`. - `h1` (string) — The landing's H1. - `description` (string) — Meta description of the landing. - `lead` (string) — Opening paragraph. - `category` (string) — Grouping of the tool in the hub. - `icon` (string) — Name of the icon used in the card. - `checks` (string[]) — Finding codes this tool highlights — they are the `Achado.code`s. - `serp` (object) — How the result looks in the search preview. - `sections` (object[]) — Content blocks of the landing. - `_links` (object) — This tool in JSON and in HTML. **Errors** - `404` — Unknown slug. **Example** ```sh curl -s https://staging.pageaudit.online/api/tools/title-tag-checker ``` ### `GET /tools` HTML hub of the micro-tools, indexable. For JSON use `GET /api/tools`. - **URL:** `https://staging.pageaudit.online/tools` - **Auth:** `none` — Public, no credential. **Response `200`** `text/html` — the hub page, rendered on the server. ### `GET /tools/:slug` HTML landing of one check, indexable. An unknown slug returns a real 404. The 404 is real, not a 200 with an empty shell: mass soft-404s burn the whole domain in the index. - **URL:** `https://staging.pageaudit.online/tools/:slug` - **Auth:** `none` — Public, no credential. **Path parameters** - `slug` (string, required) — Tool slug, e.g. `title-tag-checker`. **Response `200`** `text/html` — the tool's landing. **Errors** - `404` — Unknown slug — a real 404, not an empty shell. ## Share ### `POST /api/audits/:id/share` Publishes the audit under a non-enumerable slug. Calling again returns the same slug. - **URL:** `https://staging.pageaudit.online/api/audits/:id/share` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — ID of the audit to publish. e.g.: `9f3c2b1d-7a4e-4c58-9b02-1f6d5e8a2c34`. **Response `200`** Structure: `Compartilhamento`. - `ok` (bool) — Always `true`. - `shared` (bool) — Whether the audit is published at the end of the call. - `slug` (string) — Public, non-enumerable slug. - `path` (string) — Path of the report's HTML page. - `badge` (string) — Path of the score badge SVG. - `_links` (object) — Report, JSON and badge, as absolute URLs. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/audits/AUDIT_ID/share -H "X-Guest-Token: $PA" ``` ### `DELETE /api/audits/:id/share` Revokes the share; the slug stops serving the report. The badge keeps answering 200 with the grey `n/a` SVG — same box, so the layout of whoever pasted it in a README does not break. - **URL:** `https://staging.pageaudit.online/api/audits/:id/share` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — ID of the audit to unpublish. e.g.: `9f3c2b1d-7a4e-4c58-9b02-1f6d5e8a2c34`. **Response `200`** - `ok` (bool) — Always `true`. - `shared` (bool) — Always `false` at the end of this call. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). **Example** ```sh curl -s -XDELETE https://staging.pageaudit.online/api/audits/AUDIT_ID/share -H "X-Guest-Token: $PA" ``` ### `GET /api/shared/:slug` Shared report as JSON, without credentials — the machine twin of `/r/:slug`. - **URL:** `https://staging.pageaudit.online/api/shared/:slug` - **Auth:** `none` — Public, no credential. **Path parameters** - `slug` (string, required) — Public slug of the share. e.g.: `k7m2p9r4t6v8w1y3z5b7c9d1`. **Response `200`** Structure: `AuditGravado`. - `audit_id` (string) — ID of the audit. - `url` (string) — Final audited URL, after following the redirects. - `score` (int) — Score from 0 to 100. - `summary` (ResumoPagina, may be null) — What the page declared at the time of the run. → see `ResumoPagina` under **Structures**. - `counts` (ContagemAchados) — How many findings of each severity. → see `ContagemAchados` under **Structures**. - `issues` (Achado[]) — Everything found in that run. → see `Achado` under **Structures**. - `fixes` (Correcao[]) — The ready fix of each finding; an audit stored before this existed gets the computation on read. → see `Correcao` under **Structures**. - `jsonLd` (object[]) — The raw JSON-LD blocks stored. - `headers` (object) — Headers of the target's response, as they were in the run. - `truncated` (string[]) — What was cut by size when storing. - `share_slug` (string, may be null) — Public slug, if this audit was shared. - `created_at` (string) — When the run happened (UTC). **Errors** - `404` — Unknown slug, or share revoked. **Example** ```sh curl -s https://staging.pageaudit.online/api/shared/SLUG ``` ### `GET /r/:slug` HTML page of the shared report, indexable, canonical at `/r/:slug`. A public report is content: indexable, with its own canonical. Revoked or unknown slugs answer 404 (that one is `noindex`). The JSON twin is `/api/shared/:slug`. - **URL:** `https://staging.pageaudit.online/r/:slug` - **Auth:** `none` — Public, no credential. **Path parameters** - `slug` (string, required) — Public slug of the share. e.g.: `k7m2p9r4t6v8w1y3z5b7c9d1`. **Response `200`** `text/html` — the rendered report, with `rel=canonical`. **Errors** - `404` — Unknown or revoked slug. ### `GET /api/badge/:slug` Metadata of the score badge, including the markdown ready for the README. - **URL:** `https://staging.pageaudit.online/api/badge/:slug` - **Auth:** `none` — Public, no credential. **Path parameters** - `slug` (string, required) — Public slug of the share. e.g.: `k7m2p9r4t6v8w1y3z5b7c9d1`. **Response `200`** Structure: `Badge`. - `slug` (string) — Slug of the shared report. - `score` (int, may be null) — Score shown in the badge. - `label` (string) — Text on the left of the badge. - `available` (bool) — `false` when the share was revoked — the SVG turns grey `n/a`. - `markdown` (string) — The markdown line ready to paste in the README. - `_links` (object) — The SVG and the report. **Errors** - `404` — Unknown slug. Revoked is different: it returns 200 with `available: false`. **Example** ```sh curl -s https://staging.pageaudit.online/api/badge/SLUG ``` ### `GET /badge/:slug.svg` SVG score badge, to paste in the README of the audited project. A revoked share returns **200** with the grey `n/a` SVG — the same box, so the README of whoever pasted it does not end up with a broken image. - **URL:** `https://staging.pageaudit.online/badge/:slug.svg` - **Auth:** `none` — Public, no credential. **Path parameters** - `slug` (string, required) — Public slug, with the `.svg` extension in the path. e.g.: `k7m2p9r4t6v8w1y3z5b7c9d1`. **Response `200`** `image/svg+xml` — the badge, coloured by the score or grey `n/a` if revoked. **Errors** - `404` — Malformed slug. ## Embed ### `GET /api/embed` The embeddable widget's contract: what you can configure and the snippet to paste. One script tag puts the audit form on your own site, with your name and colour, and no account or key. Send the same query you would send to `/embed` and the answer comes back with `snippet` already assembled. The widget never asks the visitor for an e-mail. - **URL:** `https://staging.pageaudit.online/api/embed` - **Auth:** `none` — Public, no credential. **Query** - `brand` (string) — Your site's name, shown above the form (up to 40 characters). - `color` (string) — Accent colour in hex (`#0a7` or `#00aa77`); anything else falls back to ours. - `theme` (string) — `auto` (follows the visitor), `light` or `dark`. - `url` (string) — Optional http(s) URL to pre-fill in the field. **Response `200`** - `config` (object) — Each option, its type and what it does. - `current` (object) — The configuration read from this call's query. - `snippet` (string) — The `<script>` (plus a `<noscript>` link) ready to paste. - `limits` (object) — The allowance the widget runs under, and the lead capture it does not do. **Example** ```sh curl -s "https://staging.pageaudit.online/api/embed?brand=Acme&color=%2300aa77" ``` ### `GET /embed.js` The loader you paste: it creates the widget's iframe and keeps it the right height. Configuration travels in `data-brand`, `data-color`, `data-theme` and `data-url` on the script tag itself. Nothing else of ours touches the host page: the widget lives inside the iframe, so neither the site's CSS reaches it nor our code reaches the site's DOM. - **URL:** `https://staging.pageaudit.online/embed.js` - **Auth:** `none` — Public, no credential. **Response `200`** `application/javascript` — the loader, cached for an hour. ### `GET /embed` The widget page itself, made to be framed (`frame-ancestors *`) and not indexed. Open it directly to preview a configuration before pasting the snippet. It calls `POST /api/audit` like any visitor would, so the free daily allowance per network applies. - **URL:** `https://staging.pageaudit.online/embed` - **Auth:** `none` — Public, no credential. **Response `200`** `text/html` — the widget, self-contained, with no third-party resource. ## Identity ### `POST /api/guest` Creates a guest `pa_…` — it is what gives access to the tab workspace without an account. Keep the token: it is the identity of the tabs and of the audits tied to them. - **URL:** `https://staging.pageaudit.online/api/guest` - **Auth:** `none` — Public, no credential. **Response `200`** - `token` (string) — The guest, prefix `pa_`. Send it in `X-Guest-Token`, as Bearer or in `?guest_token=`. **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/guest ``` ## Tabs ### `GET /api/tabs` The owner's whole workspace, with the active tab's result already rehydrated. One call draws the whole screen: tabs, the focused tab, its last report, remaining allowance and prices. - **URL:** `https://staging.pageaudit.online/api/tabs` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Response `200`** Structure: `Workspace`. - `tabs` (Aba[]) — Every tab of the owner. → see `Aba` under **Structures**. - `active_id` (string, may be null) — Which tab is in focus. - `active_result` (AuditGravado, may be null) — The last result of the active tab, so a second call is not needed. → see `AuditGravado` under **Structures**. - `limit` (int) — How many tabs fit before paying. - `owner` (string) — Identifier of this workspace's owner. - `gate` (Gate) — How much of the IP's free allowance remains. → see `Gate` under **Structures**. - `billing` (object) — Prices and usage, the same `GET /api/billing` returns. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. **Example** ```sh curl -s https://staging.pageaudit.online/api/tabs -H "X-Guest-Token: $PA" ``` ### `POST /api/tabs` Opens a tab for the URL, or focuses the one that already exists for it. Past the free tab allowance it answers 402 with `accepts[]`: pay and repeat. - **URL:** `https://staging.pageaudit.online/api/tabs` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Body** (`application/json`) - `url` (string, required) — The URL the tab will follow. - `alias` (string) — Label to recognise the tab in the list. **Body example** ```json { "url": "https://example.com/", "alias": "optional label" } ``` **Response `200`** - `ok` (bool) — Always `true`. - `tab` (Aba) — The opened tab (or the one that already existed for that URL). → see `Aba` under **Structures**. **Errors** - `400` — `url` missing or not http. - `401` — No credential, or an invalid one. See this endpoint's auth. - `402` — Quota exceeded. The response carries `accepts[]` (x402, USDC on Base): pay and repeat the same call with `X-PAYMENT`. **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/tabs -H "X-Guest-Token: $PA" -H 'content-type: application/json' -d '{"url":"https://example.com/"}' ``` ### `GET /api/tabs/:id` One tab with the full report of its last run. - **URL:** `https://staging.pageaudit.online/api/tabs/:id` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — Tab ID, from `Aba.id`. e.g.: `tab_9f3c2b1d7a4e58b0c2d4`. **Response `200`** - `tab` (Aba) — The requested tab. → see `Aba` under **Structures**. - `result` (AuditGravado, may be null) — The report of the last run; `null` if the tab never ran. → see `AuditGravado` under **Structures**. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). **Example** ```sh curl -s https://staging.pageaudit.online/api/tabs/TAB_ID -H "X-Guest-Token: $PA" ``` ### `PATCH /api/tabs/:id` Renames the tab, puts it in focus or turns the daily watch on and off. With `monitor: true` the page is re-audited once a day and an e-mail goes out when the score drops or a new error/warning appears — never on an improvement. Watching needs an account (the alert has to reach someone) and each account watches a limited number of pages. - **URL:** `https://staging.pageaudit.online/api/tabs/:id` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — ID of the tab to change. e.g.: `tab_9f3c2b1d7a4e58b0c2d4`. **Body** (`application/json`) - `alias` (string) — New label of the tab. - `active` (bool) — `true` focuses this tab (and unfocuses the other). - `monitor` (bool) — `true` watches the page daily; `false` stops watching it. - `monitor_email` (string) — Where the alert goes. Empty or `null` uses the account's e-mail. **Body example** ```json { "alias": "new label", "active": true, "monitor": true } ``` **Response `200`** - `ok` (bool) — Always `true`. - `tab` (Aba) — The tab with the change applied. → see `Aba` under **Structures**. **Errors** - `400` — No changeable field in the body, or `monitor_email` is not an e-mail. - `401` — No credential, or an invalid one. See this endpoint's auth. - `403` — Watching needs an account: a guest token has no e-mail to be warned at (`account_required`). - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). - `409` — The account already watches the maximum number of pages (`monitor_limit`). **Example** ```sh curl -s -XPATCH https://staging.pageaudit.online/api/tabs/TAB_ID -H "X-Guest-Token: $PA" -H 'content-type: application/json' -d '{"active":true}' ``` ### `DELETE /api/tabs/:id` Closes the tab. Its audit history keeps existing. - **URL:** `https://staging.pageaudit.online/api/tabs/:id` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — ID of the tab to close. e.g.: `tab_9f3c2b1d7a4e58b0c2d4`. **Response `200`** Structure: `Ok`. - `ok` (bool) — Always `true` — failure comes as a 4xx/5xx status, not as `ok:false`. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). **Example** ```sh curl -s -XDELETE https://staging.pageaudit.online/api/tabs/TAB_ID -H "X-Guest-Token: $PA" ``` ### `POST /api/tabs/:id/run` Re-audits the tab's URL and stores a new report. Consumes the same daily allowance as `POST /api/audit` — past it, 402 with `accepts[]`. - **URL:** `https://staging.pageaudit.online/api/tabs/:id/run` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — ID of the tab to re-audit. e.g.: `tab_9f3c2b1d7a4e58b0c2d4`. **Response `200`** - `ok` (bool) — Always `true`. - `tab` (Aba) — The tab with the new run's score. → see `Aba` under **Structures**. - `gate` (Gate) — How much of the allowance is left after this run. → see `Gate` under **Structures**. - `result` (AuditGravado) — The report just stored. → see `AuditGravado` under **Structures**. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. - `402` — Quota exceeded. The response carries `accepts[]` (x402, USDC on Base): pay and repeat the same call with `X-PAYMENT`. - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/tabs/TAB_ID/run -H "X-Guest-Token: $PA" ``` ### `GET /api/tabs/:id/history` Previous runs of that tab and what changed between each one and the one before it. Every run has always been kept; this is where you read the series. Each entry carries the score, the counts and a `change` with the point delta and the findings that appeared (`broke`) or disappeared (`fixed`) since the previous run — compared by finding code, never by message. Runs older than the watch feature are matched by URL. - **URL:** `https://staging.pageaudit.online/api/tabs/:id/history` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — ID of the tab whose runs you want. e.g.: `tab_9f3c2b1d7a4e58b0c2d4`. **Query** - `limit` (int) — How many runs to bring, newest first. Default 20, maximum 100. **Response `200`** - `tab` (Aba) — The tab the runs belong to. → see `Aba` under **Structures**. - `runs` (RunHistorico[]) — Runs from newest to oldest. → see `RunHistorico` under **Structures**. - `limit` (int) — The limit actually applied. