Use this file to discover all available pages before exploring further.
The Network Trace endpoint serves a structured JSON file that records every HTTP request and response observed by the headless browser during a completed scan. The trace covers the full request lifecycle — including redirects, subresource loading, and failed requests — giving analysts a detailed picture of a page’s network behavior. This is particularly valuable for detecting redirect chains leading to phishing infrastructure, identifying external resource loading from suspicious domains, and flagging unexpected POST requests that exfiltrate data. The trace is stored as html[1] in the scan record and follows the Traces schema version 0.1.
This endpoint returns HTTP 404 if the scan did not produce a trace file. This occurs when the scan errored before network capture could complete, or when the html array on the scan record does not contain a second entry. Confirm the scan’s status is done and html has at least two entries before calling this endpoint.
The trace is a powerful tool for threat analysis. Use the redirectChain field on each request to map the full chain of redirects from the submitted URL to the final destination. Filter by method = "POST" entries to detect credential harvesting forms or data exfiltration. Cross-reference remoteAddress.ip values against threat intelligence feeds to identify known malicious infrastructure.
