How do I connect urlscan.io?

Sign up for Conductor Deck, then add a urlscan.io step to a workflow on the visual canvas. The builder walks you through the connection it needs — an account authorization or the required keys — right inside the step. No separate setup or code.

Yes — Conductor Deck has a free tier you can build and run workflows on, with no credit card required. Paid plans raise the monthly run limits and add advanced features when you need them.

What's the difference between a trigger and an action?

A trigger is the event that starts a workflow — for example, a Stream Deck button press or an incoming event from a connected app. An action is a step the workflow performs once it runs. A workflow is one trigger followed by one or more actions.

urlscan.io + Stream Deck

security-&-identity-tools · developer-tools · 0 triggers · 50 actions

Submit and retrieve website scans, search urlscan.io data, and manage urlscan Pro resources for threat intelligence and security investigations. Add urlscan.io to your Stream Deck workflows with guided setup for the connection details it needs.

Build an urlscan.io workflow — free See how it works

No code
Free tier
One Stream Deck press
Pairs with OBS & Elgato tools
OAuth & keys handled in-builder

Popular ways to use urlscan.io

Add urlscan.io to a workflow and pair it with a Stream Deck button to run it in one press — handy for security-&-identity-tools tasks. Combine it with OBS, your Elgato tools, or any other app you connect to build a routine that fits how you work.

Browse all templates

Triggers & actions

Steps your workflow can perform in urlscan.io.

Close Incident

Stop ongoing scans for an active urlscan Pro incident and transition it to the closed state. Closing does not delete the incident or its history, and the incident can later be restarted.

Copy Incident

Create a separate urlscan Pro incident from an existing incident's configuration. This create operation can consume incident capacity and does not copy the source incident's stored state history; use the distinct fork operation when history must be preserved. The provider does not document whether the copied incident immediately activates ongoing scans or alerts.

Create Alert Subscription

Create a persistent scheduled or live alert subscription for saved searches. This Pro-only operation has external notification side effects: an active subscription can send email, invoke configured channels or webhooks, and create incidents. Confirm all recipients and channel or incident settings before calling.

Create Incident

Create a Pro incident that persistently monitors an observable. This high-impact operation starts ongoing external scans and can send alerts through every supplied notification channel; confirm the observable, visibility, channels, cadence, and expiration settings before calling. The operation is contract-only because the connected build account lacks the urlscan Pro Incidents entitlement.

Create Live Scan Task

Start a non-blocking temporary Live Scan on a selected scanner and return its UUID immediately without waiting for completion. This external scan side effect requires the separate urlscan.io Live Scanning entitlement; a generic Pro plan may not include it.

Create Notification Channel

Create a Pro notification channel. This operation configures external effects: active webhook channels send requests to the supplied secret URL, and active email channels send messages to the supplied recipients. Confirm the destination and activation settings before calling.

Create Saved Search

Create a reusable scans or hostnames search definition. This operation creates a persistent saved search and requires urlscan Pro; the hostnames datasource may require an additional product entitlement.

Delete Alert Subscription

Permanently delete an alert subscription by ID. This destructive operation cannot be undone and requires urlscan Pro subscriptions access plus ownership or team write permission. Use it only for a subscription created or explicitly selected by the current workflow.

About urlscan.io

Submit and retrieve website scans, search urlscan.io data, and manage urlscan Pro resources for threat intelligence and security investigations.

security-&-identity-toolsdeveloper-tools

How to connect

Sign up for free

Create your Conductor Deck account: no credit card required.

Connect urlscan.io

Follow the setup prompts for urlscan.io. Conductor Deck handles the app authorization or required connection details inside the workflow builder.

Build a workflow

Add an urlscan.io action to your visual workflow canvas. Configure the options you need, then connect it to other steps.

Assign to Stream Deck

Sync your workflow to any Stream Deck button. Press once to trigger the entire sequence.

Frequently asked questions

How do I connect urlscan.io?: Sign up for Conductor Deck, then add a urlscan.io step to a workflow on the visual canvas. The builder walks you through the connection it needs — an account authorization or the required keys — right inside the step. No separate setup or code.
Is it free?: Yes — Conductor Deck has a free tier you can build and run workflows on, with no credit card required. Paid plans raise the monthly run limits and add advanced features when you need them.
What's the difference between a trigger and an action?: A trigger is the event that starts a workflow — for example, a Stream Deck button press or an incoming event from a connected app. An action is a step the workflow performs once it runs. A workflow is one trigger followed by one or more actions.

Automate urlscan.io with your Stream Deck

Get started free View pricing

Similar integrations