API changelog

Every release of the API, newest first. Releases are numbered major.minor.patch inside the v1 URL. New endpoints and fields arrive in minor releases and never break existing code, so ignore fields you do not recognise. Each release keeps its own copy of the documentation, exactly as it was when it shipped.

Current documentation

One audit per minute

Single-page audits are limited to one per account per minute, to stay inside the audit engine's and Google's rate limits.

Added

• A Retry-After header on 429 responses, holding the seconds to wait.

Changed

• POST /reports and POST /reports/{id}/refresh now return 429 when the account has already run an audit in the last minute. The limit is shared by the website, the API and every key on the account. A refused request does not use up the minute, and requests that are invalid or unauthorised are not counted.
• The fair-use section now states the limit instead of saying no limit exists.

Documentation for 1.1.0 OpenAPI

First public release

The API is public and documented: audits, websites and site scores, AI-directory publishing, credits and the blog, with a personal API key.

Added

• Personal API keys (isk_...) created at /account/api, one active key per account.
• Audits: POST /reports, GET /reports, GET /reports/history, GET /reports/{id}, POST /reports/{id}/refresh.
• Websites: add, verify, release, scan, score, combined report and public scorecard.
• AI directory: publish an audit, list your snapshots, browse and read public snapshots.
• Account: GET /credits/{email} and GET /settings (current prices and limits).
• Blog: GET /blog and GET /blog/{slug}.
• X-API-Version response header and a release field on GET /health.
• An OpenAPI 3.1 file for every release.

Changed

• POST /reports with a personal key now always stores the audit under that key's account, so it can be read back.
• POST /submissions with a personal key now charges the directory's credit cost (once per audit and directory) and returns credits_charged and balance. It previously charged nothing.
• POST /submissions with a personal key only publishes audits that key ran, and always as that account.
• POST /submissions refuses audits scoring below 90, and audits with no score.

Fixed

• GET /reports and GET /reports/history no longer return the internal file location of each audit.
• GET /submissions/{provider}/{id} no longer shows who published a snapshot to anyone but the publisher.
• GET /settings no longer returns the administrator's address to a personal key.

Documentation for 1.0.0 OpenAPI