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). **Example** ```sh curl -s "https://staging.pageaudit.online/api/tabs/TAB_ID/history?limit=10" -H "X-Guest-Token: $PA" ``` ### `GET /api/gate` How many free audits remain for this IP and whether Turnstile is about to be required. Check before spending a call: it is the number IN FORCE, not the allowance in the documentation. - **URL:** `https://staging.pageaudit.online/api/gate` - **Auth:** `none` — Public, no credential. **Response `200`** Structure: `Gate`. - `ip` (string) — IP seen by the edge, already masked. - `now` (int) — Time of the query, in epoch. - `configured` (bool) — Whether Turnstile is configured in this environment. - `free_allowance` (int) — Free audits per day. - `free_remaining` (int) — How many remain today for this IP. - `verified_until` (int, may be null) — Until when the verification already done is valid. - `needs_verification` (bool) — `true` when the next call will ask for Turnstile (human) or 402 (agent). - `sitekey` (string, may be null) — Turnstile sitekey, for the browser to build the challenge. ## Billing ### `GET /api/billing` Tab allowance, prices, full x402 configuration and the state of the trial. - **URL:** `https://staging.pageaudit.online/api/billing` - **Auth:** `none` — Public, no credential. **Response `200`** Structure: `Billing`. - `provider` (string) — Always `x402` — the only billing protocol accepted. - `mode` (string) — Seller mode: `live` charges for real, `dev` lets calls through unpaid. - `network` (string) — USDC network: `base` in production, `base-sepolia` in staging. - `chain_id` (int) — EVM chain ID of the network above, so the wallet signs on the right chain. - `pay_to` (string, may be null) — Address that receives the payment. - `homolog` (bool) — Staging seam on: the loop can be closed without spending USDC. - `dev` (bool) — Development mode: the 402 is simulated. - `dev_gate` (bool) — A homologation credential is configured; this grants no access. - `gratis` (string[], optional) — Temporarily free SKUs. - `facilitator` (string) — URL of the facilitator that verifies and settles the payment. - `asset` (string) — Accepted currency — always `USDC`. - `asset_address` (string) — USDC contract on the network above. - `faucet` (string, may be null) — Test-USDC faucet; only on base-sepolia. - `wallets` (object) — Links to wallets that speak x402 (metamask, coinbase, base_app). - `product` (string) — Name of the product charging. - `free_max_tabs` (int) — Free tabs per owner. - `prices` (Precos) — What each paid action costs, in USD. → see `Precos` under **Structures**. - `usage` (Uso) — How much of the free allowance has been used. → see `Uso` under **Structures**. - `trial` (Trial) — The account's trial, when there is a session. → see `Trial` under **Structures**. **Example** ```sh curl -s https://staging.pageaudit.online/api/billing -H "X-Guest-Token: $PA" ``` ### `POST /api/contact` Talks to support: a human solves Turnstile, an agent pays $0.10 in x402. Without a captcha in the body the request is treated as an agent: 402 until paid. The first agent message is free; after that the backoff is 60s doubling up to a 1-hour cap, announced in `Retry-After`. - **URL:** `https://staging.pageaudit.online/api/contact` - **Auth:** `none` — Public, no credential. **Body** (`application/json`) - `name` (string, required) — What to call the person writing. - `email` (string, required) — Where to reply. - `message` (string, required) — What you want to say. - `form_ts` (int) — When the form was opened; the anti-robot of the human path, and only it requires this. - `cf_turnstile_response` (string) — Turnstile response; present only on the human path. - `tipo` (string) — Proposal: `patrocinio`, `parceria` or `anuncio`. Turns on the fields below. - `empresa` (string) — Who is proposing, when it is a company. - `site` (string) — Website of who is proposing. - `orcamento` (string) — `ate_100`, `100_500`, `500_2000`, `2000_mais` or `a_combinar`. - `espaco` (string[]) — Placement ids from `GET /api/partners`, up to 6. - `duracao` (string) — Exposure in days: `30`, `90` or `365`. - `pagamento` (string) — `usdc`, `deposito` or `a_combinar`. **Body example** ```json { "name": "…", "email": "a@example.com", "message": "…", "cf_turnstile_response": "(human)" } ``` **Response `200`** - `ok` (bool) — Always `true` when the message was accepted. - `path` (string) — Which path it came through: human with captcha or paid agent. **Errors** - `400` — Required field missing. - `402` — Quota exceeded. The response carries `accepts[]` (x402, USDC on Base): pay and repeat the same call with `X-PAYMENT`. - `429` — Agent backoff: wait for `Retry-After`. **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/contact -H "X-PAYMENT: $PAYMENT" -H 'content-type: application/json' -d '{"name":"Agent","email":"a@example.com","message":"Hello"}' ``` ### `POST /api/visit` Ping from the interface that increments the day's visits. Agents need not call it. Smoke does not count: `X-MM-Smoke`, User-Agent `mm-smoke` or `smoke: true` in the body come in as `counted: false`. - **URL:** `https://staging.pageaudit.online/api/visit` - **Auth:** `none` — Public, no credential. **Body** (`application/json`) - `p` (string) — Path of the visited page. - `smoke` (bool) — `true` marks the call as a test and it does not enter the count. **Body example** ```json { "p": "/" } ``` **Response `200`** - `ok` (bool) — Always `true`. - `counted` (bool) — Whether the visit entered the day's count. - `reason` (string, optional) — Why it did not count, when `counted` is `false`. **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/visit -H 'content-type: application/json' -d '{"p":"/","smoke":true}' ``` ### `GET /api/metrics` Metrics of the last 7 days and the most frequent findings across audits. With the operator token, includes payments. Without credentials it returns visits, usage and accounts. With `METRICS_TOKEN` as Bearer it adds `payments` — and only on Base mainnet, because staging numbers on a finance panel mislead. - **URL:** `https://staging.pageaudit.online/api/metrics` - **Auth:** `none` — Public, no credential. **Headers** - `Authorization` (string) — `Bearer <METRICS_TOKEN>` to include the finance block. **Response `200`** Structure: `Metricas`. - `app` (string) — Product name. - `today` (string) — Reference day (UTC, YYYY-MM-DD). - `today_visits` (int) — Visits counted today. - `today_contacts` (int, optional) — Contact messages received today. Only with `METRICS_TOKEN`: contact does not leave without a token. - `days` (object[]) — One record per day of the window, with the counts of each metric. - `usage` (object) — Usage per product resource — here, audits and tabs. - `accounts` (object) — Total guests and accounts. - `financeiro` (object, optional) — Aggregate of the day: `hoje_usd`, `hoje_count`, `rede`. Only with `METRICS_TOKEN`: money does not leave without a token; the full series is `payments`. - `payments` (object, optional) — Finance summary; only with METRICS_TOKEN. - `achados` (object, may be null) — Which findings appear across stored audits: `audits` (total) and `por_codigo[]` with `code`, `n`, `audits` and `fracao_audits`. Aggregate, no URL and no owner; 1 h cache. `null` if the database did not answer. **Example** ```sh curl -s https://staging.pageaudit.online/api/metrics -H "Authorization: Bearer $METRICS_TOKEN" ``` ## Account ### `GET /api/me` The session's account, its last 50 audits and the state of the trial. The account is the global account you sign in to at `/conta/global`, the same in every product; `user.id` is its id, which owns the tabs and audits here. There is no activation step. - **URL:** `https://staging.pageaudit.online/api/me` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Response `200`** - `user` (Conta) — The person who owns the session. → see `Conta` under **Structures**. - `profile` (object) — Global profile: `name`, `locale`, `timeZone`, `theme`, `revision`. - `audits` (AuditGravado[]) — The account's 50 most recent audits. → see `AuditGravado` under **Structures**. - `trial` (Trial) — The account's trial: how many days, whether active and when it ends. → see `Trial` under **Structures**. **Errors** - `401` — invalid_session - `503` — auth_unavailable **Example** ```js await fetch("https://staging.pageaudit.online/api/me", {credentials: "same-origin"}).then(r => r.json()); ``` ### `GET /api/auth/bootstrap` Prepare the browser for global sign-in. Sets a host-only HttpOnly browser cookie. CSRF is bound to the current session. No CORS. - **URL:** `https://staging.pageaudit.online/api/auth/bootstrap` - **Auth:** `none` — Public, no credential. **Response `200`** - `csrf` (string) — X-CSRF-Token - `context` (string) — Opaque view context, also in X-MM-Context; not a credential / contexto opaco da vista, não é credencial. **Errors** - `400` — invalid_request - `403` — invalid_origin / invalid_csrf - `503` — auth_unavailable: a sessão anterior é preservada / the previous session is preserved ### `GET /api/account/profile` Read your global profile. Reads current preferences from the account. Edit them on your account page; products never own a separate profile. - **URL:** `https://staging.pageaudit.online/api/account/profile` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Response `200`** {profile:{name,locale,timeZone,theme,revision}} **Errors** - `401` — invalid_session - `503` — auth_unavailable **Example** ```js await fetch("https://staging.pageaudit.online/api/account/profile", {credentials: "same-origin"}).then(r => r.json()); ``` ### `GET /api/account/avatar` Read your global profile photo. Private WebP, up to 64 KiB, no cache. Change it on your account. No user ID or object URL accepted. - **URL:** `https://staging.pageaudit.online/api/account/avatar` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Response `200`** image/webp; Cache-Control: no-store **Errors** - `401` — invalid_session - `404` — not_found: no photo / sem foto - `503` — auth_unavailable **Example** ```js await fetch("https://staging.pageaudit.online/api/account/avatar", {credentials: "same-origin"}).then(r => {if (!r.ok) throw new Error("HTTP " + r.status); return r.blob();}); ``` ### `POST /api/auth/logout` Revoke this product session. Bootstrap/CSRF must belong to this browser and session. Other product sessions remain active. - **URL:** `https://staging.pageaudit.online/api/auth/logout` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Response `200`** - `ok` (bool) — true **Errors** - `400` — invalid_request - `403` — invalid_origin / invalid_csrf - `503` — auth_unavailable: a sessão anterior é preservada / the previous session is preserved **Example** ```js // Execute no console da página do produto / Run in the product page console. (async () => { const origin = "https://staging.pageaudit.online"; const {csrf} = await fetch(origin + "/api/auth/bootstrap").then(r => r.json()); const r = await fetch(origin + "/api/auth/logout", { method: "POST", credentials: "same-origin", headers: {"Content-Type": "application/json", "X-CSRF-Token": csrf}, body: JSON.stringify({}) }); if (!r.ok) throw new Error("Auth HTTP " + r.status); return r.json(); })(); ``` ### `GET /api/account/keys` List your API keys in this product. Never returns the key itself: name, last 4 characters, organization, creation, last use (hourly) and whether it still works. - **URL:** `https://staging.pageaudit.online/api/account/keys` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Response `200`** - `keys` (object[]) — `id`, `name`, `organizationId`, `last4`, `createdAt`, `lastUsedAt`, `revokedAt`, `active` (false when revoked or stopped by a password change / ending all sessions). **Errors** - `401` — invalid_session - `503` — auth_unavailable **Example** ```js await fetch("https://staging.pageaudit.online/api/account/keys", {credentials: "same-origin"}).then(r => r.json()); ``` ### `POST /api/account/keys/create` Create an API key for agents and scripts. Needs a sign-in in the last 5 minutes; an organization key also needs a second factor in the session and the owner/admin role with this product enabled. At most 10 live keys per account and product. The key (`secret`) is returned ONCE. - **URL:** `https://staging.pageaudit.online/api/account/keys/create` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Body** (`application/json`) - `name` (string, required) — Up to 60 characters. - `organizationId` (string, required) — `null` for an account key. **Body example** ```json { "name": "agent", "organizationId": null } ``` **Response `200`** - `key` (object) — `id`, `name`, `organizationId`, `last4`, `createdAt`. - `secret` (string) — `mmk_…`, shown once. **Errors** - `400` — invalid_key_name / invalid_organization - `401` — invalid_session / reauth_required - `403` — invalid_origin / invalid_csrf / organization_forbidden / organization_mfa_required - `409` — key_limit_reached - `503` — auth_unavailable **Example** ```js (async () => { const {csrf} = await fetch("https://staging.pageaudit.online/api/auth/bootstrap").then(r => r.json()); const r = await fetch("https://staging.pageaudit.online/api/account/keys/create", {method: "POST", credentials: "same-origin", headers: {"Content-Type": "application/json", "X-CSRF-Token": csrf}, body: JSON.stringify({name: "agent", organizationId: null})}); return r.json(); })(); ``` ### `POST /api/account/keys/revoke` Revoke one of your API keys. Stops the key at once. Repeating is harmless. - **URL:** `https://staging.pageaudit.online/api/account/keys/revoke` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Body** (`application/json`) - `id` (string, required) — The key `id`. **Body example** ```json { "id": "…" } ``` **Response `200`** - `ok` (bool) — true **Errors** - `400` — invalid_key_id - `401` — invalid_session - `403` — invalid_origin / invalid_csrf - `404` — key_not_found - `503` — auth_unavailable **Example** ```js (async () => { const {csrf} = await fetch("https://staging.pageaudit.online/api/auth/bootstrap").then(r => r.json()); const r = await fetch("https://staging.pageaudit.online/api/account/keys/revoke", {method: "POST", credentials: "same-origin", headers: {"Content-Type": "application/json", "X-CSRF-Token": csrf}, body: JSON.stringify({id: "…"})}); return r.json(); })(); ``` ### `POST /api/auth/claim` Moves what the guest created to the signed-in account: tabs and audits. Bootstrap/CSRF of this browser required; the page does it right after sign-in. Only what the guest still owns moves, in one transaction, and anything that collides with what the account already has stays with the guest. What the guest bought moves too. An old unsigned token that owns nothing here is refused. Repeating it is harmless (moves zero). - **URL:** `https://staging.pageaudit.online/api/auth/claim` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Body** (`application/json`) - `guest_token` (string, required) — Guest `pa_…` of this browser. **Body example** ```json { "guest_token": "pa_…" } ``` **Response `200`** - `ok` (bool) — Whether the guest was recognized and moved. - `claimed` (object) — `product.movidos` (rows moved, per table), `product.apagados` (guest duplicates dropped) and `product.direitos` (purchases moved). **Errors** - `400` — invalid_product_claim / invalid_body - `401` — invalid_session - `403` — invalid_origin / invalid_csrf - `409` — unknown_guest (em `claimed.reason` / in `claimed.reason`) - `503` — product_claim_pending / auth_unavailable **Example** ```js (async () => { const {csrf} = await fetch("https://staging.pageaudit.online/api/auth/bootstrap").then(r => r.json()); const r = await fetch("https://staging.pageaudit.online/api/auth/claim", {method: "POST", credentials: "same-origin", headers: {"Content-Type": "application/json", "X-CSRF-Token": csrf}, body: JSON.stringify({guest_token: localStorage.getItem("pageaudit_guest")})}); return r.json(); })(); ``` ## Operations ### `POST /api/erro-cliente` Browser error report, sent by the interface itself. Agents need not call it. The interface reports on its own JS errors, unhandled rejections, scripts/CSS that failed to load and CSP blocks — once per session — and the app reports handled failures through `window.mmErro.relata`. The server validates the envelope, redacts credentials, e-mails and phone numbers, merges repeats of the same failure per minute and records an operational event; nothing is written to a database. It keeps no IP, cookie, query string or full User-Agent. Always answers 204, even for an invalid report. - **URL:** `https://staging.pageaudit.online/api/erro-cliente` - **Auth:** `none` — Public, no credential. **Body** (`application/json`) - `code` (string, required) — Failure code, `UI-` + letters/digits (`UI-JS-001` global error, `UI-PROMESSA-001`, `UI-RECURSO-001`, `UI-CSP-001`, `UI-APP-001` app report). - `phase` (string, required) — Where it broke, lowercase: `global`, `promessa`, `script`, `load_list`… - `path` (string) — Path of the open page, without query. - `message` (string) — Error message, up to 2000 characters. - `stack` (string) — Stack trace, up to 12000 characters. - `source` (string) — Originating script; only its path is kept. - `line` (int) — Line in the originating script. - `column` (int) — Column in the originating script. - `visivel` (bool) — Whether the tab was visible when it broke. **Body example** ```json { "code": "UI-APP-001", "phase": "carregar_lista", "path": "/", "message": "lista 500" } ``` **Response `200`** 204 with no body, always — an invalid, repeated or over-cap report also gets 204. **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/erro-cliente -H 'content-type: application/json' -d '{"code":"UI-APP-001","phase":"carregar_lista","path":"/","message":"lista 500"}' ``` ### `POST /api/pagamento/aberto` The interface reports a visible payment prompt. Agents must not call this route. An empty same-origin