Droidwatch — Quickstart

Get your first Android .apk or iOS .ipa analyzed in under two minutes.
Droidwatch is a hosted service — there's nothing to install or run.

Option A — Analyze in the browser (no account)

  1. Go to droidwatch.app.
  2. Drag an .apk (or .xapk / .aab / .dex / .ipa) onto the upload box — or click to choose a file.
  3. Watch the live progress. When it finishes you get the full report: verdict, risk
    score, findings, MITRE ATT&CK Mobile mapping, MASVS coverage and a STIX 2.1 bundle.

No registration is required for your first analyses. Create a free account to keep
a history of your runs, export PDF/STIX, use webhooks, and access the API.

Option B — Analyze via the API

The API is for automating analysis — from a script, a backend, or CI/CD.

1. Get an API key

Sign in at droidwatch.app, open Profile → API keys, and
create a key. It's shown once — store it securely. Send it on every request as the
X-Auth-Key header.

export DW_KEY="dw_your_api_key_here"
export DW="https://droidwatch.app"

2. Upload a file

curl -s -X POST "$DW/api/upload" \
  -H "X-Auth-Key: $DW_KEY" \
  -F "[email protected]"

{ "upload_id": "a3f8e2d1-7b4c-4e9a-8f1d-2c5a6b3d9e0f", "file_type": "apk" }

3. Start the analysis

curl -s -X POST "$DW/api/analyze" \
  -H "X-Auth-Key: $DW_KEY" -H "Content-Type: application/json" \
  -d '{"upload_id": "a3f8e2d1-7b4c-4e9a-8f1d-2c5a6b3d9e0f", "filename": "suspicious.apk"}'

{ "job_id": "job_91a2…", "run_id": "run_57c3…", "cached": false }

4. Poll until it's done

curl -s "$DW/api/jobs/job_91a2…" -H "X-Auth-Key: $DW_KEY"

The status field moves queued → running → done. Static analysis is typically
30–90 seconds for a 50 MB APK.

{ "status": "done", "progress": 100, "run_id": "run_57c3…" }

5. Fetch the full report

curl -s "$DW/api/runs/run_57c3…/artifact/report.json" \
  -H "X-Auth-Key: $DW_KEY" | python -m json.tool

The report is a rich JSON document: overview (verdict + score), every finding with
severity and evidence, MITRE ATT&CK Mobile techniques, MASVS/MASTG mapping, network
IOCs and more. See the API Reference for the full schema, plus
PDF, CSV, DOCX and STIX 2.1 export endpoints.

CI/CD integration

Block malicious builds in your pipeline. The official GitHub Action uploads an
APK, waits for the verdict, and fails the build according to your policy — and the
same curl-based runner works on GitLab CI, Bitrise, Jenkins, CircleCI and Azure
Pipelines. See the CI/CD integration guide.

Plans

Plan For
Free 5 analyses/day, full static report, MITRE mapping
Pro 100 analyses/day, API, PDF + STIX 2.1, webhooks
Team 500 analyses/day, dynamic (Frida) analysis, priority support
Enterprise Unlimited, private STIX feed, custom YARA, SLA — and an on-premise / self-hosted deployment if your APKs can't leave your perimeter

Self-hosting (Docker / Kubernetes, fully air-gapped) is available for Enterprise
customers — your apps and reports never leave your tenant. Talk to us at
[email protected].

Next steps