SecureNow API Documentation

Authentication

# CLI login (generates a session token)
npx securenow login

# Use the token in requests
curl -H "Authorization: Bearer YOUR_TOKEN" \
  https://api.securenow.ai/api/applications

import { SecureNow } from "securenow";

const securenow = new SecureNow({
  apiKey: process.env.SECURENOW_API_KEY,
});

Base URLs

Rate Limits

Rate limits are applied per client IP address. Exceeding the limit returns a 429 status with a retryAfter field indicating seconds to wait.

Error Handling

All errors return a JSON body with an error field. HTTP status codes follow standard conventions.

SDKs & Collections

npm install securenow

Installation

The securenow package includes the SDK (tracing, logging, firewall), CLI binary, and all framework integrations.

Framework Integration

Pick your framework below. Most need zero code changes — just a preload flag or one config line.

# Just add the preload flag — zero code changes
node -r securenow/register src/index.js

# Or use the CLI
npx securenow run src/index.js

# PM2 ecosystem.config.cjs
module.exports = {
  apps: [{
    script: './app.js',
    node_args: '-r securenow/register',
    env: {
      SECURENOW_APPID: 'my-app',
      SECURENOW_INSTANCE: 'https://your-collector:4318',
    },
  }],
};

Environment Variables

Every variable the securenow npm package reads at runtime. Set in .env, .env.local, or your hosting provider.

Returns a comprehensive AI-powered threat report for any IPv4 address. Combines SecureNow's proprietary scoring, AI analysis, bot detection, attack classification, and AbuseIPDB community data into a single response.

Path Parameters

Response Fields

Code Examples

curl -s "https://api.securenow.ai/api/public/ip-intel/185.220.101.1" | jq .

Example Response

{
  "ip": "185.220.101.1",
  "securenowScore": 87,
  "verdict": "Malicious - Automated Scanner",
  "isMalicious": true,
  "isBot": true,
  "activityType": "Automated Scanning",
  "attackTypes": ["Port Scan", "Brute Force", "Web Application Attack"],
  "summary": "This IP has been widely reported for automated scanning and brute force attacks...",
  "riskFactors": [
    "High AbuseIPDB confidence score (95%)",
    "Known Tor exit node",
    "Over 500 community abuse reports"
  ],
  "botVsHumanAnalysis": "Traffic patterns are consistent with automated scanning tools...",
  "abuseipdb": {
    "abuseConfidenceScore": 95,
    "countryCode": "DE",
    "countryName": "Germany",
    "domain": "torproject.org",
    "isp": "Tor Exit Node",
    "usageType": "Hosting/Transit/CDN",
    "totalReports": 543,
    "lastReportedAt": "2026-03-13T10:30:00Z",
    "recentReports": [
      {
        "reportedAt": "2026-03-13T10:30:00Z",
        "categories": [14, 15],
        "comment": "Port scan and SSH brute force attempts"
      }
    ]
  },
  "sources": ["abuseipdb", "securenow-internal", "securenow-ai"],
  "lastUpdatedAt": "2026-03-13T12:00:00Z"
}

Returns a list of recently analyzed IP addresses. Useful for building sitemaps or discovering trending threat IPs. Heavily cached (24 hours) and more strictly rate-limited.

Example Response

{
  "ips": [
    "185.220.101.1",
    "45.33.32.156",
    "103.152.220.44",
    "192.42.116.16"
  ]
}

curl -s "https://api.securenow.ai/api/public/ip-intel/recent-ips" | jq .

Returns basic IP reputation data in a simplified format compatible with older integrations.

Path Parameters

Example Response

{
  "ip": "185.220.101.1",
  "abuseConfidenceScore": 95,
  "countryCode": "DE",
  "isp": "Tor Exit Node",
  "domain": "torproject.org",
  "totalReports": 543,
  "lastReportedAt": "2026-03-13T10:30:00Z"
}

Manage your monitored applications. Create, update, delete applications and retrieve their API keys for integration.

Access HTTP request traces collected by the SecureNow SDK. View individual traces, analyze suspicious requests with AI, and investigate incidents.

Retrieve aggregated security analytics for your applications. Response codes, error rates, and traffic patterns broken down by status category.

AI-powered security forensics. Ask questions in natural language and get structured results from your trace data. Supports chat-based investigations and saved query libraries.

Example: Natural Language Query

curl -X POST https://api.securenow.ai/api/forensics/query \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "Show me all suspicious IPs from the last 24 hours"}'

Configure security alert rules, notification channels (Slack, email, webhooks), and review alert history.

Manage IP blocklists and allowlists for your applications. Block known threats automatically or whitelist trusted IPs and services.

Real-time firewall integration endpoints. Used by the SecureNow SDK to sync blocklists and allowlists with your application's firewall middleware.

SDK Integration

// Next.js middleware integration
import { SecureNow } from "securenow";

const securenow = new SecureNow({
  apiKey: process.env.SECURENOW_API_KEY,
});

// In your middleware
export async function middleware(request) {
  const ip = request.headers.get("x-forwarded-for");
  const result = await securenow.checkIp(ip);

  if (result.blocked) {
    return new Response("Forbidden", { status: 403 });
  }
}