report, sent automatically when a payment prompt becomes visible. It starts no payment, grants no access and receives no identity or credentials. It writes no database row per report. Counts events, not unique people. The private operator dashboard separates API payment requests and browser payment views per UTC day; the two counts may overlap. - **URL:** `https://staging.pageaudit.online/api/pagamento/aberto` - **Auth:** `none` — Public, no credential. **Headers** - `Origin` (string, required) — The page origin, identical to this route's origin. - `Sec-Fetch-Site` (string, required) — `same-origin`, set by the browser. - `X-MM-Payment-View` (string, required) — `1`, set by the shared component. **Response `202`** 202 with no body when accepted; 204 when ignored. Always no-store. ## Public stats ### `GET /api/vitrine` The product's public numbers: traffic, agents, usage and reliability, no money. Projection published hourly by the house collector, rounded to two significant digits; `null` is a missing measurement, never zero. 15-minute cache with ETag (`If-None-Match` → 304). There is no way to send numbers through this route: publishing belongs to the collector, with its own token. - **URL:** `https://staging.pageaudit.online/api/vitrine` - **Auth:** `none` — Public, no credential. **Response `200`** - `v` (int) — Contract version (1). - `produto` (string) — Product id. - `publicado` (bool) — `false` before the collector's first publication; then only these five keys come. - `atualizado_em` (string, may be null) — When the collector published (ISO 8601). - `stale` (bool) — `true` when the projection is older than 26 h. - `nome` (string, optional) — Product name. - `desde` (string, optional, may be null) — First day the series covers. - `fuso` (string, optional) — Time zone of the days (`UTC`). - `hoje` (object, optional) — Today: pages by class (human, AI, bot), API calls by class, machine-surface reads and product usage. - `dias` (object[], optional) — Up to 31 days, oldest first: `dia`, `paginas`, `api`, `api_ia`, `maquina`, `visitantes`, `uso`. - `janelas` (object, optional) — 7- and 30-day sums (`d7`, `d30`). - `visitantes` (object, optional) — Unique visitors at the edge over 7 days. - `pessoas` (object, optional, may be null) — GA4 when available: users, sessions, countries, devices and who arrived from AI. - `agentes` (object, optional) — The AI agents and bots that read the most, 7 days. - `superficies` (object, optional) — Reads of OKF, llms, well-known, OpenAPI and MCP over 7 days. - `mcp` (object, optional) — MCP calls over 7 days. - `uso` (object, optional) — Real product usage per resource: label, today, 7 and 30 days. - `contas` (object, optional, may be null) — Users and guests. - `confiabilidade` (object, optional) — Share of requests without 5xx over 7 days, and the live build. - `catalogo` (object, optional, may be null) — Size of the catalog, when the product has one. - `apoio` (object, optional) — Impressions and clicks per sponsor, when any. **Example** ```sh curl -s https://staging.pageaudit.online/api/vitrine ``` ### `GET /api/vitrine/operador` The product's full document on the operator panel — operator token only. - **URL:** `https://staging.pageaudit.online/api/vitrine/operador` - **Auth:** `none` — Public, no credential. **Headers** - `Authorization` (string, required) — `Bearer <METRICS_TOKEN>` — the operator class. **Response `200`** - `produto` (string) — Product id. - `atualizado_em` (string, may be null) — When the collector published. - `operador` (object, may be null) — The collector's full document, with what the public projection leaves out. **Errors** - `401` — No token, wrong token or a token of another class. - `503` — Worker without `METRICS_TOKEN` or without the control plane. **Example** ```sh curl -s https://staging.pageaudit.online/api/vitrine/operador -H "Authorization: Bearer $METRICS_TOKEN" ``` ### `GET /api/vitrine/painel` The whole house panel, in the shape the gm reads — operator token only. - **URL:** `https://staging.pageaudit.online/api/vitrine/painel` - **Auth:** `none` — Public, no credential. **Headers** - `Authorization` (string, required) — `Bearer <METRICS_TOKEN>` — the operator class. **Response `200`** - `apps` (object[]) — One operator document per product, ordered by id. - `updated` (string, optional) — When the collector closed the round. - `totals` (object, optional) — House totals. **Errors** - `401` — No token, wrong token or a token of another class. - `503` — Worker without `METRICS_TOKEN` or without the control plane. **Example** ```sh curl -s https://staging.pageaudit.online/api/vitrine/painel -H "Authorization: Bearer $METRICS_TOKEN" ``` ### `GET /api/vitrine/cursores` The resolved-error cursor per product (`borda`, `cli`) — operator token only. - **URL:** `https://staging.pageaudit.online/api/vitrine/cursores` - **Auth:** `none` — Public, no credential. **Headers** - `Authorization` (string, required) — `Bearer <METRICS_TOKEN>` — the operator class. **Response `200`** JSON: `{ [product]: { borda?: ISO, cli?: ISO } }`; empty is `{}`. **Errors** - `401` — No token, wrong token or a token of another class. - `503` — Worker without `METRICS_TOKEN` or without the control plane. **Example** ```sh curl -s https://staging.pageaudit.online/api/vitrine/cursores -H "Authorization: Bearer $METRICS_TOKEN" ``` ## Partnership ### `GET /api/partners` Partnership, sponsorship and advertising: the product's placements with a suggested price, the public numbers next to them and how to propose. Information on request, no activation: placements from the house catalogue priced in USD per 30 days (90 and 365 days discounted), sponsors in effect, an excerpt of `/api/vitrine`, the house wallet (USDC on Base) and the contact path — bank deposit, PIX or invoice are arranged in the reply. Cached for 1 hour. - **URL:** `https://staging.pageaudit.online/api/partners` - **Auth:** `none` — Public, no credential. **Response `200`** - `status` (string) — `sob_consulta`: information and proposal, no activation and no charge. - `produto` (string) — Product name. - `idioma` (string) — Language of the texts (the product's). - `titulo` (string) — Title of the offer. - `descricao` (string) — One sentence about the offer. - `publico` (string) — Who uses the product — the audience a sponsor reaches. - `modalidades` (object[]) — `{ id, nome }`: patrocinio, parceria, anuncio. - `placements` (object[]) — The product's placements: `id`, `nome`, `onde`, `formato`, `exclusivo`, `medicao`, `price_usd_30d` (suggested; `null` is on request), `exposure[{ dias, price_usd }]` for 30, 90 and 365 days, `disponivel`. - `house_bundle` (object) — The house bundle: footer and agent mention across the ten products, discounted. - `parcerias` (string[]) — Partnership ideas the product is open to discuss. - `current_sponsors` (object[]) — Sponsors in effect: `id`, `nome`, `url`, `frase`, `espacos`, `ate`. - `stats` (object) — Excerpt of the public numbers (`hoje`, `janelas`, `agentes`, `confiabilidade`) and the `link` to `/api/vitrine`; `publicado: false` before the first publication. - `payment` (object) — How to pay: `rede`, `chain_id`, `ativo`, `pay_to`, `eip681` (the house wallet, when declared), `alternativas` and the `nota` — bank deposit, PIX or invoice in the reply. - `contact` (object) — `email`, `form_url`, `api_url` (`POST /api/contact` where the handler exists), `campos` (required), `campos_proposta` (the optional proposal fields, each with its accepted values), `price_agent_usd`, `message_template`, `instructions`. - `politica` (object) — Placement label, refused sectors, prepayment, deadlines. - `_links` (object) — `self`, `stats`, `page` (`null` until the page exists), `contact`, `casa` (the same path on the ten products). **Example** ```sh curl -s https://staging.pageaudit.online/api/partners ``` ## Credit ### `POST /api/credito` Top up prepaid credit: pay once with x402 and get the token that debits on any API of the house. - **URL:** `https://staging.pageaudit.online/api/credito` - **Auth:** `none` — Public, no credential. **Query** - `usd` (int, required) — Package: 1, 5, 10 ou 25 dollars. **Response `200`** - `token` (string) — Bearer token for the balance (`cred_…`). Shown ONCE — it cannot be recovered. - `saldo_usd` (string) — Credited balance. - `guarde` (string) — Warning that the token is the bearer of the credit. - `usar` (string) — How to present the token on paid routes. - `saldo_em` (string) — Where to check balance and statement. **Errors** - `400` — Package outside the list (1, 5, 10 ou 25). - `402` — Unpaid — the body carries the x402 `accepts[]`. **Example** ```sh curl -s -XPOST 'https://staging.pageaudit.online/api/credito?usd=10' ``` ### `GET /api/credito` Credit balance and statement — the latest movements, without returning the token. - **URL:** `https://staging.pageaudit.online/api/credito` - **Auth:** `credito` — Prepaid credit token in `Authorization: Bearer cred_…` (or the `X-Credito` header). Not an account: it is a bearer of balance. **Response `200`** - `saldo_micros` (int) — Balance in micro-dollars (1e-6 USD). - `saldo_usd` (string) — Formatted balance. - `criado_em` (string) — When the credit was opened. - `movimentos` (object[]) — Recent credits and debits, with product and resource. **Errors** - `401` — No token, or unknown token. **Example** ```sh curl -s https://staging.pageaudit.online/api/credito -H 'Authorization: Bearer cred_…' ``` ## Structures ### `Audit` The report of one audit: score, findings and everything observed on the page. - `id` (string, may be null) — ID of the stored audit; `null` when the database was unavailable. - `score` (int) — 0–100 for measured checks: error -18, warn -8, info 0. Not a security/accessibility certification. Older saved scores keep their original weights. - `issues` (Achado[]) — Everything found, from most to least severe. → see `Achado` under **Structures**. - `summary` (ResumoPagina) — What the page declares: title, meta, canonical, OG, headings, links… → see `ResumoPagina` under **Structures**. - `counts` (ContagemAchados) — How many findings of each severity. → see `ContagemAchados` under **Structures**. - `headers` (object) — Every header of the target's response. `Set-Cookie` is removed on purpose: it is a third party's credential. - `htmlTruncated` (bool) — `true` when the page passed 2 MB and was read only that far. - `jsonLd` (object[]) — The raw JSON-LD blocks, as they were on the page. - `jsonLdStored` (int) — How many blocks survived the size cap — compare with `summary.jsonLdBlocks`. - `truncated` (string[]) — What was cut and why: `jsonld_size`, `jsonld_nodes_over_50`, `result_size`. Empty means nothing cut. - `fixes` (Correcao[]) — The ready fix of each finding, without a model — paste, fill in or decide. The consolidated one is at `_links.patch`. → see `Correcao` under **Structures**. - `quota` (CotaAudit) — How much is still free and what it costs past that. → see `CotaAudit` under **Structures**. - `_links` (LinksAudit) — This audit, the patch, the share and the API index. → see `LinksAudit` under **Structures**. ### `AuditGravado` The same report re-read from the database. It has no `quota` and no `_links` (it is a read, not a run) and gains the date and the share slug. - `audit_id` (string) — ID of the audit. - `url` (string) — Final audited URL, after following the redirects. - `score` (int) — Score from 0 to 100. - `summary` (ResumoPagina, may be null) — What the page declared at the time of the run. → see `ResumoPagina` under **Structures**. - `counts` (ContagemAchados) — How many findings of each severity. → see `ContagemAchados` under **Structures**. - `issues` (Achado[]) — Everything found in that run. → see `Achado` under **Structures**. - `fixes` (Correcao[]) — The ready fix of each finding; an audit stored before this existed gets the computation on read. → see `Correcao` under **Structures**. - `jsonLd` (object[]) — The raw JSON-LD blocks stored. - `headers` (object) — Headers of the target's response, as they were in the run. - `truncated` (string[]) — What was cut by size when storing. - `share_slug` (string, may be null) — Public slug, if this audit was shared. - `created_at` (string) — When the run happened (UTC). ### `Patch` The consolidated patch of an audit, ready for the agent that builds the site to apply. - `url` (string, may be null) — Final audited URL. - `audit` (string, may be null) — Absolute link of the source audit. - `head` (string) — The deterministic tags, one per line, in <head> order (charset first). Empty when there are none. - `arquivos` (ArquivoPatch[]) — Files to create at the host root. → see `ArquivoPatch` under **Structures**. - `moldes` (MoldePatch[]) — What only the owner can fill in. → see `MoldePatch` under **Structures**. - `sem_patch` (SemPatch[]) — What is a decision or infrastructure. → see `SemPatch` under **Structures**. - `resumo` (ResumoPatch) — Count per class. → see `ResumoPatch` under **Structures**. - `como_aplicar` (string) — One-sentence instruction. - `_links` (object) — `api_index`. ### `Ferramenta` A micro-tool: the landing of one isolated check, with the same engine as the full audit. - `slug` (string) — Identifier in the URL, e.g. `title-tag-checker`. - `title` (string) — Page title, used in `<title>`. - `h1` (string) — The landing's H1. - `description` (string) — Meta description of the landing. - `lead` (string) — Opening paragraph. - `category` (string) — Grouping of the tool in the hub. - `icon` (string) — Name of the icon used in the card. - `checks` (string[]) — Finding codes this tool highlights — they are the `Achado.code`s. - `serp` (object) — How the result looks in the search preview. - `sections` (object[]) — Content blocks of the landing. - `_links` (object) — This tool in JSON and in HTML. ### `Compartilhamento` The result of publishing an audit under a non-enumerable slug. - `ok` (bool) — Always `true`. - `shared` (bool) — Whether the audit is published at the end of the call. - `slug` (string) — Public, non-enumerable slug. - `path` (string) — Path of the report's HTML page. - `badge` (string) — Path of the score badge SVG. - `_links` (object) — Report, JSON and badge, as absolute URLs. ### `Badge` The score badge metadata, to build the README markdown. - `slug` (string) — Slug of the shared report. - `score` (int, may be null) — Score shown in the badge. - `label` (string) — Text on the left of the badge. - `available` (bool) — `false` when the share was revoked — the SVG turns grey `n/a`. - `markdown` (string) — The markdown line ready to paste in the README. - `_links` (object) — The SVG and the report. ### `Workspace` The owner's whole workspace, with the active tab's result already rehydrated — one call to draw the screen. - `tabs` (Aba[]) — Every tab of the owner. → see `Aba` under **Structures**. - `active_id` (string, may be null) — Which tab is in focus. - `active_result` (AuditGravado, may be null) — The last result of the active tab, so a second call is not needed. → see `AuditGravado` under **Structures**. - `limit` (int) — How many tabs fit before paying. - `owner` (string) — Identifier of this workspace's owner. - `gate` (Gate) — How much of the IP's free allowance remains. → see `Gate` under **Structures**. - `billing` (object) — Prices and usage, the same `GET /api/billing` returns. ### `Aba` A workspace tab: one followed URL, with the last result kept. - `id` (string) — ID of the tab. - `url` (string) — URL the tab follows. - `alias` (string, may be null) — Label the person gave the tab. - `active` (bool) — Whether it is the focused tab in the workspace. - `audit_id` (string, may be null) — Audit of this tab's last run. - `score` (int, may be null) — Score of the last run. - `monitor` (bool) — Whether the daily watch is on for this tab. - `monitor_email` (string, may be null) — Where the watch writes; `null` means the account's e-mail. - `monitor_checked_at` (string, may be null) — When the watch last checked this page (UTC). - `created_at` (string) — When the tab was opened (UTC). ### `Ok` Write confirmation with no body of its own to return. - `ok` (bool) — Always `true` — failure comes as a 4xx/5xx status, not as `ok:false`. ### `Gate` How much of the daily allowance still exists for this IP, and whether Turnstile is already required. - `ip` (string) — IP seen by the edge, already masked. - `now` (int) — Time of the query, in epoch. - `configured` (bool) — Whether Turnstile is configured in this environment. - `free_allowance` (int) — Free audits per day. - `free_remaining` (int) — How many remain today for this IP. - `verified_until` (int, may be null) — Until when the verification already done is valid. - `needs_verification` (bool) — `true` when the next call will ask for Turnstile (human) or 402 (agent). - `sitekey` (string, may be null) — Turnstile sitekey, for the browser to build the challenge. ### `RunHistorico` One run of a tab in the series, with what changed since the run before