API Reference
Complete REST API documentation. All endpoints return JSON. Dashboard APIs use session cookies; CI/CD APIs use API keys.
Authentication
Dashboard APIs (/api/*)
Authenticated automatically via Supabase session cookie in the browser.
CI/CD API (/api/v1/*)
Pass your API key via header:
HTTP
x-api-key: ap_live_abc123...
Or, equivalently, using a Bearer token:
HTTP
Authorization: Bearer ap_live_abc123...
CI/CD Scan
POST /api/v1/scan
Trigger an accessibility scan from CI/CD.
POST /api/v1/scan request parameters| Parameter | Type | Required | Description |
|---|
url | string | Yes | Site URL (must match registered site) |
threshold | number | No | Minimum score to pass (0-100) |
wait | boolean | No | Block until complete (max 5 min) |
max_pages | number | No | Override page limit |
GET /api/v1/scan?id={scanId}
Poll scan status and results.
API Keys
API Keys endpoints| Method | Endpoint | Description |
|---|
| GET | /api/api-keys | List keys (hashes hidden) |
| POST | /api/api-keys | Create key (full key shown once) |
| DELETE | /api/api-keys?id={id} | Revoke key |
Sites
Sites endpoints| Method | Endpoint | Description |
|---|
| GET | /api/sites | List all sites |
| POST | /api/sites | Add a site |
| GET | /api/sites/{id} | Get site details |
| PATCH | /api/sites/{id} | Update site |
| DELETE | /api/sites/{id} | Remove site |
| POST | /api/sites/{id}/verify | Verify ownership |
Scans
Scans endpoints| Method | Endpoint | Description |
|---|
| GET | /api/scans | List scan jobs |
| POST | /api/scans | Trigger manual scan |
| GET | /api/scans/{id} | Scan details |
| GET | /api/scans/{id}/pages | Per-page results |
Violations
Violations endpoints| Method | Endpoint | Description |
|---|
| GET | /api/violations | List violations (filterable) |
| GET | /api/violations/{id} | Violation details (includes screenshots, workflow state) |
| PATCH | /api/violations/{id} | Update status (open, in progress, resolved, suppressed, accepted exception), set assignee, or attach a suppression / exception reason |
| POST | /api/violations/{id}/fix | Generate AI fix suggestion |
| GET | /api/violations/{id}/comments | List comments on a violation |
| POST | /api/violations/{id}/comments | Add a comment |
| GET | /api/violations/{id}/events | Get workflow event history |
| GET | /api/export/ai-instructions | Download AI fix instructions (Markdown) |
Reports
Reports endpoints| Method | Endpoint | Description |
|---|
| GET | /api/vpats | List VPATs |
| POST | /api/vpats | Generate VPAT |
| GET | /api/vpats/{id} | VPAT details |
| GET | /api/vpats/{id}/pdf | Download VPAT as PDF |
| POST | /api/statements | Publish accessibility statement |
| POST | /api/certificates | Generate conformance certificate |
Sharing
Sharing endpoints| Method | Endpoint | Description |
|---|
| POST | /api/shared-reports | Create a shareable report link (30-day expiry) |
| GET | /api/shared-reports | List active shared links for a site |
| DELETE | /api/shared-reports?id={id} | Revoke a shared link |
Organizations
Organizations endpoints| Method | Endpoint | Description |
|---|
| GET | /api/organizations | List your organizations |
| POST | /api/organizations | Create an organization |
| POST | /api/organizations/switch | Switch active organization |
| POST | /api/organizations/leave | Leave an organization |
| POST | /api/organizations/transfer | Transfer ownership |
| POST | /api/organizations/delete | Delete organization (owner, email-verified) |
Team & Settings
Team and settings endpoints| Method | Endpoint | Description |
|---|
| GET | /api/team | List members |
| POST | /api/team | Invite member |
| DELETE | /api/team?id={id} | Remove member |
| GET | /api/audit-log | View audit log (admin/owner) |
| GET | /api/settings | Get org settings |
| PATCH | /api/settings | Update org settings |
Webhooks
Each organization has a single outbound webhook URL and signing secret. Configure both with PATCH /api/settings (fields webhook_url and webhook_secret); fetch the current configuration with GET /api/settings. Set the URL to an empty string or the secret to empty to disable delivery. See Webhooks for payload shape, supported events, and signature verification.
User
User endpoints| Method | Endpoint | Description |
|---|
| POST | /api/user/avatar | Upload profile avatar |
| DELETE | /api/user/avatar | Remove profile avatar |
| GET | /api/user/notification-prefs | Get notification preferences |
| PATCH | /api/user/notification-prefs | Update notification preferences |