Documentation
Getting Started
API Quickstart

API Quickstart

This guide walks you through the complete SaaS onboarding flow: creating an account, getting your API key, running your first scan, polling for status, viewing results, exporting reports, and checking your usage — all via the NAT REST API.

If you prefer the CLI, see the Quickstart guide. This page covers the API-first / SaaS flow.

Base URL

https://api.nat-testing.io/api/v1

All examples below use this base URL. Replace nat_pk_your_api_key_here with your actual API key wherever it appears.


Sign up for free

Navigate to app.nat-testing.io/signup (opens in a new tab) to create your account. The Free plan is available immediately — no credit card required.

Once your account is created, NAT provisions your tenant and you can grab your API key right away.

Need higher quotas or security scans? See Pricing & Plans for a full plan comparison. You can upgrade at any time from the dashboard.

Get your API key

Your API key (nat_pk_...) is available in two places:

  1. Dashboard — log in at app.nat-testing.io/dashboard (opens in a new tab) and go to Settings → API Keys
  2. sync-tenant response — if you provisioned your tenant via the sync-tenant endpoint, the key is included in the response body
⚠️

Store your API key securely. Treat it like a password — do not commit it to source control. Use environment variables or a secrets manager.

Export it for use in all examples below:

export NAT_API_KEY="nat_pk_your_api_key_here"

Start your first scan

Send a POST /api/v1/scan request with the target URL. The X-API-Key header authenticates you and automatically identifies your tenant.

curl -X POST https://api.nat-testing.io/api/v1/scan \
  -H "X-API-Key: $NAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://api.example.com",
    "spec_url": "https://api.example.com/openapi.json",
    "options": {
      "concurrency": 5,
      "timeout": 30
    }
  }'

Response 202 Accepted:

{
  "scan_id": "scan_abc123xyz",
  "status": "running",
  "created_at": "2025-01-15T10:30:00Z"
}

Save the scan_id — you will need it for the next steps.

Poll for scan status

Use GET /api/v1/scan/{id} to check whether the scan is still running. Poll until status is completed, failed, or cancelled.

SCAN_ID="scan_abc123xyz"
 
while true; do
  STATUS=$(curl -s "https://api.nat-testing.io/api/v1/scan/$SCAN_ID" \
    -H "X-API-Key: $NAT_API_KEY" | jq -r '.status')
  echo "Status: $STATUS"
  case "$STATUS" in
    completed|failed|cancelled) break ;;
    *) sleep 5 ;;
  esac
done

Example status response:

{
  "scan_id": "scan_abc123xyz",
  "status": "completed",
  "created_at": "2025-01-15T10:30:00Z",
  "updated_at": "2025-01-15T10:31:30Z"
}

Fetch results

Once the scan is completed, call GET /api/v1/scan/{id}/results to retrieve the full results object.

curl https://api.nat-testing.io/api/v1/scan/$SCAN_ID/results \
  -H "X-API-Key: $NAT_API_KEY"

Example completed response:

{
  "status": "completed",
  "passed": 10,
  "failed": 2,
  "total": 12,
  "elapsed_seconds": 45.32,
  "agent_count": 3,
  "tasks": [...],
  "accessibility": {
    "pages_scanned": 12,
    "violations": [...],
    "compliance_score": 87.5
  },
  "performance": {
    "pages_tested": 12,
    "metrics": [...],
    "performance_score": 72.1
  },
  "visual_regression": {
    "comparisons": [...],
    "diffs_detected": 1
  }
}

Export results

Download a formatted report using GET /api/v1/scan/{id}/export. Supported formats: html, json, csv.

# HTML report
curl "https://api.nat-testing.io/api/v1/scan/$SCAN_ID/export?format=html" \
  -H "X-API-Key: $NAT_API_KEY" \
  -o report.html
 
# CSV export
curl "https://api.nat-testing.io/api/v1/scan/$SCAN_ID/export?format=csv" \
  -H "X-API-Key: $NAT_API_KEY" \
  -o results.csv

Check your usage

Monitor how many scans you have used this billing period with GET /api/v1/usage.

curl https://api.nat-testing.io/api/v1/usage \
  -H "X-API-Key: $NAT_API_KEY"
{
  "plan": "pro",
  "scans_used": 47,
  "scans_limit": 500,
  "security_scan_count": 8,
  "monthly_security_scan_quota": 100,
  "approaching_limit": false,
  "quota_reset_date": "2025-02-01T00:00:00Z"
}

When approaching_limit is true, you are within 20% of your monthly quota. Consider upgrading your plan or waiting for the reset date.

Upgrade your plan

If you need higher quotas or additional features (security scans, webhooks, more API specs), upgrade from the dashboard (opens in a new tab) under Settings → Billing, or via the API:

curl -X POST https://api.nat-testing.io/api/v1/billing/checkout \
  -H "X-API-Key: $NAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "plan": "pro",
    "success_url": "https://app.nat-testing.io/dashboard?upgraded=true",
    "cancel_url": "https://app.nat-testing.io/dashboard"
  }'

The response contains a checkout_url to redirect your user through the Stripe checkout flow. See Pricing & Plans for a full plan comparison.


Rate limits

Each plan includes a per-minute request rate limit. When you exceed it, the API returns 429 Too Many Requests with a Retry-After header.

Rate limits by plan:

PlanRequests / minute
Free10
Pro60
Team200
Enterprise1,000

Check the X-RateLimit-Remaining response header to monitor your remaining capacity, and honour the Retry-After header value (in seconds) when you receive a 429.


Common errors & troubleshooting

StatusCodeMeaningFix
401 UnauthorizedUNAUTHORIZEDMissing or invalid API keyEnsure X-API-Key header is set and the key starts with nat_pk_
402 Payment RequiredQUOTA_EXCEEDEDMonthly scan quota exhaustedUpgrade your plan or wait for quota_reset_date
429 Too Many RequestsRATE_LIMITEDAPI request rate limit exceededBack off and retry after the Retry-After header value (seconds)
503 Service UnavailableSTRIPE_NOT_CONFIGUREDStripe not set up (self-hosted only)Set STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET env vars
⚠️

401 Unauthorized — Always use the X-API-Key header (not Authorization: Bearer). Your key must start with nat_pk_. Verify it in the dashboard under Settings → API Keys.

⚠️

402 Payment Required — Quota is exhausted for this billing period. Either upgrade your plan (opens in a new tab) or wait for quota_reset_date. The response body includes the exact reset timestamp.

⚠️

429 Too Many Requests — You have exceeded your plan's request rate limit. Respect the Retry-After header returned in the response. Free plan: 10 req/min; Pro: 60 req/min; Team: 200 req/min; Enterprise: 1,000 req/min.


Next steps

Having trouble? Check the onboarding troubleshooting guide for solutions to common setup issues.


Add functional testing

Security scanning is just one side of NAT. You can also run visual regression, accessibility, and performance tests by passing "mode": "functional" (or "mode": "full" for both security and functional) in the same POST /api/v1/scan request:

curl -X POST https://api.nat-testing.io/api/v1/scan \
  -H "X-API-Key: $NAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://app.example.com",
    "mode": "functional"
  }'

Ready to run your first functional test? Follow the Functional Testing Quickstart for a step-by-step walkthrough covering visual regression, accessibility, and Core Web Vitals. See the Functional Testing API reference for full endpoint documentation.

Was this helpful?