it. `change` is null on the oldest run read — with no base there is no change to state. - `audit_id` (string) — The stored audit, readable at `GET /api/audits/:id`. - `score` (int, may be null) — Score of this run. - `counts` (object) — How many errors, warnings and infos this run had. - `created_at` (string) — When the run happened (UTC). - `change` (Mudanca, may be null) — What changed since the previous run. → see `Mudanca` under **Structures**. - `shared` (string, may be null) — Public report URL, when this run was shared. - `api` (string) — This run in the API. ### `Billing` Everything that decides whether the next call will cost: the x402 configuration, the prices, the usage and the trial. - `provider` (string) — Always `x402` — the only billing protocol accepted. - `mode` (string) — Seller mode: `live` charges for real, `dev` lets calls through unpaid. - `network` (string) — USDC network: `base` in production, `base-sepolia` in staging. - `chain_id` (int) — EVM chain ID of the network above, so the wallet signs on the right chain. - `pay_to` (string, may be null) — Address that receives the payment. - `homolog` (bool) — Staging seam on: the loop can be closed without spending USDC. - `dev` (bool) — Development mode: the 402 is simulated. - `dev_gate` (bool) — A homologation credential is configured; this grants no access. - `gratis` (string[], optional) — Temporarily free SKUs. - `facilitator` (string) — URL of the facilitator that verifies and settles the payment. - `asset` (string) — Accepted currency — always `USDC`. - `asset_address` (string) — USDC contract on the network above. - `faucet` (string, may be null) — Test-USDC faucet; only on base-sepolia. - `wallets` (object) — Links to wallets that speak x402 (metamask, coinbase, base_app). - `product` (string) — Name of the product charging. - `free_max_tabs` (int) — Free tabs per owner. - `prices` (Precos) — What each paid action costs, in USD. → see `Precos` under **Structures**. - `usage` (Uso) — How much of the free allowance has been used. → see `Uso` under **Structures**. - `trial` (Trial) — The account's trial, when there is a session. → see `Trial` under **Structures**. ### `Conta` The person behind the session. - `id` (string) — ID of the global account — the owner of the tabs and audits. - `email` (string) — The account's verified e-mail. ### `Trial` The paywall-free period of an account, counted from its first use of PageAudit — once per account. It is the alternative to paying. - `days` (int) — Trial length in days. - `active` (bool) — Whether it is in force now. - `days_left` (int, optional) — How many days remain. - `ends_at` (string, may be null) — When it ends (UTC). ### `Metricas` 7-day panel. `payments` only shows with the operator token and only on Base mainnet. - `app` (string) — Product name. - `today` (string) — Reference day (UTC, YYYY-MM-DD). - `today_visits` (int) — Visits counted today. - `today_contacts` (int, optional) — Contact messages received today. Only with `METRICS_TOKEN`: contact does not leave without a token. - `days` (object[]) — One record per day of the window, with the counts of each metric. - `usage` (object) — Usage per product resource — here, audits and tabs. - `accounts` (object) — Total guests and accounts. - `financeiro` (object, optional) — Aggregate of the day: `hoje_usd`, `hoje_count`, `rede`. Only with `METRICS_TOKEN`: money does not leave without a token; the full series is `payments`. - `payments` (object, optional) — Finance summary; only with METRICS_TOKEN. - `achados` (object, may be null) — Which findings appear across stored audits: `audits` (total) and `por_codigo[]` with `code`, `n`, `audits` and `fracao_audits`. Aggregate, no URL and no owner; 1 h cache. `null` if the database did not answer. ### `PaymentQuota` - `free` (PaymentFree[]) — Free allowances and their windows. → see `PaymentFree` under **Structures**. - `paid` (PaymentPrice[]) — List prices in USD. The operation's 402 is the payable quote. → see `PaymentPrice` under **Structures**. - `how_to_pay` (string) — Payment instructions and availability restrictions. - `live` (string, may be null) — Authoritative product quota endpoint. - `free_now` (string[], optional) — SKUs temporarily free despite their list price. - `trial` (PaymentTrial, optional) — Registration trial, when offered. → see `PaymentTrial` under **Structures**. ### `Achado` A problem (or a pass) found on the page. - `severity` (string) — Severity of the finding. - `code` (string) — Stable check code, e.g. `title_missing`. It is what you filter by. - `message` (string) — The finding in one sentence, ready to show a person. ### `ResumoPagina` Everything the page declares about itself. It is the most consulted object of the API. - `finalUrl` (string) — URL after following every redirect. - `status` (int) — Final HTTP status of the target. - `contentType` (string, may be null) — Content-Type of the final response. - `title` (string, may be null) — Content of `<title>`. - `metaDescription` (string, may be null) — Content of `<meta name=description>`. - `canonical` (string, may be null) — Canonical URL declared by the page. - `robots` (string, may be null) — Content of `<meta name=robots>`. - `viewport` (string, may be null) — Content of `<meta name=viewport>`. - `charset` (string, may be null) — Declared encoding. - `lang` (string, may be null) — Language declared in `<html lang>`. - `favicon` (string, may be null) — URL of the favicon found. - `faviconSource` (string, may be null) — How the favicon was found: declared or by the default path. - `h1s` (string[]) — Every `<h1>` on the page, in order. - `openGraph` (object) — The `og:*` tags found, key by key. - `twitter` (object) — The `twitter:*` tags found. - `jsonLdCount` (int) — How many JSON-LD nodes the page had. - `jsonLdBlocks` (int) — How many `<script type=application/ld+json>` blocks existed. - `jsonLdErrors` (int, optional) — Invalid JSON syntax or non-object root values; not full JSON-LD/schema.org validation. - `jsonLdDropped` (bool) — `true` when nodes were dropped for passing the cap. - `jsonLdTypes` (string[]) — The `@type`s found, e.g. `Organization`, `WebSite`. - `images` (object) — Image count and how many have no `alt`. - `links` (object) — Count of internal, external and text-less links. - `words` (int) — Words in the visible content. - `hreflang` (object[]) — The declared language alternates. - `legacy` (object) — Old markup still present (e.g. `<font>`, layout tables). - `redirects` (object[]) — The redirect chain followed to the final URL. - `robotsTxt` (object) — What the origin's `robots.txt` says about this URL. - `sitemap` (object) — Whether the URL appears in the sitemap the origin declares. - `discovery` (Discovery, optional, may be null) — Selected discovery and delivery checks; optional files missing do not lower the score. Up to 15 additional GETs, concurrency 2, 8s total deadline and 64 KiB per text body. → see `Discovery` under **Structures**. ### `ContagemAchados` How many findings of each severity — the summary that fits in a badge. - `errors` (int) — Serious findings. - `warnings` (int) — Findings that deserve attention. - `info` (int) — Observations without severity. ### `Correcao` The ready fix of one finding. `classe` says whether it is to paste, to fill in or to decide. - `code` (string) — The same `code` as the finding (`Achado.code`). - `severity` (string) — Severity of the source finding. - `classe` (string) — `deterministico` comes whole from the page; `molde` has a `{{…}}` placeholder; `sem_patch` is an instruction. - `alvo` (string) — Where to apply: `head`, `corpo`, `img`, `arquivo` or `pagina` (instruction). - `snippet` (string, may be null) — The ready tag (or with a placeholder). `null` for files and for `sem_patch`. - `arquivo` (object, may be null) — `path` and `conteudo` when the fix is a file at the host root. - `fonte` (string, may be null) — Where the value came from, or what the page already had (for the template or to check the cut). - `nota` (string, may be null) — How to apply, or what to decide. ### `CotaAudit` How much is still free and what it costs past that. - `free_per_day` (int) — Free audits per IP per day. - `price_usd` (number) — Price of an audit beyond the allowance, in USD. ### `LinksAudit` Addresses of the audit just created. Without a stored `id`, only `api_index` comes. - `self` (string, optional) — This audit, to re-read without re-auditing. - `patch` (string, may be null) — `GET /api/audits/:id/patch` — the consolidated patch of this audit. - `share` (string, optional) — Where to publish this audit under a public slug. - `api_index` (string) — Self-describing API index. ### `ArquivoPatch` A file to create at the host root. - `code` (string) — Finding that originated it (`robots_txt_missing`, `sitemap_missing`). - `path` (string) — Absolute path on the host, e.g. `/robots.txt`. - `conteudo` (string) — Full content of the file. ### `MoldePatch` A tag with a marked placeholder: content missing that only the owner knows. - `code` (string) — Source finding. - `alvo` (string) — `head`, `corpo` or `img`. - `snippet` (string) — The tag with `{{PLACEHOLDER}}`. - `fonte` (string, may be null) — Suggestion taken from the page itself (H1, og:description…), if any. - `nota` (string) — What to fill in and the limit. ### `SemPatch` Finding without an automatic fix: it is a decision or infrastructure. - `code` (string) — Source finding. - `nota` (string) — What to check or decide. ### `ResumoPatch` How many fixes of each class. - `deterministicos` (int) — Ready to paste (head + files). - `moldes` (int) — With a placeholder. - `sem_patch` (int) — Instruction only. - `total` (int) — Findings considered. ### `Mudanca` The difference between two runs of the same page. Findings are compared by code, never by message: the message carries the measured value and would change without anything getting worse. - `score` (int, may be null) — Point delta, signed (positive means it improved). - `from` (int, may be null) — Score of the previous run. - `to` (int, may be null) — Score of this run. - `broke` (object[]) — Findings that appeared, each with `code`, `severity` and `message`. - `fixed` (object[]) — Findings that disappeared, in the same shape. ### `Precos` Prices in force, in dollars. Read them here, not from the documentation. - `extra_tab_usd` (number) — Cost of a tab beyond the allowance. - `contact_agent_usd` (number) — Cost of an agent contact. ### `Uso` How much of the free allowance the owner has used. - `tabs` (int) — Tabs open now. - `free_slots_left` (int) — Free tabs still available. ### `PaymentFree` - `o_que` (string) — Operation or allowance. - `limite` (string) — Allowance and eligibility. - `janela` (string, may be null) — Reset window, when applicable. ### `PaymentPrice` - `o_que` (string) — Operation and billing unit. - `price_usd` (number) — Current list price in USD. ### `PaymentTrial` - `days` (int) — Trial duration in days. - `how` (string) — Eligibility and activation steps. ### `Discovery` Five fixed probes plus well-known extras only when the page declares them or matches their function. Absent in older reports; rerun to measure. No recursive crawling. - `llms` (DiscoveryCheck) — Root llms.txt or the most specific same-origin describedby guide found on the page. → see `DiscoveryCheck` under **Structures**. - `security` (DiscoveryCheck) — /.well-known/security.txt: selected RFC 9116 checks. → see `DiscoveryCheck` under **Structures**. - `apiCatalog` (DiscoveryCheck) — /.well-known/api-catalog: selected RFC 9727 Linkset checks. → see `DiscoveryCheck` under **Structures**. - `changePassword` (DiscoveryCheck, optional) — /.well-known/change-password when the page uses a password field. Redirect only; the form is never submitted. → see `DiscoveryCheck` under **Structures**. - `assetlinks` (DiscoveryCheck, optional) — /.well-known/assetlinks.json when Android app association is indicated. App binary is not compared. → see `DiscoveryCheck` under **Structures**. - `appleApp` (DiscoveryCheck, optional) — /.well-known/apple-app-site-association when Apple associated domains are indicated. No redirects. Entitlements are not checked. → see `DiscoveryCheck` under **Structures**. - `oauthResource` (DiscoveryCheck, optional) — OAuth protected resource metadata when WWW-Authenticate, MCP or the well-known URL is declared. Authorization servers are not fetched. → see `DiscoveryCheck` under **Structures**. - `oauthServer` (DiscoveryCheck, optional) — /.well-known/oauth-authorization-server when this host declares itself as the issuer. → see `DiscoveryCheck` under **Structures**. - `openidConfig` (DiscoveryCheck, optional) — /.well-known/openid-configuration when this host declares OpenID Provider discovery. → see `DiscoveryCheck` under **Structures**. - `agentCard` (DiscoveryCheck, optional) — A2A Agent Card when declared. MCP identity JSON at this URL is not an A2A pass. → see `DiscoveryCheck` under **Structures**. - `webauthn` (DiscoveryCheck, optional) — /.well-known/webauthn when related origins are declared. Same-host passkeys do not need it. → see `DiscoveryCheck` under **Structures**. - `favicon` (DiscoveryCheck) — HTTP status/media type of the selected favicon; no image decoding. → see `DiscoveryCheck` under **Structures**. - `notFound` (DiscoveryCheck) — One randomly generated missing path, checking for 404/410 or a possible soft 404. → see `DiscoveryCheck` under **Structures**. ### `DiscoveryCheck` A measured observation with scope and reference. pass is limited to the checks stated in message. - `status` (string) — pass: measured checks passed; warn: issue; info: optional resource absent; unverified: blocked, incomplete, timeout or unavailable. - `url` (string, may be null) — Final public resource URL; null when it cannot safely be probed. - `httpStatus` (int) — Final observed HTTP status, or 0 if unavailable. - `contentType` (string) — Observed Content-Type, or empty when unavailable. - `message` (string) — Measured evidence and limitations; plain text, never instructions to execute. - `reference` (string) — Fixed authoritative reference for the check. ## Public data archives Browse addresses and procurement by location, then open the records you need. Up to 20 items per page, in formats ready for people and agents. Check coverage and the reference date before using a result. Access options are shown by each product. - [Postal codes and addresses](https://api.pontofato.com/enderecos/index.json): Find addresses by location, with coordinates and a 2022 reference date. Not a current postal-code certification. State → municipality → locality → street → addresses. [HTML](https://api.pontofato.com/enderecos/) · [llms.txt](https://api.pontofato.com/enderecos/llms.txt) · [OKF](https://api.pontofato.com/enderecos/okf/index.md) - [Public procurement](https://api.editalmd.com/licitacoes/index.json): Find public procurement by location and date. View documents and reading options in EditalMD. Procedure → state → year → month → day → municipality → purchases. [HTML](https://api.editalmd.com/licitacoes/) · [llms.txt](https://api.editalmd.com/licitacoes/llms.txt) · [OKF](https://api.editalmd.com/licitacoes/okf/index.md) ## Quota - Free: audit (`POST /api/audit`) — 10 per IP per day. - Free: audit — rate ceiling — 300 per IP per hour. - Free: workspace tabs — 20 per owner. - Paid: audit beyond the daily allowance — **$0.02** USDC via x402. - Paid: tab beyond the allowance — **$0.05** USDC via x402. - Paid: agent contact — **$0.10** USDC via x402. - **Not charging right now**: audit, extra_tab. Call it directly — no 402. The price above is the list price and comes back without notice. - Trial: sign up and CONFIRM the e-mail → **90 days** of full access, free. Loop: Sign in with an account at /conta/global (browser: e-mail code or link, password or passkey) → 90 days without paywall, counted from the account's first use of PageAudit Past the allowance → **402** with `accepts[]` (x402, USDC on Base). Pay and repeat the same call with `X-PAYMENT`. A human in a browser solves Turnstile and does not pay. Free alternative: a person signs in with an account (trial below). Numbers in force: https://staging.pageaudit.online/api/billing

