> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pulsedive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Add Indicator to the Queue

> Add an indicator to the scanning queue and receive a queue ID, so you can poll for results.




## OpenAPI

````yaml /api/scan-explore.yaml post /api/analyze.php
openapi: 3.0.3
info:
  title: Pulsedive API Reference
  version: 1.0.0
  description: >
    The Pulsedive API lets you programmatically manage resources within
    Pulsedive.

    Users can look up known indicators and threats, enrich and investigate
    indicators, query Pulsedive data, and automate workflows.


    Please report any discrepancies in API behavior to <a
    href="mailto:support@pulsedive.com">Pulsedive Support</a>.
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  contact:
    email: support@pulsedive.com
servers:
  - url: https://pulsedive.com
security: []
tags:
  - name: Scan
    description: >
      Queue an indicator for scanning and poll to retrieve enriched threat
      intelligence results.


      ## Workflow


      1. Submit an indicator.
          Add an indicator to the scanning queue and receive a queue ID.
      2. Poll for results.
          Use the queue ID to check progress and retrieve data.

      ## Storage Behavior


      Scan indicators without permanently storing them in Pulsedive. This
      performs the same enrichment and risk scoring as submitting through the
      UI, but the data isn't stored. If the indicator already exists in the
      database, however, its information will be updated.


      <Note>

      For bulk scans, use the UI's [Analyze](https://pulsedive.com/analyze/)
      page.

      </Note>
  - name: Explore
    description: Search for indicators using query language.
externalDocs:
  url: https://docs.pulsedive.com
paths:
  /api/analyze.php:
    post:
      tags:
        - Scan
      summary: Add Indicator to the Queue
      description: >
        Add an indicator to the scanning queue and receive a queue ID, so you
        can poll for results.
      operationId: scanIndicatorByValue
      parameters:
        - $ref: '#/components/parameters/APIKey'
        - $ref: '#/components/parameters/Indicator'
        - $ref: '#/components/parameters/IOC'
        - $ref: '#/components/parameters/Probe'
        - $ref: '#/components/parameters/Submit'
        - $ref: '#/components/parameters/Pretty'
      responses:
        '200':
          description: Successful request. Returns scan queue information in JSON format.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScanResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-codeSamples:
        - lang: curl
          label: Add to Queue
          source: |
            curl "https://pulsedive.com/api/analyze.php?value=pulsedive.com"
        - lang: curl
          label: Safe Indicator Handling
          source: >
            curl
            "https://pulsedive.com/api/analyze.php?ioc=cHVsc2VkaXZlLmNvbQ%3D%3D&probe=1"
components:
  parameters:
    APIKey:
      name: key
      in: query
      required: false
      description: >
        Your Pulsedive API key.


        API key authentication is optional. However, requests without a key have
        stricter rate limits. We recommend including an API key for better
        performance and reliability.
      schema:
        type: string
    Indicator:
      name: value
      in: query
      required: false
      description: |
        Value of the indicator to scan. May be:

        - a domain name (e.g., `microsoft.com`)
        - an IP address (e.g., `8.8.8.8`)
        - a URL (e.g., `https://pulsedive.com/explore`)

        To use a base64-encoded indicator, use the `ioc` parameter instead.
      schema:
        type: string
      examples:
        ip:
          summary: IPv4 address
          value: 8.8.8.8
        domain:
          summary: Domain name
          value: microsoft.com
        url:
          summary: URL
          value: https://pulsedive.com/explore
    IOC:
      name: ioc
      in: query
      required: false
      description: >
        Base64-encoded value of the indicator to scan.


        Useful for safely transmitting indicators that contain special
        characters or when the indicator is not being processed correctly
        through the `indicator` parameter. (If this is happening, please let us
        know.)


        Use this parameter instead of `indicator` when submitting base64-encoded
        data.
      schema:
        type: string
      examples:
        base64domain:
          summary: Base64-encoded domain
          value: cHVsc2VkaXZlLmNvbQ==
        base64url:
          summary: Base64-encoded URL
          value: aHR0cHM6Ly9wdWxzZWRpdmUuY29tL2V4cGxvcmU=
    Probe:
      name: probe
      in: query
      required: false
      description: >
        Scan type for the indicator.


        Passive scans collect data without direct contact, such as through WHOIS
        and DNS requests. Active scans include port scanning and web browser
        analysis, which are more detectable.


        For active scanning, set to `1`.

        For passive scanning, set to `0`.
      schema:
        type: integer
        enum:
          - 0
          - 1
        default: 0
      examples:
        passive:
          summary: Passive scan
          value: 0
        active:
          summary: Active scan
          value: 1
    Submit:
      name: submit
      in: query
      required: false
      description: >
        Controls whether to save the scanned indicator to Pulsedive's database.


        To store the indicator and make it searchable in future queries, set to
        `1`.

        To scan and enrich without storing, set to `0`.


        If you scan an indicator that already exists in the database, Pulsedive
        updates it with fresh scan results regardless of this parameter's value.
      schema:
        type: integer
        enum:
          - 0
          - 1
        default: 0
      examples:
        submit:
          summary: Store indicator
          value: 1
        no_submit:
          summary: Don't store indicator
          value: 0
    Pretty:
      name: pretty
      in: query
      required: false
      description: |
        Indicates whether to format returned JSON results.

        For pretty-printed output, set to `1`.
        For compact output, set to `0`.
      schema:
        type: integer
        enum:
          - 0
          - 1
        default: 0
      examples:
        compact:
          summary: Compact output
          value: 0
        pretty:
          summary: Pretty-printed output
          value: 1
  schemas:
    ScanResponse:
      type: object
      properties:
        qid:
          type: integer
          description: |
            Unique identifier of the scan request (Queue ID).
          example: '2100254203'
      additionalProperties:
        type: string
        description: >
          Dynamic key-value pair representing the outcome of your request.


          Each `{key}` represents the overall outcome of your request. The
          `{value}` string provides additional context for the outcome. Until
          your request is complete, the `{key}` will be `error`.
        example:
          error: Added request to queue.
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Message describing the error that occurred, if available.
  responses:
    BadRequest:
      description: |
        Bad request. The request was malformed or missing required parameters.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: |
        Unauthorized. Your API key is missing or invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: |
        Not found. The requested indicator could not be located.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    TooManyRequests:
      description: >
        Rate limit exceeded. Too many requests have been made in a short period
        of time.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: |
        Server error. An unexpected problem occurred on our end.
        These errors are automatically reported to our team.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'

````