How do I use the REST API?
The REST API is the MCP server’s tools over plain HTTP. Open the OpenAPI description from the link The same tools as a REST API on the MCP server page, then send a request to /api/v1/ followed by a tool name, such as /api/v1/scan_page. The page tools need no account and no key. The tools that act on a person’s own sites need that person’s approval.
-
Open the OpenAPI description
Press MCP server in the footer, then The same tools as a REST API. That is the OpenAPI file at /api/v1/openapi.json. Point an OpenAPI tool at it to read every operation, or import it to generate a client. The same address is listed in the site’s API catalogue at /.well-known/api-catalog.
-
Call a page tool
Every tool is at /api/v1/ and its name, and takes either a GET with its inputs as query parameters or a POST with them as a JSON body. To scan a page, send the address as url to /api/v1/scan_page; a bare domain works. If that exact page was scanned in the last 24 hours you get the stored result; add fresh set to true to run a new scan. The page tools are scan_page, get_report, page_history, list_checks, explain_check, request_site_scan and leaderboard.
-
Read the answer
Each answer is JSON with ok, the tool name, a one-line summary and the data. Every answer carries a link to the full report on the website, and a source line you should pass on if you show the result to anyone. A page that refuses our scanner comes back as blocked with no score. A bad input comes back as ok false with an error code and a message.
-
Use the account tools
start_site_scan, site_scan_status, list_sites, site_history, set_pins, set_rescan_settings and share_site_scan work on a person’s own sites. Called without a token they answer 401 with a WWW-Authenticate header that names where to start. The person approves your connection once, in their own browser, and you then send the token as a bearer token. A program cannot create an account for anyone.
-
If it says to wait
Starting a new scan has a daily limit per connection and a stricter rate limit than reading a stored result; stored results do not count towards the daily limit. When you go over, the answer says so. Wait, then try again, or read the stored report instead.
The why behind it
More help
Ready when you are
Rather talk it through with a person? Book a call. No pitch, just a plain-English chat.
Book a call