# PageAudit — full API reference > Generated from the catalog at https://staging.pageaudit.online · build `c3b7d1c3` > 55 endpoints · 34 structures > Short index: https://staging.pageaudit.online/llms.txt · Spec: https://staging.pageaudit.online/openapi.json · MCP: https://staging.pageaudit.online/mcp > Technical SEO auditor in one call: title, meta, canonical, OG, headings, JSON-LD, > robots, alt, links, hreflang, redirects and selected discovery/delivery checks. > llms.txt, security.txt, API catalog, function-matched well-known files, favicon and missing-page evidence. No key to start. ## How to read - Every endpoint lists path, auth, parameters, body, response structure, errors and a call that runs. - `Pagina` is a reference: the fields are under **Structures**, at the end, once. - `(optional)` on a field means it may be absent; `(may be null)` means it comes with a null value. - Slice what you need: `https://staging.pageaudit.online/llms-full.txt?prefix=/api/` returns only that branch. ## Authentication - `credito` — Prepaid credit token in `Authorization: Bearer cred_…` (or the `X-Credito` header). Not an account: it is a bearer of balance. - `none` — Public, no credential. - `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. - `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. - `token` — Operator token in `Authorization: Bearer …` (`METRICS_TOKEN`). ## Endpoints ## Discovery ### `GET /agent.json` Agent card: identity, operator, documentation, the MCP endpoint and the tools it serves. Same document as `/.well-known/agent-card.json`. - **URL:** `https://staging.pageaudit.online/agent.json` - **Auth:** `none` — Public, no credential. **Response `200`** `application/json`: `name`, `provider`, `protocol` (`mcp`), `interfaces[]` and `skills[]`. **Example** ```sh curl -s https://staging.pageaudit.online/agent.json ``` ### `GET /okf/:arquivo` OKF bundle (Open Knowledge Format v0.1): markdown with frontmatter so an agent reads the whole product without parsing HTML. - **URL:** `https://staging.pageaudit.online/okf/:arquivo` - **Auth:** `none` — Public, no credential. **Path parameters** - `arquivo` (string, required) — `index.md`, `sobre.md`, `api.md` or `faq.md`. e.g.: `index.md`. **Response `200`** `text/markdown`. Start at `/okf/index.md`, which lists the bundle. **Errors** - `404` — File outside the bundle. **Example** ```sh curl -s https://staging.pageaudit.online/okf/index.md ``` ### `GET /.well-known/:arquivo` Machine discovery before the home page: `api-catalog` (RFC 9727, a linkset with the API and the MCP), `security.txt` (RFC 9116), `x402` (payment manifest: network, wallet and the routes that charge) and `mcp-registry-auth` (the official MCP registry key). - **URL:** `https://staging.pageaudit.online/.well-known/:arquivo` - **Auth:** `none` — Public, no credential. **Path parameters** - `arquivo` (string, required) — `api-catalog`, `security.txt`, `x402`, `mcp-registry-auth` or `apis.json`. e.g.: `api-catalog`. **Response `200`** `application/linkset+json` for the api-catalog; `application/json` for x402 and apis.json; `text/plain` for the other two. **Errors** - `404` — Name outside the five published. **Example** ```sh curl -s https://staging.pageaudit.online/.well-known/api-catalog ``` ### `GET /apis.json` APIs.json (apisjson.org, 0.19): the index APIs.io harvests — the API, the MCP, OpenAPI, guide and OKF bundle in one file. Also at `/.well-known/apis.json`. - **URL:** `https://staging.pageaudit.online/apis.json` - **Auth:** `none` — Public, no credential. **Response `200`** `application/json` in the APIs.json 0.19 format: `apis[]` with `baseURL`, `humanURL` and `properties[]`. **Example** ```sh curl -s https://staging.pageaudit.online/apis.json ``` ### `GET /api/` Self-describing index: the whole API surface, with quota and retention policy. - **URL:** `https://staging.pageaudit.online/api/` - **Auth:** `none` — Public, no credential. **Response `200`** - `name` (string) — Product name. - `description` (string) — What the product does, in one sentence. - `build` (string) — Deployed commit. - `base_url` (string) — Origin this API is serving from. - `docs` (object) — Links to llms.txt, llms-full.txt, openapi.json, MCP and the UI. - `conventions` (object) — Error format, CORS, x402 and the UI↔API parity rule. - `auth` (object) — Each authentication mode and how to obtain it. - `endpoints` (object[]) — Every endpoint with method, path, auth, absolute URL and what it returns. - `data_retention` (object) — What is stored from each run and what is discarded. - `quota` (object) — What is free, what costs and how to pay — before you spend a call. - `mcp` (object) — Address and transport of the MCP server. - `quickstart` (string[]) — The calls that take you from zero to the first report. ### `GET /api/health` Liveness and the commit deployed right now — it is how the smoke waits for its own deploy. - **URL:** `https://staging.pageaudit.online/api/health` - **Auth:** `none` — Public, no credential. **Response `200`** - `ok` (bool) — Always `true` when the Worker answers. - `app` (string) — Product name. - `build` (string) — Deployed commit; CI passes the short SHA on deploy. - `ts` (string) — Time of the response (UTC, ISO-8601). ### `POST /mcp` MCP server over HTTP (Streamable HTTP, JSON-RPC 2.0) — plugs into the client with nothing to install. The tools are the operations of this same catalog; the MCP has no backend of its own. `GET /mcp` returns the server card. - **URL:** `https://staging.pageaudit.online/mcp` - **Auth:** `none` — Public, no credential. - Credentials go in the usual headers (X-Guest-Token, Authorization, X-PAYMENT) and are forwarded to the API. - An exhausted quota comes back as a 402 with accepts[] inside the tool result — pay and repeat. **Response `200`** JSON-RPC 2.0 response (`initialize`, `tools/list` or `tools/call`). **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/mcp -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' ``` ### `GET /api/pricing` Current prices and free allowances. - **URL:** `https://staging.pageaudit.online/api/pricing` - **Auth:** `none` — Public, no credential. **Response `200`** - `product` (string) — Product name. - `quota` (PaymentQuota) — Public allowances and current list prices; not personal usage. → see `PaymentQuota` under **Structures**. - `pricing` (string) — Absolute URL of the current price list. - `billing` (string) — Absolute URL of payment discovery or the existing billing summary. - `api_index` (string) — Absolute URL of the API catalog. **Errors** - `405` — Use GET or HEAD. **Example** ```sh curl -s https://staging.pageaudit.online/api/pricing ``` ## Audit ### `POST /api/audit` Audits a URL and returns the full report in one call, without a token or a tab. This is the product for agents. Past the IP's daily allowance the response is **402 with `accepts[]`** — pay and repeat the same call. It also carries `sitekey` and `code`, which are the path for a human with a browser; an agent ignores those two. The free alternative: a person signs in with an account to get the trial. - **URL:** `https://staging.pageaudit.online/api/audit` - **Auth:** `none` — Public, no credential. **Body** (`application/json`) - `url` (string, required) — The page to audit, `http` or `https`. - `guest_token` (string) — Guest `pa_…` so the audit is tied to it and shows up in the tabs. - `cf_turnstile_response` (string) — Turnstile response; it is the human path, agents use x402. **Body example** ```json { "url": "https://example.com/", "guest_token": "pa_… (optional, ties the audit)" } ``` **Response `200`** Structure: `Audit`. - `id` (string, may be null) — ID of the stored audit; `null` when the database was unavailable. - `score` (int) — 0–100 for measured checks: error -18, warn -8, info 0. Not a security/accessibility certification. Older saved scores keep their original weights. - `issues` (Achado[]) — Everything found, from most to least severe. → see `Achado` under **Structures**. - `summary` (ResumoPagina) — What the page declares: title, meta, canonical, OG, headings, links… → see `ResumoPagina` under **Structures**. - `counts` (ContagemAchados) — How many findings of each severity. → see `ContagemAchados` under **Structures**. - `headers` (object) — Every header of the target's response. `Set-Cookie` is removed on purpose: it is a third party's credential. - `htmlTruncated` (bool) — `true` when the page passed 2 MB and was read only that far. - `jsonLd` (object[]) — The raw JSON-LD blocks, as they were on the page. - `jsonLdStored` (int) — How many blocks survived the size cap — compare with `summary.jsonLdBlocks`. - `truncated` (string[]) — What was cut and why: `jsonld_size`, `jsonld_nodes_over_50`, `result_size`. Empty means nothing cut. - `fixes` (Correcao[]) — The ready fix of each finding, without a model — paste, fill in or decide. The consolidated one is at `_links.patch`. → see `Correcao` under **Structures**. - `quota` (CotaAudit) — How much is still free and what it costs past that. → see `CotaAudit` under **Structures**. - `_links` (LinksAudit) — This audit, the patch, the share and the API index. → see `LinksAudit` under **Structures**. **Errors** - `400` — Body is not JSON, or `url` missing/not http. - `402` — Quota exceeded. The response carries `accepts[]` (x402, USDC on Base): pay and repeat the same call with `X-PAYMENT`. - `403` — Wrong Turnstile answer. A wrong captcha is not an invitation to pay. - `429` — Past `MAX_AUDITS_PER_HOUR` on the same IP. Wait an hour. **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/audit -H 'content-type: application/json' -d '{"url":"https://example.com/"}' ``` ### `GET /api/audits/:id` Re-reads an audit already made, in full, without re-auditing the page. Re-reading costs nothing and does not count against the allowance — the page's HTML is not kept, but the report is. - **URL:** `https://staging.pageaudit.online/api/audits/:id` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — Audit ID, from `Audit.id`. e.g.: `9f3c2b1d-7a4e-4c58-9b02-1f6d5e8a2c34`. **Response `200`** Structure: `AuditGravado`. - `audit_id` (string) — ID of the audit. - `url` (string) — Final audited URL, after following the redirects. - `score` (int) — Score from 0 to 100. - `summary` (ResumoPagina, may be null) — What the page declared at the time of the run. → see `ResumoPagina` under **Structures**. - `counts` (ContagemAchados) — How many findings of each severity. → see `ContagemAchados` under **Structures**. - `issues` (Achado[]) — Everything found in that run. → see `Achado` under **Structures**. - `fixes` (Correcao[]) — The ready fix of each finding; an audit stored before this existed gets the computation on read. → see `Correcao` under **Structures**. - `jsonLd` (object[]) — The raw JSON-LD blocks stored. - `headers` (object) — Headers of the target's response, as they were in the run. - `truncated` (string[]) — What was cut by size when storing. - `share_slug` (string, may be null) — Public slug, if this audit was shared. - `created_at` (string) — When the run happened (UTC). **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). **Example** ```sh curl -s https://staging.pageaudit.online/api/audits/AUDIT_ID -H "X-Guest-Token: $PA" ``` ### `GET /api/audits/:id/patch` The consolidated patch of an audit: the block ready to paste, the files to create at the root and the templates for what only the owner can fill in — no model, only facts from the page itself. Each finding becomes a fix in one of three classes: `deterministico` (comes whole from what the page declares: final URL, title, description, OG), `molde` (a tag with a marked placeholder, like `{{TITULO}}`, and the suggested source) or `sem_patch` (a decision or infrastructure, with the instruction). Nothing is invented by a model. - **URL:** `https://staging.pageaudit.online/api/audits/:id/patch` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — Audit ID, from `Audit.id`. e.g.: `9f3c2b1d-7a4e-4c58-9b02-1f6d5e8a2c34`. **Response `200`** Structure: `Patch`. - `url` (string, may be null) — Final audited URL. - `audit` (string, may be null) — Absolute link of the source audit. - `head` (string) — The deterministic tags, one per line, in order (charset first). Empty when there are none. - `arquivos` (ArquivoPatch[]) — Files to create at the host root. → see `ArquivoPatch` under **Structures**. - `moldes` (MoldePatch[]) — What only the owner can fill in. → see `MoldePatch` under **Structures**. - `sem_patch` (SemPatch[]) — What is a decision or infrastructure. → see `SemPatch` under **Structures**. - `resumo` (ResumoPatch) — Count per class. → see `ResumoPatch` under **Structures**. - `como_aplicar` (string) — One-sentence instruction. - `_links` (object) — `api_index`. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). **Example** ```sh curl -s https://staging.pageaudit.online/api/audits/AUDIT_ID/patch -H "X-Guest-Token: $PA" ``` ## Micro-tools ### `GET /api/tools` The micro-tools: one landing per check, all driven by the same engine as the audit. - **URL:** `https://staging.pageaudit.online/api/tools` - **Auth:** `none` — Public, no credential. **Response `200`** - `tools` (Ferramenta[]) — Every published tool. → see `Ferramenta` under **Structures**. - `_links` (object) — The hub in HTML and the API index. ### `GET /api/tools/:slug` Metadata and copy of one micro-tool. - **URL:** `https://staging.pageaudit.online/api/tools/:slug` - **Auth:** `none` — Public, no credential. **Path parameters** - `slug` (string, required) — Tool slug, e.g. `title-tag-checker`. **Response `200`** Structure: `Ferramenta`. - `slug` (string) — Identifier in the URL, e.g. `title-tag-checker`. - `title` (string) — Page title, used in ``. - `h1` (string) — The landing's H1. - `description` (string) — Meta description of the landing. - `lead` (string) — Opening paragraph. - `category` (string) — Grouping of the tool in the hub. - `icon` (string) — Name of the icon used in the card. - `checks` (string[]) — Finding codes this tool highlights — they are the `Achado.code`s. - `serp` (object) — How the result looks in the search preview. - `sections` (object[]) — Content blocks of the landing. - `_links` (object) — This tool in JSON and in HTML. **Errors** - `404` — Unknown slug. **Example** ```sh curl -s https://staging.pageaudit.online/api/tools/title-tag-checker ``` ### `GET /tools` HTML hub of the micro-tools, indexable. For JSON use `GET /api/tools`. - **URL:** `https://staging.pageaudit.online/tools` - **Auth:** `none` — Public, no credential. **Response `200`** `text/html` — the hub page, rendered on the server. ### `GET /tools/:slug` HTML landing of one check, indexable. An unknown slug returns a real 404. The 404 is real, not a 200 with an empty shell: mass soft-404s burn the whole domain in the index. - **URL:** `https://staging.pageaudit.online/tools/:slug` - **Auth:** `none` — Public, no credential. **Path parameters** - `slug` (string, required) — Tool slug, e.g. `title-tag-checker`. **Response `200`** `text/html` — the tool's landing. **Errors** - `404` — Unknown slug — a real 404, not an empty shell. ## Share ### `POST /api/audits/:id/share` Publishes the audit under a non-enumerable slug. Calling again returns the same slug. - **URL:** `https://staging.pageaudit.online/api/audits/:id/share` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — ID of the audit to publish. e.g.: `9f3c2b1d-7a4e-4c58-9b02-1f6d5e8a2c34`. **Response `200`** Structure: `Compartilhamento`. - `ok` (bool) — Always `true`. - `shared` (bool) — Whether the audit is published at the end of the call. - `slug` (string) — Public, non-enumerable slug. - `path` (string) — Path of the report's HTML page. - `badge` (string) — Path of the score badge SVG. - `_links` (object) — Report, JSON and badge, as absolute URLs. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/audits/AUDIT_ID/share -H "X-Guest-Token: $PA" ``` ### `DELETE /api/audits/:id/share` Revokes the share; the slug stops serving the report. The badge keeps answering 200 with the grey `n/a` SVG — same box, so the layout of whoever pasted it in a README does not break. - **URL:** `https://staging.pageaudit.online/api/audits/:id/share` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — ID of the audit to unpublish. e.g.: `9f3c2b1d-7a4e-4c58-9b02-1f6d5e8a2c34`. **Response `200`** - `ok` (bool) — Always `true`. - `shared` (bool) — Always `false` at the end of this call. