SecureNow API Documentation

Authentication

# CLI login (generates a session token)
npx securenow login

# Use the token in requests
curl -H "Authorization: Bearer YOUR_TOKEN" \
  https://api.securenow.ai/api/applications

import { SecureNow } from "securenow";

const securenow = new SecureNow({
  apiKey: "snk_live_replace_me",
});

Base URLs

Rate Limits

Rate limits are applied per client IP address. Exceeding the limit returns a 429 status with a retryAfter field indicating seconds to wait.

Error Handling

All errors return a JSON body with an error field. HTTP status codes follow standard conventions.

SDKs & Collections

npm install securenow@latest

Installation

The securenow package includes the SDK (tracing, logging, body capture, firewall), CLI binary, MCP server, and framework integrations. Install the latest package, then connect with the credentials-first login flow.

Framework Integration

Pick your framework below. Most need zero code changes — just a preload flag or one config line.

# Connect once. This writes .securenow/runtime.json.
npx securenow login

# Then add the preload flag — zero code changes.
node -r securenow/register src/index.js

# Or use the CLI
npx securenow run src/index.js

# PM2 ecosystem.config.cjs
module.exports = {
  apps: [{
    script: './app.js',
    node_args: '-r securenow/register',
  }],
};

Runtime Configuration

SecureNow boots from .securenow/runtime.json locally, then legacy/generated runtime credential files. Production should mount the tokenless runtime export as .securenow/credentials.json or .securenow/credentials.<env>.json.

Returns a comprehensive AI-powered threat report for any IPv4 address. Combines SecureNow's proprietary scoring, AI analysis, bot detection, attack classification, and SecureNow AI IPDB community data into a single response.

Path Parameters

Response Fields

Code Examples

curl -s "https://api.securenow.ai/api/public/ip-intel/185.220.101.1" | jq .

Example Response

{
  "ip": "185.220.101.1",
  "securenowScore": 87,
  "verdict": "Malicious - Automated Scanner",
  "isMalicious": true,
  "isBot": true,
  "activityType": "Automated Scanning",
  "attackTypes": ["Port Scan", "Brute Force", "Web Application Attack"],
  "summary": "This IP has been widely reported for automated scanning and brute force attacks...",
  "riskFactors": [
    "High SecureNow AI IPDB confidence score (95%)",
    "Known Tor exit node",
    "Over 500 community abuse reports"
  ],
  "botVsHumanAnalysis": "Traffic patterns are consistent with automated scanning tools...",
  "securenowIpdb": {
    "abuseConfidenceScore": 95,
    "countryCode": "DE",
    "countryName": "Germany",
    "domain": "torproject.org",
    "isp": "Tor Exit Node",
    "usageType": "Hosting/Transit/CDN",
    "totalReports": 543,
    "lastReportedAt": "2026-03-13T10:30:00Z",
    "recentReports": [
      {
        "reportedAt": "2026-03-13T10:30:00Z",
        "categories": [14, 15],
        "comment": "Port scan and SSH brute force attempts"
      }
    ]
  },
  "sources": ["securenow-ipdb", "securenow-internal", "securenow-ai"],
  "lastUpdatedAt": "2026-03-13T12:00:00Z"
}

Returns a list of recently analyzed IP addresses. Useful for building sitemaps or discovering trending threat IPs. Heavily cached (24 hours) and more strictly rate-limited.

Example Response

{
  "ips": [
    "185.220.101.1",
    "45.33.32.156",
    "103.152.220.44",
    "192.42.116.16"
  ]
}

curl -s "https://api.securenow.ai/api/public/ip-intel/recent-ips" | jq .

Returns basic IP reputation data in a simplified format compatible with older integrations.

Path Parameters

Example Response

{
  "ip": "185.220.101.1",
  "abuseConfidenceScore": 95,
  "countryCode": "DE",
  "isp": "Tor Exit Node",
  "domain": "torproject.org",
  "totalReports": 543,
  "lastReportedAt": "2026-03-13T10:30:00Z"
}

Manage your monitored applications. Create, update, delete applications and retrieve their API keys for integration.

Access HTTP request traces collected by the SecureNow SDK. View individual traces, analyze suspicious requests with AI, and investigate incidents.

Retrieve aggregated security analytics for your applications. Response codes, error rates, and traffic patterns broken down by status category.

AI-powered security forensics. Ask questions in natural language and get structured results from your trace data. Supports chat-based investigations and saved query libraries.

Example: Natural Language Query

curl -X POST https://api.securenow.ai/api/forensics/query \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "Show me all suspicious IPs from the last 24 hours"}'

Configure security alert rules, notification channels (Slack, email, webhooks), and review alert history.

Manage IP blocklists and allowlists for your applications. Block known threats automatically or whitelist trusted IPs and services.

Real-time firewall integration endpoints. Used by the SecureNow SDK to sync blocklists and allowlists with your application's firewall middleware.

SDK Integration

// Next.js middleware integration
import { SecureNow } from "securenow";

const securenow = new SecureNow({
  apiKey: "snk_live_replace_me",
});

// In your middleware
export async function middleware(request) {
  const ip = request.headers.get("x-forwarded-for");
  const result = await securenow.checkIp(ip);

  if (result.blocked) {
    return new Response("Forbidden", { status: 403 });
  }
}