable schema and interactive UI (public, no API key required to view):