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). **Example** ```sh curl -s -XDELETE https://staging.pageaudit.online/api/audits/AUDIT_ID/share -H "X-Guest-Token: $PA" ``` ### `GET /api/shared/:slug` Shared report as JSON, without credentials — the machine twin of `/r/:slug`. - **URL:** `https://staging.pageaudit.online/api/shared/:slug` - **Auth:** `none` — Public, no credential. **Path parameters** - `slug` (string, required) — Public slug of the share. e.g.: `k7m2p9r4t6v8w1y3z5b7c9d1`. **Response `200`** Structure: `AuditGravado`. - `audit_id` (string) — ID of the audit. - `url` (string) — Final audited URL, after following the redirects. - `score` (int) — Score from 0 to 100. - `summary` (ResumoPagina, may be null) — What the page declared at the time of the run. → see `ResumoPagina` under **Structures**. - `counts` (ContagemAchados) — How many findings of each severity. → see `ContagemAchados` under **Structures**. - `issues` (Achado[]) — Everything found in that run. → see `Achado` under **Structures**. - `fixes` (Correcao[]) — The ready fix of each finding; an audit stored before this existed gets the computation on read. → see `Correcao` under **Structures**. - `jsonLd` (object[]) — The raw JSON-LD blocks stored. - `headers` (object) — Headers of the target's response, as they were in the run. - `truncated` (string[]) — What was cut by size when storing. - `share_slug` (string, may be null) — Public slug, if this audit was shared. - `created_at` (string) — When the run happened (UTC). **Errors** - `404` — Unknown slug, or share revoked. **Example** ```sh curl -s https://staging.pageaudit.online/api/shared/SLUG ``` ### `GET /r/:slug` HTML page of the shared report, indexable, canonical at `/r/:slug`. A public report is content: indexable, with its own canonical. Revoked or unknown slugs answer 404 (that one is `noindex`). The JSON twin is `/api/shared/:slug`. - **URL:** `https://staging.pageaudit.online/r/:slug` - **Auth:** `none` — Public, no credential. **Path parameters** - `slug` (string, required) — Public slug of the share. e.g.: `k7m2p9r4t6v8w1y3z5b7c9d1`. **Response `200`** `text/html` — the rendered report, with `rel=canonical`. **Errors** - `404` — Unknown or revoked slug. ### `GET /api/badge/:slug` Metadata of the score badge, including the markdown ready for the README. - **URL:** `https://staging.pageaudit.online/api/badge/:slug` - **Auth:** `none` — Public, no credential. **Path parameters** - `slug` (string, required) — Public slug of the share. e.g.: `k7m2p9r4t6v8w1y3z5b7c9d1`. **Response `200`** Structure: `Badge`. - `slug` (string) — Slug of the shared report. - `score` (int, may be null) — Score shown in the badge. - `label` (string) — Text on the left of the badge. - `available` (bool) — `false` when the share was revoked — the SVG turns grey `n/a`. - `markdown` (string) — The markdown line ready to paste in the README. - `_links` (object) — The SVG and the report. **Errors** - `404` — Unknown slug. Revoked is different: it returns 200 with `available: false`. **Example** ```sh curl -s https://staging.pageaudit.online/api/badge/SLUG ``` ### `GET /badge/:slug.svg` SVG score badge, to paste in the README of the audited project. A revoked share returns **200** with the grey `n/a` SVG — the same box, so the README of whoever pasted it does not end up with a broken image. - **URL:** `https://staging.pageaudit.online/badge/:slug.svg` - **Auth:** `none` — Public, no credential. **Path parameters** - `slug` (string, required) — Public slug, with the `.svg` extension in the path. e.g.: `k7m2p9r4t6v8w1y3z5b7c9d1`. **Response `200`** `image/svg+xml` — the badge, coloured by the score or grey `n/a` if revoked. **Errors** - `404` — Malformed slug. ## Embed ### `GET /api/embed` The embeddable widget's contract: what you can configure and the snippet to paste. One script tag puts the audit form on your own site, with your name and colour, and no account or key. Send the same query you would send to `/embed` and the answer comes back with `snippet` already assembled. The widget never asks the visitor for an e-mail. - **URL:** `https://staging.pageaudit.online/api/embed` - **Auth:** `none` — Public, no credential. **Query** - `brand` (string) — Your site's name, shown above the form (up to 40 characters). - `color` (string) — Accent colour in hex (`#0a7` or `#00aa77`); anything else falls back to ours. - `theme` (string) — `auto` (follows the visitor), `light` or `dark`. - `url` (string) — Optional http(s) URL to pre-fill in the field. **Response `200`** - `config` (object) — Each option, its type and what it does. - `current` (object) — The configuration read from this call's query. - `snippet` (string) — The `<script>` (plus a `<noscript>` link) ready to paste. - `limits` (object) — The allowance the widget runs under, and the lead capture it does not do. **Example** ```sh curl -s "https://staging.pageaudit.online/api/embed?brand=Acme&color=%2300aa77" ``` ### `GET /embed.js` The loader you paste: it creates the widget's iframe and keeps it the right height. Configuration travels in `data-brand`, `data-color`, `data-theme` and `data-url` on the script tag itself. Nothing else of ours touches the host page: the widget lives inside the iframe, so neither the site's CSS reaches it nor our code reaches the site's DOM. - **URL:** `https://staging.pageaudit.online/embed.js` - **Auth:** `none` — Public, no credential. **Response `200`** `application/javascript` — the loader, cached for an hour. ### `GET /embed` The widget page itself, made to be framed (`frame-ancestors *`) and not indexed. Open it directly to preview a configuration before pasting the snippet. It calls `POST /api/audit` like any visitor would, so the free daily allowance per network applies. - **URL:** `https://staging.pageaudit.online/embed` - **Auth:** `none` — Public, no credential. **Response `200`** `text/html` — the widget, self-contained, with no third-party resource. ## Identity ### `POST /api/guest` Creates a guest `pa_…` — it is what gives access to the tab workspace without an account. Keep the token: it is the identity of the tabs and of the audits tied to them. - **URL:** `https://staging.pageaudit.online/api/guest` - **Auth:** `none` — Public, no credential. **Response `200`** - `token` (string) — The guest, prefix `pa_`. Send it in `X-Guest-Token`, as Bearer or in `?guest_token=`. **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/guest ``` ## Tabs ### `GET /api/tabs` The owner's whole workspace, with the active tab's result already rehydrated. One call draws the whole screen: tabs, the focused tab, its last report, remaining allowance and prices. - **URL:** `https://staging.pageaudit.online/api/tabs` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Response `200`** Structure: `Workspace`. - `tabs` (Aba[]) — Every tab of the owner. → see `Aba` under **Structures**. - `active_id` (string, may be null) — Which tab is in focus. - `active_result` (AuditGravado, may be null) — The last result of the active tab, so a second call is not needed. → see `AuditGravado` under **Structures**. - `limit` (int) — How many tabs fit before paying. - `owner` (string) — Identifier of this workspace's owner. - `gate` (Gate) — How much of the IP's free allowance remains. → see `Gate` under **Structures**. - `billing` (object) — Prices and usage, the same `GET /api/billing` returns. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. **Example** ```sh curl -s https://staging.pageaudit.online/api/tabs -H "X-Guest-Token: $PA" ``` ### `POST /api/tabs` Opens a tab for the URL, or focuses the one that already exists for it. Past the free tab allowance it answers 402 with `accepts[]`: pay and repeat. - **URL:** `https://staging.pageaudit.online/api/tabs` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Body** (`application/json`) - `url` (string, required) — The URL the tab will follow. - `alias` (string) — Label to recognise the tab in the list. **Body example** ```json { "url": "https://example.com/", "alias": "optional label" } ``` **Response `200`** - `ok` (bool) — Always `true`. - `tab` (Aba) — The opened tab (or the one that already existed for that URL). → see `Aba` under **Structures**. **Errors** - `400` — `url` missing or not http. - `401` — No credential, or an invalid one. See this endpoint's auth. - `402` — Quota exceeded. The response carries `accepts[]` (x402, USDC on Base): pay and repeat the same call with `X-PAYMENT`. **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/tabs -H "X-Guest-Token: $PA" -H 'content-type: application/json' -d '{"url":"https://example.com/"}' ``` ### `GET /api/tabs/:id` One tab with the full report of its last run. - **URL:** `https://staging.pageaudit.online/api/tabs/:id` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — Tab ID, from `Aba.id`. e.g.: `tab_9f3c2b1d7a4e58b0c2d4`. **Response `200`** - `tab` (Aba) — The requested tab. → see `Aba` under **Structures**. - `result` (AuditGravado, may be null) — The report of the last run; `null` if the tab never ran. → see `AuditGravado` under **Structures**. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). **Example** ```sh curl -s https://staging.pageaudit.online/api/tabs/TAB_ID -H "X-Guest-Token: $PA" ``` ### `PATCH /api/tabs/:id` Renames the tab, puts it in focus or turns the daily watch on and off. With `monitor: true` the page is re-audited once a day and an e-mail goes out when the score drops or a new error/warning appears — never on an improvement. Watching needs an account (the alert has to reach someone) and each account watches a limited number of pages. - **URL:** `https://staging.pageaudit.online/api/tabs/:id` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — ID of the tab to change. e.g.: `tab_9f3c2b1d7a4e58b0c2d4`. **Body** (`application/json`) - `alias` (string) — New label of the tab. - `active` (bool) — `true` focuses this tab (and unfocuses the other). - `monitor` (bool) — `true` watches the page daily; `false` stops watching it. - `monitor_email` (string) — Where the alert goes. Empty or `null` uses the account's e-mail. **Body example** ```json { "alias": "new label", "active": true, "monitor": true } ``` **Response `200`** - `ok` (bool) — Always `true`. - `tab` (Aba) — The tab with the change applied. → see `Aba` under **Structures**. **Errors** - `400` — No changeable field in the body, or `monitor_email` is not an e-mail. - `401` — No credential, or an invalid one. See this endpoint's auth. - `403` — Watching needs an account: a guest token has no e-mail to be warned at (`account_required`). - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). - `409` — The account already watches the maximum number of pages (`monitor_limit`). **Example** ```sh curl -s -XPATCH https://staging.pageaudit.online/api/tabs/TAB_ID -H "X-Guest-Token: $PA" -H 'content-type: application/json' -d '{"active":true}' ``` ### `DELETE /api/tabs/:id` Closes the tab. Its audit history keeps existing. - **URL:** `https://staging.pageaudit.online/api/tabs/:id` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — ID of the tab to close. e.g.: `tab_9f3c2b1d7a4e58b0c2d4`. **Response `200`** Structure: `Ok`. - `ok` (bool) — Always `true` — failure comes as a 4xx/5xx status, not as `ok:false`. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). **Example** ```sh curl -s -XDELETE https://staging.pageaudit.online/api/tabs/TAB_ID -H "X-Guest-Token: $PA" ``` ### `POST /api/tabs/:id/run` Re-audits the tab's URL and stores a new report. Consumes the same daily allowance as `POST /api/audit` — past it, 402 with `accepts[]`. - **URL:** `https://staging.pageaudit.online/api/tabs/:id/run` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — ID of the tab to re-audit. e.g.: `tab_9f3c2b1d7a4e58b0c2d4`. **Response `200`** - `ok` (bool) — Always `true`. - `tab` (Aba) — The tab with the new run's score. → see `Aba` under **Structures**. - `gate` (Gate) — How much of the allowance is left after this run. → see `Gate` under **Structures**. - `result` (AuditGravado) — The report just stored. → see `AuditGravado` under **Structures**. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. - `402` — Quota exceeded. The response carries `accepts[]` (x402, USDC on Base): pay and repeat the same call with `X-PAYMENT`. - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/tabs/TAB_ID/run -H "X-Guest-Token: $PA" ``` ### `GET /api/tabs/:id/history` Previous runs of that tab and what changed between each one and the one before it. Every run has always been kept; this is where you read the series. Each entry carries the score, the counts and a `change` with the point delta and the findings that appeared (`broke`) or disappeared (`fixed`) since the previous run — compared by finding code, never by message. Runs older than the watch feature are matched by URL. - **URL:** `https://staging.pageaudit.online/api/tabs/:id/history` - **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. Only a token this site issued is accepted. A signed-in account (cookie) also works and takes precedence; after the claim the token owns nothing. **Path parameters** - `id` (string, required) — ID of the tab whose runs you want. e.g.: `tab_9f3c2b1d7a4e58b0c2d4`. **Query** - `limit` (int) — How many runs to bring, newest first. Default 20, maximum 100. **Response `200`** - `tab` (Aba) — The tab the runs belong to. → see `Aba` under **Structures**. - `runs` (RunHistorico[]) — Runs from newest to oldest. → see `RunHistorico` under **Structures**. - `limit` (int) — The limit actually applied. **Errors** - `401` — No credential, or an invalid one. See this endpoint's auth. - `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose). **Example** ```sh curl -s "https://staging.pageaudit.online/api/tabs/TAB_ID/history?limit=10" -H "X-Guest-Token: $PA" ``` ### `GET /api/gate` How many free audits remain for this IP and whether Turnstile is about to be required. Check before spending a call: it is the number IN FORCE, not the allowance in the documentation. - **URL:** `https://staging.pageaudit.online/api/gate` - **Auth:** `none` — Public, no credential. **Response `200`** Structure: `Gate`. - `ip` (string) — IP seen by the edge, already masked. - `now` (int) — Time of the query, in epoch. - `configured` (bool) — Whether Turnstile is configured in this environment. - `free_allowance` (int) — Free audits per day. - `free_remaining` (int) — How many remain today for this IP. - `verified_until` (int, may be null) — Until when the verification already done is valid. - `needs_verification` (bool) — `true` when the next call will ask for Turnstile (human) or 402 (agent). - `sitekey` (string, may be null) — Turnstile sitekey, for the browser to build the challenge. ## Billing ### `GET /api/billing` Tab allowance, prices, full x402 configuration and the state of the trial. - **URL:** `https://staging.pageaudit.online/api/billing` - **Auth:** `none` — Public, no credential. **Response `200`** Structure: `Billing`. - `provider` (string) — Always `x402` — the only billing protocol accepted. - `mode` (string) — Seller mode: `live` charges for real, `dev` lets calls through unpaid. - `network` (string) — USDC network: `base` in production, `base-sepolia` in staging. - `chain_id` (int) — EVM chain ID of the network above, so the wallet signs on the right chain. - `pay_to` (string, may be null) — Address that receives the payment. - `homolog` (bool) — Staging seam on: the loop can be closed without spending USDC. - `dev` (bool) — Development mode: the 402 is simulated. - `dev_gate` (bool) — A homologation credential is configured; this grants no access. - `gratis` (string[], optional) — Temporarily free SKUs. - `facilitator` (string) — URL of the facilitator that verifies and settles the payment. - `asset` (string) — Accepted currency — always `USDC`. - `asset_address` (string) — USDC contract on the network above. - `faucet` (string, may be null) — Test-USDC faucet; only on base-sepolia. - `wallets` (object) — Links to wallets that speak x402 (metamask, coinbase, base_app). - `product` (string) — Name of the product charging. - `free_max_tabs` (int) — Free tabs per owner. - `prices` (Precos) — What each paid action costs, in USD. → see `Precos` under **Structures**. - `usage` (Uso) — How much of the free allowance has been used. → see `Uso` under **Structures**. - `trial` (Trial) — The account's trial, when there is a session. → see `Trial` under **Structures**. **Example** ```sh curl -s https://staging.pageaudit.online/api/billing -H "X-Guest-Token: $PA" ``` ### `POST /api/contact` Talks to support: a human solves Turnstile, an agent pays $0.10 in x402. Without a captcha in the body the request is treated as an agent: 402 until paid. The first agent message is free; after that the backoff is 60s doubling up to a 1-hour cap, announced in `Retry-After`. - **URL:** `https://staging.pageaudit.online/api/contact` - **Auth:** `none` — Public, no credential. **Body** (`application/json`) - `name` (string, required) — What to call the person writing. - `email` (string, required) — Where to reply. - `message` (string, required) — What you want to say. - `form_ts` (int) — When the form was opened; the anti-robot of the human path, and only it requires this. - `cf_turnstile_response` (string) — Turnstile response; present only on the human path. - `tipo` (string) — Proposal: `patrocinio`, `parceria` or `anuncio`. Turns on the fields below. - `empresa` (string) — Who is proposing, when it is a company. - `site` (string) — Website of who is proposing. - `orcamento` (string) — `ate_100`, `100_500`, `500_2000`, `2000_mais` or `a_combinar`. - `espaco` (string[]) — Placement ids from `GET /api/partners`, up to 6. - `duracao` (string) — Exposure in days: `30`, `90` or `365`. - `pagamento` (string) — `usdc`, `deposito` or `a_combinar`. **Body example** ```json { "name": "…", "email": "a@example.com", "message": "…", "cf_turnstile_response": "(human)" } ``` **Response `200`** - `ok` (bool) — Always `true` when the message was accepted. - `path` (string) — Which path it came through: human with captcha or paid agent. **Errors** - `400` — Required field missing. - `402` — Quota exceeded. The response carries `accepts[]` (x402, USDC on Base): pay and repeat the same call with `X-PAYMENT`. - `429` — Agent