Sonar documentation
Sonar organizes authorized infrastructure into workspaces. Each workspace has its own scopes, assets, scans, findings, members and API keys.
Connect and verify
- Sign in with Discord and open Verified scope.
- Add a domain or public IP you are authorized to assess.
- For domains, publish the displayed TXT value at the displayed challenge name. For IPs, serve the challenge at the displayed HTTP URL without a redirect.
- Select Verify ownership. Leave the record or file in place because scans recheck it.
- Open Scans and queue a scan. Asset discovery stays within verified domain scope.
Investigate
Asset search matches hostnames and collected evidence, including addresses, open ports, HTTP metadata and certificates. Select an asset for its current evidence and changed states. Findings include severity, evidence and remediation. Review each result and use the investigation note to document decisions. Resolved findings reopen if observed again.
Search syntax
Combine terms with spaces to require every condition. Supported fields are host, ip, port, http.status, cert.issuer, service, severity and excluded. Quote phrases containing spaces. Ports and IPs match exactly; hostnames, server headers and issuers use text matching. Severity matches open findings.
port:443 http.status:200 cert.issuer:"Example Authority" host:api excluded:false severity:high
Public passive search
Search a domain for public certificate-transparency names, existing public urlscan.io observations and current DNS records. Search a public IP for existing urlscan.io observations, RIPEstat prefix and ASN data, and reverse DNS names. These lookups do not scan the address or collect port banners. Search history contains public-source data only and is separate from workspace inventory.
Authenticated read-only checks
Configure exact HTTPS paths with a dedicated low-privilege bearer token or session cookie. HEAD checks collect headers. GET checks require you to confirm the path is read-only, compare anonymous and authenticated status codes, and discard the response body after at most 16 KiB. An anonymous 2xx result is a review signal, not proof of an access-control vulnerability. Sonar follows no redirects.
Scheduling and notifications
Settings offers one daily scan time in UTC, or manual scans only. Scheduled scans rotate through verified scopes, subject to the same daily quotas as manual scans. Add a Discord webhook to receive finding and scan updates. Delivery failures are retried with increasing delays and reported in console notifications.
Roles
Owners manage all workspace settings and team roles. Administrators manage scope, keys and analyst invitations. Analysts investigate findings, export reports and run scans within verified scope. Only the platform operator can change capacity or suspend a workspace.
API authentication
Create a scoped key in Settings. Send it in the Authorization header. The API hostname is api.tohou.io; endpoints use the /v1 prefix. The console also exposes the same endpoints under /api. Requests return JSON unless an export format is selected.
curl https://api.tohou.io/v1/assets -H "Authorization: Bearer $TOHOU_API_KEY"
Never include API keys in browser URLs or public repositories. Invalid keys return HTTP 401. Missing permissions return HTTP 403. Limits return HTTP 429.
| Endpoint | Permission | Purpose |
|---|---|---|
| GET /v1/assets?q=… | assets:read | Search inventory, 50 rows per page; use offset |
| GET /v1/assets/{id} | assets:read | Asset detail and recent states |
| GET /v1/scopes | assets:read | List scopes |
| POST /v1/scopes | assets:write + admin | Add a domain or public IP |
| POST /v1/scopes/{id}/verify | assets:write + admin | Check ownership |
| GET /v1/scans | scans:read | List scan jobs |
| POST /v1/scans | scans:write | Queue a scan with scopeId |
| POST /v1/scans/{id}/cancel | scans:write | Cancel a scan |
| GET /v1/findings | findings:read | List findings; optional status filter |
| PATCH /v1/findings/{id} | findings:write | Set status, assignee, dueAt, comment |
| GET /v1/reports?format=json | reports:read | Export assets and findings |
| GET /v1/reports?format=csv | reports:read | Export findings as CSV |
Queue a scan
curl https://api.tohou.io/v1/scans -H "Authorization: Bearer $TOHOU_API_KEY" -H "Content-Type: application/json" --data '{"scopeId":"your-verified-scope-id"}'The scope ID is returned by the scopes endpoint. A queued scan is not a completed scan; poll the scan list to inspect status, progress and errors.
Coverage
The current engine performs bounded public-network checks. It does not implement a worldwide search index, private-network agents, cloud-account posture checks, credential-leak monitoring, authenticated web assessment, or intrusive exploitation. See the scanning policy for exact behavior.
Support
Contact [email protected] for account and product support. Report unexpected scanning to [email protected] with the target and UTC timestamp.