API documentation
Public, anonymous website performance, SEO, AI-search and security analysis API. No authentication required; all endpoints are rate limited per IP and anonymous session. Reports are public and read-only at /report?id={reportId}.
Quick start
# 1. Submit a scan (returns 202 + scan id, or 200 with a cached report)
curl -X POST http://localhost:3000/api/scans \
-H 'content-type: application/json' \
-d '{"url":"https://example.com","device":"MOBILE"}'
# 2. Poll progress (or subscribe to /api/scans/{id}/events for SSE)
curl http://localhost:3000/api/scans/{id}/status
# 3. Fetch the full report, or a single section
curl http://localhost:3000/api/scans/{id}/report
curl http://localhost:3000/api/scans/{id}/seo
# 4. Public report by report id (also the shareable web URL /report?id={reportId})
curl http://localhost:3000/api/reports/{reportId}
curl -o report.pdf http://localhost:3000/api/reports/{reportId}/pdfRate limits apply per IP and anonymous session. When a 429 response includes challengeRequired: true, request GET /api/challenge, solve the proof-of-work (find a nonce so that sha256("token:nonce") starts with the given number of hex zeros) and resubmit with the challenge field.
Scans
/api/scansSubmit a URL for analysisAnonymous. Rate-limited per IP and per session. Returns 202 when a new scan is queued or 200 when a recent cached report is reused. May return 429 with challengeRequired=true; obtain a challenge from GET /api/challenge and resubmit with the solution.
/api/scansRecent completed scanslimit(query)
/api/scans/{id}Scan metadata()
/api/scans/{id}/statusScan progress (polling)()
/api/scans/{id}/eventsScan progress (Server-Sent Events)text/event-stream with `progress` events and a final `done` event.
()
/api/scans/{id}/rescanRe-run a scan()
Reports
/api/scans/{id}/reportFull report()
/api/reports/{reportId}Public report by report id()
/api/reports/{reportId}/pdfDownload report as PDF()
Report sections
/api/scans/{id}/performancePerformance metrics, opportunities & resource summary()
/api/scans/{id}/core-web-vitalsCore Web Vitals (lab + CrUX field data when available)()
/api/scans/{id}/waterfallNetwork waterfall resources()
/api/scans/{id}/seoTechnical & on-page SEO results and issues()
/api/scans/{id}/ai-seoAI search readiness analysis()
/api/scans/{id}/geoGenerative Engine Optimization analysis()
/api/scans/{id}/schemaStructured data validation()
/api/scans/{id}/sitemapSitemap analysis()
/api/scans/{id}/robotsrobots.txt analysis and crawler access table()
/api/scans/{id}/backlinksBacklink data (provider-backed; honest unavailable state otherwise)()
/api/scans/{id}/securityHTTPS, certificate, headers, cookies, mixed content()
/api/scans/{id}/accessibilityLighthouse accessibility audits()
/api/scans/{id}/recommendationsPrioritized recommendations across all modules()
/api/scans/{id}/pagesCrawled pages()
/api/scans/{id}/lighthouseRaw Lighthouse audits()
Abuse protection
/api/challengeObtain an anti-abuse challengeReturns a proof-of-work challenge: find a nonce such that sha256(`${token}:${nonce}`) starts with `difficulty` hex zeros. If a Turnstile site key is returned, a Turnstile token may be used instead.
System
/api/healthService healthSchemas
Request and response schemas are defined in the OpenAPI document under components.schemas: ScanId, ReportId, CreateScanResponse, ScanSummary, ErrorResponse, CreateScanRequest, ProgressEvent, FullReport, Challenge.