backoff: wait for `Retry-After`. **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/contact -H "X-PAYMENT: $PAYMENT" -H 'content-type: application/json' -d '{"name":"Agent","email":"a@example.com","message":"Hello"}' ``` ### `POST /api/visit` Ping from the interface that increments the day's visits. Agents need not call it. Smoke does not count: `X-MM-Smoke`, User-Agent `mm-smoke` or `smoke: true` in the body come in as `counted: false`. - **URL:** `https://staging.pageaudit.online/api/visit` - **Auth:** `none` — Public, no credential. **Body** (`application/json`) - `p` (string) — Path of the visited page. - `smoke` (bool) — `true` marks the call as a test and it does not enter the count. **Body example** ```json { "p": "/" } ``` **Response `200`** - `ok` (bool) — Always `true`. - `counted` (bool) — Whether the visit entered the day's count. - `reason` (string, optional) — Why it did not count, when `counted` is `false`. **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/visit -H 'content-type: application/json' -d '{"p":"/","smoke":true}' ``` ### `GET /api/metrics` Metrics of the last 7 days and the most frequent findings across audits. With the operator token, includes payments. Without credentials it returns visits, usage and accounts. With `METRICS_TOKEN` as Bearer it adds `payments` — and only on Base mainnet, because staging numbers on a finance panel mislead. - **URL:** `https://staging.pageaudit.online/api/metrics` - **Auth:** `none` — Public, no credential. **Headers** - `Authorization` (string) — `Bearer <METRICS_TOKEN>` to include the finance block. **Response `200`** Structure: `Metricas`. - `app` (string) — Product name. - `today` (string) — Reference day (UTC, YYYY-MM-DD). - `today_visits` (int) — Visits counted today. - `today_contacts` (int, optional) — Contact messages received today. Only with `METRICS_TOKEN`: contact does not leave without a token. - `days` (object[]) — One record per day of the window, with the counts of each metric. - `usage` (object) — Usage per product resource — here, audits and tabs. - `accounts` (object) — Total guests and accounts. - `financeiro` (object, optional) — Aggregate of the day: `hoje_usd`, `hoje_count`, `rede`. Only with `METRICS_TOKEN`: money does not leave without a token; the full series is `payments`. - `payments` (object, optional) — Finance summary; only with METRICS_TOKEN. - `achados` (object, may be null) — Which findings appear across stored audits: `audits` (total) and `por_codigo[]` with `code`, `n`, `audits` and `fracao_audits`. Aggregate, no URL and no owner; 1 h cache. `null` if the database did not answer. **Example** ```sh curl -s https://staging.pageaudit.online/api/metrics -H "Authorization: Bearer $METRICS_TOKEN" ``` ## Account ### `GET /api/me` The session's account, its last 50 audits and the state of the trial. The account is the global account you sign in to at `/conta/global`, the same in every product; `user.id` is its id, which owns the tabs and audits here. There is no activation step. - **URL:** `https://staging.pageaudit.online/api/me` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Response `200`** - `user` (Conta) — The person who owns the session. → see `Conta` under **Structures**. - `profile` (object) — Global profile: `name`, `locale`, `timeZone`, `theme`, `revision`. - `audits` (AuditGravado[]) — The account's 50 most recent audits. → see `AuditGravado` under **Structures**. - `trial` (Trial) — The account's trial: how many days, whether active and when it ends. → see `Trial` under **Structures**. **Errors** - `401` — invalid_session - `503` — auth_unavailable **Example** ```js await fetch("https://staging.pageaudit.online/api/me", {credentials: "same-origin"}).then(r => r.json()); ``` ### `GET /api/auth/bootstrap` Prepare the browser for global sign-in. Sets a host-only HttpOnly browser cookie. CSRF is bound to the current session. No CORS. - **URL:** `https://staging.pageaudit.online/api/auth/bootstrap` - **Auth:** `none` — Public, no credential. **Response `200`** - `csrf` (string) — X-CSRF-Token - `context` (string) — Opaque view context, also in X-MM-Context; not a credential / contexto opaco da vista, não é credencial. **Errors** - `400` — invalid_request - `403` — invalid_origin / invalid_csrf - `503` — auth_unavailable: a sessão anterior é preservada / the previous session is preserved ### `GET /api/account/profile` Read your global profile. Reads current preferences from the account. Edit them on your account page; products never own a separate profile. - **URL:** `https://staging.pageaudit.online/api/account/profile` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Response `200`** {profile:{name,locale,timeZone,theme,revision}} **Errors** - `401` — invalid_session - `503` — auth_unavailable **Example** ```js await fetch("https://staging.pageaudit.online/api/account/profile", {credentials: "same-origin"}).then(r => r.json()); ``` ### `GET /api/account/avatar` Read your global profile photo. Private WebP, up to 64 KiB, no cache. Change it on your account. No user ID or object URL accepted. - **URL:** `https://staging.pageaudit.online/api/account/avatar` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Response `200`** image/webp; Cache-Control: no-store **Errors** - `401` — invalid_session - `404` — not_found: no photo / sem foto - `503` — auth_unavailable **Example** ```js await fetch("https://staging.pageaudit.online/api/account/avatar", {credentials: "same-origin"}).then(r => {if (!r.ok) throw new Error("HTTP " + r.status); return r.blob();}); ``` ### `POST /api/auth/logout` Revoke this product session. Bootstrap/CSRF must belong to this browser and session. Other product sessions remain active. - **URL:** `https://staging.pageaudit.online/api/auth/logout` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Response `200`** - `ok` (bool) — true **Errors** - `400` — invalid_request - `403` — invalid_origin / invalid_csrf - `503` — auth_unavailable: a sessão anterior é preservada / the previous session is preserved **Example** ```js // Execute no console da página do produto / Run in the product page console. (async () => { const origin = "https://staging.pageaudit.online"; const {csrf} = await fetch(origin + "/api/auth/bootstrap").then(r => r.json()); const r = await fetch(origin + "/api/auth/logout", { method: "POST", credentials: "same-origin", headers: {"Content-Type": "application/json", "X-CSRF-Token": csrf}, body: JSON.stringify({}) }); if (!r.ok) throw new Error("Auth HTTP " + r.status); return r.json(); })(); ``` ### `GET /api/account/keys` List your API keys in this product. Never returns the key itself: name, last 4 characters, organization, creation, last use (hourly) and whether it still works. - **URL:** `https://staging.pageaudit.online/api/account/keys` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Response `200`** - `keys` (object[]) — `id`, `name`, `organizationId`, `last4`, `createdAt`, `lastUsedAt`, `revokedAt`, `active` (false when revoked or stopped by a password change / ending all sessions). **Errors** - `401` — invalid_session - `503` — auth_unavailable **Example** ```js await fetch("https://staging.pageaudit.online/api/account/keys", {credentials: "same-origin"}).then(r => r.json()); ``` ### `POST /api/account/keys/create` Create an API key for agents and scripts. Needs a sign-in in the last 5 minutes; an organization key also needs a second factor in the session and the owner/admin role with this product enabled. At most 10 live keys per account and product. The key (`secret`) is returned ONCE. - **URL:** `https://staging.pageaudit.online/api/account/keys/create` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Body** (`application/json`) - `name` (string, required) — Up to 60 characters. - `organizationId` (string, required) — `null` for an account key. **Body example** ```json { "name": "agent", "organizationId": null } ``` **Response `200`** - `key` (object) — `id`, `name`, `organizationId`, `last4`, `createdAt`. - `secret` (string) — `mmk_…`, shown once. **Errors** - `400` — invalid_key_name / invalid_organization - `401` — invalid_session / reauth_required - `403` — invalid_origin / invalid_csrf / organization_forbidden / organization_mfa_required - `409` — key_limit_reached - `503` — auth_unavailable **Example** ```js (async () => { const {csrf} = await fetch("https://staging.pageaudit.online/api/auth/bootstrap").then(r => r.json()); const r = await fetch("https://staging.pageaudit.online/api/account/keys/create", {method: "POST", credentials: "same-origin", headers: {"Content-Type": "application/json", "X-CSRF-Token": csrf}, body: JSON.stringify({name: "agent", organizationId: null})}); return r.json(); })(); ``` ### `POST /api/account/keys/revoke` Revoke one of your API keys. Stops the key at once. Repeating is harmless. - **URL:** `https://staging.pageaudit.online/api/account/keys/revoke` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Body** (`application/json`) - `id` (string, required) — The key `id`. **Body example** ```json { "id": "…" } ``` **Response `200`** - `ok` (bool) — true **Errors** - `400` — invalid_key_id - `401` — invalid_session - `403` — invalid_origin / invalid_csrf - `404` — key_not_found - `503` — auth_unavailable **Example** ```js (async () => { const {csrf} = await fetch("https://staging.pageaudit.online/api/auth/bootstrap").then(r => r.json()); const r = await fetch("https://staging.pageaudit.online/api/account/keys/revoke", {method: "POST", credentials: "same-origin", headers: {"Content-Type": "application/json", "X-CSRF-Token": csrf}, body: JSON.stringify({id: "…"})}); return r.json(); })(); ``` ### `POST /api/auth/claim` Moves what the guest created to the signed-in account: tabs and audits. Bootstrap/CSRF of this browser required; the page does it right after sign-in. Only what the guest still owns moves, in one transaction, and anything that collides with what the account already has stays with the guest. What the guest bought moves too. An old unsigned token that owns nothing here is refused. Repeating it is harmless (moves zero). - **URL:** `https://staging.pageaudit.online/api/auth/claim` - **Auth:** `session` — Global account: HttpOnly cookie `__Host-mm-auth`, set when you sign in on this site's `/conta/global` page. An ended session answers 401 `session_ended` (it never falls back to the guest). Writes need the same Origin and `X-CSRF-Token` from `/api/auth/bootstrap`. No bearer token is issued to humans. **Body** (`application/json`) - `guest_token` (string, required) — Guest `pa_…` of this browser. **Body example** ```json { "guest_token": "pa_…" } ``` **Response `200`** - `ok` (bool) — Whether the guest was recognized and moved. - `claimed` (object) — `product.movidos` (rows moved, per table), `product.apagados` (guest duplicates dropped) and `product.direitos` (purchases moved). **Errors** - `400` — invalid_product_claim / invalid_body - `401` — invalid_session - `403` — invalid_origin / invalid_csrf - `409` — unknown_guest (em `claimed.reason` / in `claimed.reason`) - `503` — product_claim_pending / auth_unavailable **Example** ```js (async () => { const {csrf} = await fetch("https://staging.pageaudit.online/api/auth/bootstrap").then(r => r.json()); const r = await fetch("https://staging.pageaudit.online/api/auth/claim", {method: "POST", credentials: "same-origin", headers: {"Content-Type": "application/json", "X-CSRF-Token": csrf}, body: JSON.stringify({guest_token: localStorage.getItem("pageaudit_guest")})}); return r.json(); })(); ``` ## Operations ### `POST /api/erro-cliente` Browser error report, sent by the interface itself. Agents need not call it. The interface reports on its own JS errors, unhandled rejections, scripts/CSS that failed to load and CSP blocks — once per session — and the app reports handled failures through `window.mmErro.relata`. The server validates the envelope, redacts credentials, e-mails and phone numbers, merges repeats of the same failure per minute and records an operational event; nothing is written to a database. It keeps no IP, cookie, query string or full User-Agent. Always answers 204, even for an invalid report. - **URL:** `https://staging.pageaudit.online/api/erro-cliente` - **Auth:** `none` — Public, no credential. **Body** (`application/json`) - `code` (string, required) — Failure code, `UI-` + letters/digits (`UI-JS-001` global error, `UI-PROMESSA-001`, `UI-RECURSO-001`, `UI-CSP-001`, `UI-APP-001` app report). - `phase` (string, required) — Where it broke, lowercase: `global`, `promessa`, `script`, `load_list`… - `path` (string) — Path of the open page, without query. - `message` (string) — Error message, up to 2000 characters. - `stack` (string) — Stack trace, up to 12000 characters. - `source` (string) — Originating script; only its path is kept. - `line` (int) — Line in the originating script. - `column` (int) — Column in the originating script. - `visivel` (bool) — Whether the tab was visible when it broke. **Body example** ```json { "code": "UI-APP-001", "phase": "carregar_lista", "path": "/", "message": "lista 500" } ``` **Response `200`** 204 with no body, always — an invalid, repeated or over-cap report also gets 204. **Example** ```sh curl -s -XPOST https://staging.pageaudit.online/api/erro-cliente -H 'content-type: application/json' -d '{"code":"UI-APP-001","phase":"carregar_lista","path":"/","message":"lista 500"}' ``` ### `POST /api/pagamento/aberto` The interface reports a visible payment prompt. Agents must not call this route. An empty same-origin report, sent automatically when a payment prompt becomes visible. It starts no payment, grants no access and receives no identity or credentials. It writes no database row per report. Counts events, not unique people. The private operator dashboard separates API payment requests and browser payment views per UTC day; the two counts may overlap. - **URL:** `https://staging.pageaudit.online/api/pagamento/aberto` - **Auth:** `none` — Public, no credential. **Headers** - `Origin` (string, required) — The page origin, identical to this route's origin. - `Sec-Fetch-Site` (string, required) — `same-origin`, set by the browser. - `X-MM-Payment-View` (string, required) — `1`, set by the shared component. **Response `202`** 202 with no body when accepted; 204 when ignored. Always no-store. ## Public stats ### `GET /api/vitrine` The product's public numbers: traffic, agents, usage and reliability, no money. Projection published hourly by the house collector, rounded to two significant digits; `null` is a missing measurement, never zero. 15-minute cache with ETag (`If-None-Match` → 304). There is no way to send numbers through this route: publishing belongs to the collector, with its own token. - **URL:** `https://staging.pageaudit.online/api/vitrine` - **Auth:** `none` — Public, no credential. **Response `200`** - `v` (int) — Contract version (1). - `produto` (string) — Product id. - `publicado` (bool) — `false` before the collector's first publication; then only these five keys come. - `atualizado_em` (string, may be null) — When the collector published (ISO 8601). - `stale` (bool) — `true` when the projection is older than 26 h. - `nome` (string, optional) — Product name. - `desde` (string, optional, may be null) — First day the series covers. - `fuso` (string, optional) — Time zone of the days (`UTC`). - `hoje` (object, optional) — Today: pages by class (human, AI, bot), API calls by class, machine-surface reads and product usage. - `dias` (object[], optional) — Up to 31 days, oldest first: `dia`, `paginas`, `api`, `api_ia`, `maquina`, `visitantes`, `uso`. - `janelas` (object, optional) — 7- and 30-day sums (`d7`, `d30`). - `visitantes` (object, optional) — Unique visitors at the edge over 7 days. - `pessoas` (object, optional, may be null) — GA4 when available: users, sessions, countries, devices and who arrived from AI. - `agentes` (object, optional) — The AI agents and bots that read the most, 7 days. - `superficies` (object, optional) — Reads of OKF, llms, well-known, OpenAPI and MCP over 7 days. - `mcp` (object, optional) — MCP calls over 7 days. - `uso` (object, optional) — Real product usage per resource: label, today, 7 and 30 days. - `contas` (object, optional, may be null) — Users and guests. - `confiabilidade` (object, optional) — Share of requests without 5xx over 7 days, and the live build. - `catalogo` (object, optional, may be null) — Size of the catalog, when the product has one. - `apoio` (object, optional) — Impressions and clicks per sponsor, when any. **Example** ```sh curl -s https://staging.pageaudit.online/api/vitrine ``` ### `GET /api/vitrine/operador` The product's full document on the operator panel — operator token only. - **URL:** `https://staging.pageaudit.online/api/vitrine/operador` - **Auth:** `none` — Public, no credential. **Headers** - `Authorization` (string, required) — `Bearer <METRICS_TOKEN>` — the operator class. **Response `200`** - `produto` (string) — Product