Overview

The integration uses HTTPS and JSON. The Lykan Shield dashboard provides an API key for every registered and verified domain. This key identifies the domain and is used to calculate short-lived request signatures.

Register the domain and verify it with the provided meta tag.
Store the API key exclusively on the server.
Generate a minute-specific signature for every request.
Send the request and process the JSON response.

POST/report-hack.html

Authentication

JSON requests use SHA-512 over the API key, host, and current timestamp in YmdHi format.

Signature formula

hash = SHA512(apiKey + ":" + host + ":" + timestamp)
timestamp = YYYYMMDDHHmm

PHP

<?php
$apiKey = getenv('LYKAN_API_KEY');
$host = 'example.com';
$timestamp = gmdate('YmdHi');
$hash = hash('sha512', implode(':', [$apiKey, $host, $timestamp]));

The signature is valid for a specific minute. Synchronize the server clock using NTP and use exactly the same hostname in the signature and payload.

Report a blocked attack

POST/report-hack.html · Content-Type: application/json

The report_hack command stores a blocked security event. FORM.url contains the path, query string, and request data separated by ### and subsequently encoded as Base64.

Field	Type	Description
`cmd`	string	Fixed value `report_hack`
`apikey`	string	API key from the dashboard
`host`	string	Hostname of the protected application
`hash`	string	SHA-512 signature
`adddb`	boolean	Temporarily add the IP to the blocklist
`user_agent`	string	User agent of the blocked request
`FORM.ip`	string	Source IP of the attack
`FORM.domain`	string	Affected domain without `www.`
`FORM.type`	string	Attack category, for example `SQL_INJECT`
`FORM.url`	base64	Context of the blocked request

PHP – complete request

<?php
$endpoint = '/report-hack.html';
$apiKey = getenv('LYKAN_API_KEY');
$host = 'example.com';
$hash = hash('sha512', $apiKey . ':' . $host . ':' . gmdate('YmdHi'));
$payload = [
  'cmd' => 'report_hack',
  'apikey' => $apiKey,
  'host' => $host,
  'hash' => $hash,
  'adddb' => true,
  'user_agent' => $_SERVER['HTTP_USER_AGENT'] ?? '',
  'FORM' => [
    'ip' => $_SERVER['REMOTE_ADDR'],
    'domain' => $host,
    'type' => 'SQL_INJECT',
    'url' => base64_encode(
      $_SERVER['PHP_SELF'] . '###' .
      ($_SERVER['QUERY_STRING'] ?? '') . '###' .
      json_encode($_REQUEST)
    ),
  ],
];
$ch = curl_init($endpoint);
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
  CURLOPT_POSTFIELDS => json_encode($payload),
  CURLOPT_TIMEOUT => 5,
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

Retrieve aggregated statistics

Statistics are retrieved using a form-encoded POST request. days must be between 1 and 365, while limit must be between 1 and 100. The SHA-256 signature is generated from the normalized domain, number of days, and current minute.

PHP

<?php
$domain = 'example.com';
$days = 30;
$limit = 10;
$hash = hash('sha256', $domain . $days . gmdate('YmdHi'));
$body = http_build_query([
  'cmd' => 'get_lock',
  'd' => $domain,
  'days' => $days,
  'limit' => $limit,
  'hash' => $hash,
]);
$ch = curl_init('/report-hack.html');
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded'],
  CURLOPT_POSTFIELDS => $body,
]);
$statistics = json_decode(curl_exec($ch), true);
curl_close($ch);

The response contains data for the daily history, current for IP addresses, countries for countries of origin, and summary for totals and domain metadata.

Responses and errors

Successful event report

{
  "status": true
}

Status	Meaning	Action
200	Request processed	Process the JSON response
400	Invalid domain or hash format	Check the parameters
401	Invalid API key or signature	Check the key, host, and server time
405	HTTP method not allowed	Use POST

Security and operations

Store API keys exclusively on the server, preferably as environment variables.
Never expose keys, signatures, or payloads in browser logs.
Use HTTPS, short timeouts, and a limited retry strategy.
Submit events asynchronously whenever possible to avoid blocking user requests.
Transmit IP addresses and request data only to the extent permitted by applicable law.

Signatures must not be pre-generated, stored, or reused.

Name	Anbieter	Zweck	Ablauf
OwnPage OwnPage
kei_frontend	OwnPage	PHP Session Cookie	8 hours

REST integration for Lykan Shield