Skip to main content
Remote Browser gives you an isolated Chromium session for visiting infrastructure you do not trust. The page loads on Infrawatch hardware, egressing from a country you choose, so nothing touches your network and nothing you visit learns anything about you. Sessions are scoped to a project, and everything a session produces stays private to the credential that opened it.

​
Start a session

You need a public URL and an exit country. Everything else has a default. The browser profile is an identity only. It changes how the browser presents itself to the page, not the operating system the session runs on.
Private targets are refused. Credentials in the URL, loopback, link-local, metadata, localhost, and local-network addresses are all rejected, so the session cannot be pointed back at your own infrastructure.
Creation is asynchronous. The request returns 202 with a Location header and the session begins queued, so poll it until it becomes ready rather than expecting a browser on the first response.
Session creation and replay both require an Idempotency-Key header. Reusing a key with the same request returns the session you already created; reusing it with a different request is a conflict. That is what stops a retry from opening a second browser.

​
Follow the lifecycle

A session that never started reports why: creation_timeout, dispatch_interrupted, or creation_failed. Closing is idempotent. Creators can close their own sessions, and project managers can terminate any session in the project.

​
Work in the session

The live view is a real interactive browser, not a video feed. You can click, type, and navigate exactly as you would locally, while the page runs somewhere else entirely. Three kinds of evidence come out of it:
  • Screenshots, captured on demand as viewport or full_page PNGs, each recorded with a SHA-256, dimensions, and byte size. These are retained indefinitely.
  • Network events, showing what the page reached for: method, host, path, status, remote address and port, and timing. These are transient and redacted, and readable only while the session is live.
  • Replay, which opens a new session against the same URL, profile, exit country, and viewport once the original has ended.
Replay re-runs the visit, it does not play back a recording. There is no stored video or DOM timeline, so a replayed session shows the site as it is now, which is often the point when you are watching infrastructure change.
Programmatic navigation is not available. A session is driven through the live view, and the navigate route returns 501.

​
Privacy model

This is the part worth understanding before you build a workflow on it. A session belongs to the exact credential that created it, whether that is a member or an API key. A project manager can see that a session exists and end it, but cannot open its evidence. Management permission never widens evidence access.

​
Live streaming

The live view is a WebSocket, admitted by a one-use ticket rather than by your API key. Request a ticket, connect with it, and it is consumed on connection. Tickets expire after 60 seconds, each reconnect needs a fresh one, and only one controlling stream may be attached to a session at a time. Ownership, permission, and entitlement are re-verified every 30 seconds while the stream is open, so revoked access ends the stream rather than waiting for it to finish.

​
Capabilities and limits

Ask the project capabilities endpoint what this credential can actually do rather than assuming. It reports which features are enabled, the exit countries available, and four effective limits: active sessions per organisation, active sessions per caller, a hard session lifetime, and an idle timeout. Exceeding an active-session limit returns 429 with Retry-After. Usage is reported per project as two numbers: how many sessions, and total duration measured once from ready to terminal. The API reports duration and does not price it.

Open directories

Inspect exposed files and listings without visiting them yourself.

Browse the API

Session, screenshot, network event, and streaming endpoints in full.