Target Management

Targets are domains you want to scan. Each target is validated, scoped to your account, and can be used for any number of scans.

Creating Targets

Create a single target by sending a domain name to the API. The domain is validated against a strict regex format, checked against a blocked list, and verified against your existing targets.

Domain Format

Domains must match the following regular expression:

Domain validation regex

^(?!-)[A-Za-z0-9_-]{1,63}(?<!-)(\.[A-Za-z0-9_-]{1,63})*\.[A-Za-z]{2,}$

Valid examples: example.com, api.example.org, sub-domain.example.co.uk

Invalid examples: -example.com, example..com, example.c

Blocked Targets

The following domains are blocked and cannot be added as targets:

Blocked domains

localhost
0.0.0.0
::1
127.0.0.1
xnolex.com

Warning

Attempting to scan localhost, internal IP addresses, or xnolex.com domains will be rejected with a 400 error.

API Example

POST /api/v1/targets

curl -X POST https://api.xnolex.com/api/v1/targets \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "example.com",
    "organization": "Example Corp"
  }'

Response:

200 OK

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "domain": "example.com",
  "organization": "Example Corp",
  "status": "active",
  "scan_count": 0
}

Bulk Import

Import multiple domains in a single request. Each domain is individually validated. Duplicates are skipped, and invalid entries are reported in the response.

POST /api/v1/targets/import

curl -X POST https://api.xnolex.com/api/v1/targets/import \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": [
      "example.com",
      "api.example.com",
      "staging.example.org",
      "invalid-domain",
      "example.com"
    ]
  }'

Response:

200 OK

{
  "created": 3,
  "skipped": 1,
  "errors": ["Invalid domain format: invalid-domain"]
}

Note

Duplicates within the same request or domains that already exist for your account are silently skipped and counted in the "skipped" field.

Ownership & Scope

Each target is scoped to the user who created it. You can only see, scan, and delete your own targets. All API queries filter by your user ID automatically. Attempting to access a target owned by another user returns a 404.

Deleting Targets

Delete a target by its ID. Only targets you own can be deleted. The target must not have active (pending or running) scans.

DELETE /api/v1/targets/{id}

curl -X DELETE https://api.xnolex.com/api/v1/targets/550e8400-e29b-41d4-a716-446655440000 \
  -H "Authorization: Bearer <token>"

Tier Limits

Target creation is limited by your subscription tier:

Tier

Target Limit

Demo

Monthly Pro

Unlimited

Yearly Pro

Unlimited

Info

Reaching your target limit returns a 403 error with an upgrade prompt. Upgrade your plan to add more targets.

Listing Targets

Retrieve all targets for your account. Results are ordered by creation date (newest first) and include the scan count for each target.

GET /api/v1/targets

curl https://api.xnolex.com/api/v1/targets \
  -H "Authorization: Bearer <token>"

Response

[
  {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "domain": "example.com",
    "organization": "Example Corp",
    "status": "active",
    "created_at": "2025-01-15T10:30:00Z",
    "updated_at": "2025-01-15T10:30:00Z",
    "scan_count": 5
  }
]