Skip to main content
Out-of-band Application Security Testing (OAST) interactions recorded from interactsh callbacks. These represent DNS, HTTP, or other protocol interactions triggered by payloads injected during active scanning.

​
GET /api/oast-interactions — List OAST Interactions

Returns paginated OAST interactions. Heavy fields (raw_request, raw_response) are excluded from list responses for performance. Query parameters:
ParameterTypeDefaultDescription
limitint50Number of interactions to return (max 500)
offsetint0Offset for pagination
scan_idstringFilter by scan UUID
protocolstringFilter by protocol (e.g. dns, http, smtp)
module_idstringFilter by module ID
searchstringSearch across target URL, parameter name, unique ID
# List all OAST interactions
curl -s http://localhost:9002/api/oast-interactions | jq .

# Filter by protocol
curl -s 'http://localhost:9002/api/oast-interactions?protocol=dns&limit=5' | jq .

# Filter by scan
curl -s 'http://localhost:9002/api/oast-interactions?scan_id=scan-456' | jq .

# Search by target URL
curl -s 'http://localhost:9002/api/oast-interactions?search=example.com' | jq .

{
  "data": [
    {
      "id": 1,
      "scan_uuid": "scan-456",
      "unique_id": "abc123def456",
      "full_id": "abc123def456.oast.fun",
      "protocol": "dns",
      "q_type": "A",
      "remote_address": "203.0.113.42",
      "interacted_at": "2026-02-16T15:10:00Z",
      "target_url": "https://example.com/api/users?id=1",
      "parameter_name": "id",
      "injection_type": "param_value",
      "module_id": "ssrf-detection",
      "created_at": "2026-02-16T15:10:01Z"
    }
  ],
  "total": 12,
  "limit": 50,
  "offset": 0,
  "has_more": false
}
Note: The fields raw_request and raw_response are excluded from list responses. Use GET /api/oast-interactions/:id to access full interaction data.

​
GET /api/oast-interactions/:id — Get OAST Interaction Detail

Returns a single OAST interaction by its numeric ID, including full raw_request and raw_response fields. 
curl -s http://localhost:9002/api/oast-interactions/1 | jq .

{
  "id": 1,
  "scan_uuid": "scan-456",
  "unique_id": "abc123def456",
  "full_id": "abc123def456.oast.fun",
  "protocol": "http",
  "q_type": "",
  "raw_request": "GET / HTTP/1.1\r\nHost: abc123def456.oast.fun\r\n\r\n",
  "raw_response": "HTTP/1.1 200 OK\r\n\r\n<html>...</html>",
  "remote_address": "203.0.113.42",
  "interacted_at": "2026-02-16T15:10:00Z",
  "target_url": "https://example.com/api/users?id=1",
  "parameter_name": "id",
  "injection_type": "param_value",
  "module_id": "ssrf-detection",
  "created_at": "2026-02-16T15:10:01Z"
}
Error responses:
CodeCondition
400Invalid ID (not a number)
404OAST interaction not found
503Database unavailable

​
DELETE /api/oast-interactions/:id — Delete OAST Interaction

Deletes a single OAST interaction by its numeric ID. Returns 404 if the interaction does not exist. 
curl -s -X DELETE http://localhost:9002/api/oast-interactions/1 | jq .
Response (200): 
{
  "message": "OAST interaction deleted",
  "id": 1
}
Error responses:
CodeCondition
400Invalid ID (not a number)
404OAST interaction not found
503Database unavailable