urlscan.io n8n integrationAutomate urlscan.io with n8n.
Three operations, one resource, and every scan result lands in your workflow as plain data. The urlscan.io n8n integration wraps the scan API in a single node: submit a URL, search past scans, pull one back by its ID. No trigger ships with it, so a schedule or another app starts the run.
Verified Trustpilot reviews · AI, automation & growth agency
What does the urlscan.io n8n integration actually do?
urlscan.io opens a page in its own browser and writes down what happened: the domains contacted, the files pulled, a screenshot, a verdict on the page. The n8n node exposes that service as three steps you can drop between any two other nodes, so a link that arrives somewhere gets checked without a person pasting it into a website.
Everything runs on one credential, the saved API key n8n stores once and offers in a dropdown inside every workflow on your instance.
Take inbox triage first. A suspicious message reaches a shared address, a Gmail step reads it, the node performs a scan on the link it contains, and the outcome goes straight to the person on duty in Slack. That is the shape of the public template Scan URLs with urlscan.io and Send Results via Gmail (6946), and of the wider Phishing Analysis workflow (1992) that pairs the node with an HTTP Request call to a second reputation service.
Second, a brand watch log. A Schedule Trigger fires each morning, Get Many Scans runs a Query such as domain:n8n.io, and the matching scans are appended to Google Sheets so one tab holds the week instead of a browser tab per lookup. The certificate monitoring template (12221) uses the same idea on newly issued domains that look like a brand.
Third, ticket enrichment. A scan gets submitted when a ticket opens, and a later branch fetches the finished report by its scan ID to attach the screenshot and the domain list to the ticket itself.
The node covers the Scan resource only. Anything else in the urlscan.io API goes through the HTTP Request node, which reuses the same credential through predefined authentication instead of asking you to rebuild a header by hand.
Two limits worth knowing before you build. There is no urlscan.io trigger in n8n, so nothing on the urlscan.io side can wake a workflow up on its own. And a scan is not instant by nature: the page has to be loaded and recorded, which is why the submit step and the read step are two separate operations rather than one. If you want the wider view on the platform itself, the n8n review covers what the tool is good at.
How do you connect urlscan.io to n8n?
- 01
Open an urlscan.io account
The credential needs an account on urlscan.io, so start there if the team does not have one yet. This is the account the scans will be filed under, which matters later: the Visibility setting on a scan decides whether it stays private to that account or shows up publicly, and the search operation reads from what the account can see.
- 02
Generate the API key
Inside urlscan.io, go to Settings & API, then API Keys, and create a key. An API key is a long string that stands in for a password when a program talks to the service, so treat it like one. Copy it once it is shown. It is the only authentication method the n8n node supports, there is no OAuth flow and no account selector on the node itself.
- 03
Save the credential in n8n
In n8n, open the Credentials menu, create an urlscan.io credential and paste the value into the API Key field. A credential lives outside the workflow: you build it once and every urlscan.io node on the instance can pick it from its dropdown, whether that instance runs on n8n Cloud or on your own Docker install.
What the urlscan.io node can do
The urlscan.io node exposes 3 operations across 1 resources. For each one: the node as you configure it in n8n, the required fields, and our field notes.
Scan
3 operationsGet a scan
scan.getWhat you see in n8n
Notes & use cases
This one reads a single finished scan back out of urlscan.io and returns its result: the page that was loaded, the domains it reached, the verdict attached to it.
Key parameters
- Scan ID: which scan to retrieve. The node marks no field as required here, but without an ID it has nothing to point at, so this is usually an expression such as
{{ $json.scanId }}carrying the value from the step that submitted the scan.
Get many scans
scan.getAllWhat you see in n8n
Notes & use cases
Searching rather than fetching: this operation returns a list of scans that match a search, one item per scan.
Key parameters
- Query: sits in the Filters collection and takes Elastic Search query string syntax, for example
domain:n8n.io, matched against the fields urlscan.io documents for search. - Return All: on, n8n walks through the pages of the API until every matching scan is back.
- Limit: with Return All off, the highest number of scans the step will hand on.
Perform a scan
scan.performWhat you see in n8n
Notes & use cases
Submits a URL so urlscan.io loads it in its sandbox and records the visit. This step creates the scan; reading the result is a separate call.
Key parameters
- URL: the address to scan, in the form
https://n8n.io, often fed by{{ $json.url }}from the node before. - Visibility:
private,publicorunlisted, which decides who gets to see the scan afterwards. - Tags: a comma separated list such as
phishing, malicious, capped at 10 tags per scan.
Need help automating urlscan.io with n8n?
A person reads every message.
