Romp Documentation

Romp is a security scanner platform with three deployment modes: in-browser (free), hosted Subscription, and self-hosted Download. This page covers the API and install reference.

Quick start

Get up and running in 60 seconds. Sign up, create an API token, scan a target.

# 1. Sign up at https://domainless.fun/romp/signup
# 2. Sign in → Account → "Create API token"
# 3. Run a scan with curl:

export ROMP_TOKEN="rpt_..."
curl -H "Authorization: Bearer $ROMP_TOKEN" \
     "https://domainless.fun/romp/v1/scan/red_otter/dns?target=example.com"

Authentication

Romp accepts three authentication modes. Pick whichever fits your context:

1. JWT cookie (browser / PWA)

Sign in via POST /v1/auth/login. The server sets an httpOnly + Secure + SameSite=Strict cookie. Subsequent requests carry the cookie automatically (with credentials: "same-origin" in fetch).

2. Bearer API token (programmatic / CLI / CI)

Create a token at /account. Send as a header on every request:

Authorization: Bearer rpt_0d2640f6e1b3a15ee21ec82ed6c21ce402716c1964a03ffb4cb54b6557c4d74e

Tokens are stored as SHA-256 hashes — we cannot recover them after creation. Lose the raw value? Create a new one and revoke the old.

3. License token (self-hosted Download)

The Download tier ships with a signed ed25519 license token. Use it as a header for offline-verifiable auth:

X-Romp-License: eyJhbGciOiJFZERTQSI...

Verify offline using the public key at /v1/auth/public-key.pem.

API tokens

Tokens belong to a user and inherit their tier. Manage at /account or via the API:

POST/v1/auth/tokens

Create a new token. The raw token is returned ONCE in the response — save it now or never.

$ curl -b cookies.txt -X POST -H "Content-Type: application/json" \
       -d '{"name":"laptop CI","ttl_days":365}' \
       https://domainless.fun/romp/v1/auth/tokens

{
  "id": 7,
  "name": "laptop CI",
  "token_preview": "rpt_0d26…d74e",
  "created_at": 1779113374,
  "expires_at": 1810649374,
  "token": "rpt_0d2640f6e1b3a15ee21ec82ed6c21ce402716c1964a03ffb4cb54b6557c4d74e"
}

GET/v1/auth/tokens

List your tokens. Raw values are never returned.

DELETE/v1/auth/tokens/:id

Revoke a token. Effective immediately.

Scanner reference

Romp ships 9 scanner modules. Your tier determines which you can use; check /v1/entitlements.

red_otter

:4000

Recon — DNS, SSL, headers, ports, ping, IP lookup, whois, traceroute

cyber_guard_dog

:4100

Monitoring + alerting bus

black_otter

:4200

Vuln scanning, SQLi, XSS, dir enumeration

yellow_otter

:4300

Authentication testing

white_otter

:4400

Alerts + reporting

grey_otter

:4500

Threat intel + IoC lookups

blue_otter

:4600

Crawler, forms, CORS, methods, info disclosure

green_otter

:4700

Cloud config + IAM checks

orange_otter

:4800

Wireless + perimeter recon

Endpoint reference

Auth

POST/v1/auth/register

Body: {email, password}. Creates user, sets cookies, fires verify email.

POST/v1/auth/login

Body: {email, password}. Returns user, sets cookies. Locks after 5 failed attempts/15min.

POST/v1/auth/refresh

Rotate refresh token, issue new access cookie.

POST/v1/auth/logout

Revoke refresh, clear cookies.

GET/v1/auth/me

Current user + tier + email_verified.

POST/v1/auth/forgot

Body: {email}. Sends reset link. Always returns 200 (no enumeration).

POST/v1/auth/reset

Body: {token, password}. Single-use, 30min TTL. Revokes all existing sessions.

POST/v1/auth/verify

Body: {token}. Marks email verified.

Scanning

GET/v1/scan/limits

Tier + rate limit status + available_otters list.

GETPOST/v1/scan/:otter/:method

Proxies to the named Otter's /api/:method. Param names vary by endpoint (target / url / host) — see scanner docs.

Commerce

GET/v1/skus

Public SKU catalog.

POST/v1/checkout/:sku

Stripe Checkout session for a paid tier.

POST/v1/billing/portal

Stripe-hosted billing portal (subs, cards, invoices).

GET/v1/download/release/:filename

License-gated artifact download. Use ?license=<token> or X-Romp-License header.

Discovery

GET/v1/auth/jwks.json

JWK Set for offline JWT verification by downstream installs (RFC 7517).

GET/v1/security/latest

Latest self-scan results.

Self-hosted install (Download tier)

# 1. Download with your license token
curl -O "https://domainless.fun/romp/v1/download/release/romp-1.3.5.tar.gz?license=$ROMP_LICENSE"

# 2. Verify the checksum
sha256sum romp-1.3.5.tar.gz
# Expected: published at https://domainless.fun/romp/v1/download/release/romp-1.3.5.tar.gz/sha256

# 3. Extract + install
tar -xzf romp-1.3.5.tar.gz
cd romp-1.3.5
sudo ./install.sh

# 4. Save license + start
sudo mkdir -p /etc/romp
echo "$ROMP_LICENSE" | sudo tee /etc/romp/license.txt
sudo ./romp.sh start

# 5. Open the dashboard
xdg-open http://127.0.0.1:4100/

Supported: Debian / Ubuntu / Fedora / RHEL / Arch / Alpine / macOS (Intel + Apple Silicon) / Windows WSL2.

Errors & status codes

`200`	Success
`400`	Bad request — missing/invalid input
`401`	Not authenticated, or token expired/invalid
`403`	Authenticated but tier lacks entitlement for this scanner
`404`	Resource not found
`409`	Conflict (e.g. account already exists)
`429`	Rate limit exceeded. Honor `Retry-After` header.
`502`	Upstream scanner unreachable
`503`	nginx-level rate limit (very high burst)

Rate limits

Anonymous / Free	5 scans / hour
Subscription / Download	1000 scans / hour

Limits are per-IP for anonymous, per-user for authenticated, per-license for downloadable installs. Programmatic users: check /v1/scan/limits before bursting.