id. - `atualizado_em` (string, may be null) — When the collector published. - `operador` (object, may be null) — The collector's full document, with what the public projection leaves out. **Errors** - `401` — No token, wrong token or a token of another class. - `503` — Worker without `METRICS_TOKEN` or without the control plane. **Example** ```sh curl -s https://staging.pageaudit.online/api/vitrine/operador -H "Authorization: Bearer $METRICS_TOKEN" ``` ### `GET /api/vitrine/painel` The whole house panel, in the shape the gm reads — operator token only. - **URL:** `https://staging.pageaudit.online/api/vitrine/painel` - **Auth:** `none` — Public, no credential. **Headers** - `Authorization` (string, required) — `Bearer <METRICS_TOKEN>` — the operator class. **Response `200`** - `apps` (object[]) — One operator document per product, ordered by id. - `updated` (string, optional) — When the collector closed the round. - `totals` (object, optional) — House totals. **Errors** - `401` — No token, wrong token or a token of another class. - `503` — Worker without `METRICS_TOKEN` or without the control plane. **Example** ```sh curl -s https://staging.pageaudit.online/api/vitrine/painel -H "Authorization: Bearer $METRICS_TOKEN" ``` ### `GET /api/vitrine/cursores` The resolved-error cursor per product (`borda`, `cli`) — operator token only. - **URL:** `https://staging.pageaudit.online/api/vitrine/cursores` - **Auth:** `none` — Public, no credential. **Headers** - `Authorization` (string, required) — `Bearer <METRICS_TOKEN>` — the operator class. **Response `200`** JSON: `{ [product]: { borda?: ISO, cli?: ISO } }`; empty is `{}`. **Errors** - `401` — No token, wrong token or a token of another class. - `503` — Worker without `METRICS_TOKEN` or without the control plane. **Example** ```sh curl -s https://staging.pageaudit.online/api/vitrine/cursores -H "Authorization: Bearer $METRICS_TOKEN" ``` ## Partnership ### `GET /api/partners` Partnership, sponsorship and advertising: the product's placements with a suggested price, the public numbers next to them and how to propose. Information on request, no activation: placements from the house catalogue priced in USD per 30 days (90 and 365 days discounted), sponsors in effect, an excerpt of `/api/vitrine`, the house wallet (USDC on Base) and the contact path — bank deposit, PIX or invoice are arranged in the reply. Cached for 1 hour. - **URL:** `https://staging.pageaudit.online/api/partners` - **Auth:** `none` — Public, no credential. **Response `200`** - `status` (string) — `sob_consulta`: information and proposal, no activation and no charge. - `produto` (string) — Product name. - `idioma` (string) — Language of the texts (the product's). - `titulo` (string) — Title of the offer. - `descricao` (string) — One sentence about the offer. - `publico` (string) — Who uses the product — the audience a sponsor reaches. - `modalidades` (object[]) — `{ id, nome }`: patrocinio, parceria, anuncio. - `placements` (object[]) — The product's placements: `id`, `nome`, `onde`, `formato`, `exclusivo`, `medicao`, `price_usd_30d` (suggested; `null` is on request), `exposure[{ dias, price_usd }]` for 30, 90 and 365 days, `disponivel`. - `house_bundle` (object) — The house bundle: footer and agent mention across the ten products, discounted. - `parcerias` (string[]) — Partnership ideas the product is open to discuss. - `current_sponsors` (object[]) — Sponsors in effect: `id`, `nome`, `url`, `frase`, `espacos`, `ate`. - `stats` (object) — Excerpt of the public numbers (`hoje`, `janelas`, `agentes`, `confiabilidade`) and the `link` to `/api/vitrine`; `publicado: false` before the first publication. - `payment` (object) — How to pay: `rede`, `chain_id`, `ativo`, `pay_to`, `eip681` (the house wallet, when declared), `alternativas` and the `nota` — bank deposit, PIX or invoice in the reply. - `contact` (object) — `email`, `form_url`, `api_url` (`POST /api/contact` where the handler exists), `campos` (required), `campos_proposta` (the optional proposal fields, each with its accepted values), `price_agent_usd`, `message_template`, `instructions`. - `politica` (object) — Placement label, refused sectors, prepayment, deadlines. - `_links` (object) — `self`, `stats`, `page` (`null` until the page exists), `contact`, `casa` (the same path on the ten products). **Example** ```sh curl -s https://staging.pageaudit.online/api/partners ``` ## Credit ### `POST /api/credito` Top up prepaid credit: pay once with x402 and get the token that debits on any API of the house. - **URL:** `https://staging.pageaudit.online/api/credito` - **Auth:** `none` — Public, no credential. **Query** - `usd` (int, required) — Package: 1, 5, 10 ou 25 dollars. **Response `200`** - `token` (string) — Bearer token for the balance (`cred_…`). Shown ONCE — it cannot be recovered. - `saldo_usd` (string) — Credited balance. - `guarde` (string) — Warning that the token is the bearer of the credit. - `usar` (string) — How to present the token on paid routes. - `saldo_em` (string) — Where to check balance and statement. **Errors** - `400` — Package outside the list (1, 5, 10 ou 25). - `402` — Unpaid — the body carries the x402 `accepts[]`. **Example** ```sh curl -s -XPOST 'https://staging.pageaudit.online/api/credito?usd=10' ``` ### `GET /api/credito` Credit balance and statement — the latest movements, without returning the token. - **URL:** `https://staging.pageaudit.online/api/credito` - **Auth:** `credito` — Prepaid credit token in `Authorization: Bearer cred_…` (or the `X-Credito` header). Not an account: it is a bearer of balance. **Response `200`** - `saldo_micros` (int) — Balance in micro-dollars (1e-6 USD). - `saldo_usd` (string) — Formatted balance. - `criado_em` (string) — When the credit was opened. - `movimentos` (object[]) — Recent credits and debits, with product and resource. **Errors** - `401` — No token, or unknown token. **Example** ```sh curl -s https://staging.pageaudit.online/api/credito -H 'Authorization: Bearer cred_…' ``` ## Structures ### `Audit` The report of one audit: score, findings and everything observed on the page. - `id` (string, may be null) — ID of the stored audit; `null` when the database was unavailable. - `score` (int) — 0–100 for measured checks: error -18, warn -8, info 0. Not a security/accessibility certification. Older saved scores keep their original weights. - `issues` (Achado[]) — Everything found, from most to least severe. → see `Achado` under **Structures**. - `summary` (ResumoPagina) — What the page declares: title, meta, canonical, OG, headings, links… → see `ResumoPagina` under **Structures**. - `counts` (ContagemAchados) — How many findings of each severity. → see `ContagemAchados` under **Structures**. - `headers` (object) — Every header of the target's response. `Set-Cookie` is removed on purpose: it is a third party's credential. - `htmlTruncated` (bool) — `true` when the page passed 2 MB and was read only that far. - `jsonLd` (object[]) — The raw JSON-LD blocks, as they were on the page. - `jsonLdStored` (int) — How many blocks survived the size cap — compare with `summary.jsonLdBlocks`. - `truncated` (string[]) — What was cut and why: `jsonld_size`, `jsonld_nodes_over_50`, `result_size`. Empty means nothing cut. - `fixes` (Correcao[]) — The ready fix of each finding, without a model — paste, fill in or decide. The consolidated one is at `_links.patch`. → see `Correcao` under **Structures**. - `quota` (CotaAudit) — How much is still free and what it costs past that. → see `CotaAudit` under **Structures**. - `_links` (LinksAudit) — This audit, the patch, the share and the API index. → see `LinksAudit` under **Structures**. ### `AuditGravado` The same report re-read from the database. It has no `quota` and no `_links` (it is a read, not a run) and gains the date and the share slug. - `audit_id` (string) — ID of the audit. - `url` (string) — Final audited URL, after following the redirects. - `score` (int) — Score from 0 to 100. - `summary` (ResumoPagina, may be null) — What the page declared at the time of the run. → see `ResumoPagina` under **Structures**. - `counts` (ContagemAchados) — How many findings of each severity. → see `ContagemAchados` under **Structures**. - `issues` (Achado[]) — Everything found in that run. → see `Achado` under **Structures**. - `fixes` (Correcao[]) — The ready fix of each finding; an audit stored before this existed gets the computation on read. → see `Correcao` under **Structures**. - `jsonLd` (object[]) — The raw JSON-LD blocks stored. - `headers` (object) — Headers of the target's response, as they were in the run. - `truncated` (string[]) — What was cut by size when storing. - `share_slug` (string, may be null) — Public slug, if this audit was shared. - `created_at` (string) — When the run happened (UTC). ### `Patch` The consolidated patch of an audit, ready for the agent that builds the site to apply. - `url` (string, may be null) — Final audited URL. - `audit` (string, may be null) — Absolute link of the source audit. - `head` (string) — The deterministic tags, one per line, in <head> order (charset first). Empty when there are none. - `arquivos` (ArquivoPatch[]) — Files to create at the host root. → see `ArquivoPatch` under **Structures**. - `moldes` (MoldePatch[]) — What only the owner can fill in. → see `MoldePatch` under **Structures**. - `sem_patch` (SemPatch[]) — What is a decision or infrastructure. → see `SemPatch` under **Structures**. - `resumo` (ResumoPatch) — Count per class. → see `ResumoPatch` under **Structures**. - `como_aplicar` (string) — One-sentence instruction. - `_links` (object) — `api_index`. ### `Ferramenta` A micro-tool: the landing of one isolated check, with the same engine as the full audit. - `slug` (string) — Identifier in the URL, e.g. `title-tag-checker`. - `title` (string) — Page title, used in `<title>`. - `h1` (string) — The landing's H1. - `description` (string) — Meta description of the landing. - `lead` (string) — Opening paragraph. - `category` (string) — Grouping of the tool in the hub. - `icon` (string) — Name of the icon used in the card. - `checks` (string[]) — Finding codes this tool highlights — they are the `Achado.code`s. - `serp` (object) — How the result looks in the search preview. - `sections` (object[]) — Content blocks of the landing. - `_links` (object) — This tool in JSON and in HTML. ### `Compartilhamento` The result of publishing an audit under a non-enumerable slug. - `ok` (bool) — Always `true`. - `shared` (bool) — Whether the audit is published at the end of the call. - `slug` (string) — Public, non-enumerable slug. - `path` (string) — Path of the report's HTML page. - `badge` (string) — Path of the score badge SVG. - `_links` (object) — Report, JSON and badge, as absolute URLs. ### `Badge` The score badge metadata, to build the README markdown. - `slug` (string) — Slug of the shared report. - `score` (int, may be null) — Score shown in the badge. - `label` (string) — Text on the left of the badge. - `available` (bool) — `false` when the share was revoked — the SVG turns grey `n/a`. - `markdown` (string) — The markdown line ready to paste in the README. - `_links` (object) — The SVG and the report. ### `Workspace` The owner's whole workspace, with the active tab's result already rehydrated — one call to draw the screen. - `tabs` (Aba[]) — Every tab of the owner. → see `Aba` under **Structures**. - `active_id` (string, may be null) — Which tab is in focus. - `active_result` (AuditGravado, may be null) — The last result of the active tab, so a second call is not needed. → see `AuditGravado` under **Structures**. - `limit` (int) — How many tabs fit before paying. - `owner` (string) — Identifier of this workspace's owner. - `gate` (Gate) — How much of the IP's free allowance remains. → see `Gate` under **Structures**. - `billing` (object) — Prices and usage, the same `GET /api/billing` returns. ### `Aba` A workspace tab: one followed URL, with the last result kept. - `id` (string) — ID of the tab. - `url` (string) — URL the tab follows. - `alias` (string, may be null) — Label the person gave the tab. - `active` (bool) — Whether it is the focused tab in the workspace. - `audit_id` (string, may be null) — Audit of this tab's last run. - `score` (int, may be null) — Score of the last run. - `monitor` (bool) — Whether the daily watch is on for this tab. - `monitor_email` (string, may be null) — Where the watch writes; `null` means the account's e-mail. - `monitor_checked_at` (string, may be null) — When the watch last checked this page (UTC). - `created_at` (string) — When the tab was opened (UTC). ### `Ok` Write confirmation with no body of its own to return. - `ok` (bool) — Always `true` — failure comes as a 4xx/5xx status, not as `ok:false`. ### `Gate` How much of the daily allowance still exists for this IP, and whether Turnstile is already required. - `ip` (string) — IP seen by the edge, already masked. - `now` (int) — Time of the query, in epoch. - `configured` (bool) — Whether Turnstile is configured in this environment. - `free_allowance` (int) — Free audits per day. - `free_remaining` (int) — How many remain today for this IP. - `verified_until` (int, may be null) — Until when the verification already done is valid. - `needs_verification` (bool) — `true` when the next call will ask for Turnstile (human) or 402 (agent). - `sitekey` (string, may be null) — Turnstile sitekey, for the browser to build the challenge. ### `RunHistorico` One run of a tab in the series, with what changed since the run before it. `change` is null on the oldest run read — with no base there is no change to state. - `audit_id` (string) — The stored audit, readable at `GET /api/audits/:id`. - `score` (int, may be null) — Score of this run. - `counts` (object) — How many errors, warnings and infos this run had. - `created_at` (string) — When the run happened (UTC). - `change` (Mudanca, may be null) — What changed since the previous run. → see `Mudanca` under **Structures**. - `shared` (string, may be null) — Public report URL, when this run was shared. - `api` (string) — This run in the API. ### `Billing` Everything that decides whether the next call will cost: the x402 configuration, the prices, the usage and the trial. - `provider` (string) — Always `x402` — the only billing protocol accepted. - `mode` (string) — Seller mode: `live` charges for real, `dev` lets calls through unpaid. - `network` (string) — USDC network: `base` in production, `base-sepolia` in staging. - `chain_id` (int) — EVM chain ID of the network above, so the wallet signs on the right chain. - `pay_to` (string, may be null) — Address that receives the payment. - `homolog` (bool) — Staging seam on: the loop can be closed without spending USDC. - `dev` (bool) — Development mode: the 402 is simulated. - `dev_gate` (bool) — A homologation credential is configured; this grants no access. - `gratis` (string[], optional) — Temporarily free SKUs. - `facilitator` (string) — URL of the facilitator that verifies and settles the payment. - `asset` (string) — Accepted currency — always `USDC`. - `asset_address` (string) — USDC contract on the network above. - `faucet` (string, may be null) — Test-USDC faucet; only on base-sepolia. - `wallets` (object) — Links to wallets that speak x402 (metamask, coinbase, base_app). - `product` (string) — Name of the product charging. - `free_max_tabs` (int) — Free tabs per owner. - `prices` (Precos) — What each paid action costs, in USD. → see `Precos` under **Structures**. - `usage` (Uso) — How much of the free allowance has been used. → see `Uso` under **Structures**. - `trial` (Trial) — The account's trial, when there is a session. → see `Trial` under **Structures**. ### `Conta` The person behind the session. - `id` (string) — ID of the global account — the owner of the tabs and audits. - `email` (string) — The account's verified e-mail. ### `Trial` The paywall-free period of an account, counted from its first use of PageAudit — once per account. It is the alternative to paying. - `days` (int) — Trial length in days. - `active` (bool) — Whether it is in force now. - `days_left` (int, optional) — How many days remain. - `ends_at` (string, may be null) — When it ends (UTC). ### `Metricas` 7-day panel. `payments` only shows with the operator token and only on Base mainnet. - `app` (string) — Product name. - `today` (string) — Reference day (UTC, YYYY-MM-DD). - `today_visits` (int) — Visits counted today. - `today_contacts` (int, optional) — Contact messages received today. Only with `METRICS_TOKEN`: contact does not leave without a token. - `days` (object[]) — One record per day of the window, with the counts of each metric. - `usage` (object) — Usage per product resource — here, audits and tabs. - `accounts` (object) — Total guests and accounts. - `financeiro` (object, optional) — Aggregate of the day: `hoje_usd`, `hoje_count`, `rede`. Only with `METRICS_TOKEN`: money does not leave without a token; the full series is `payments`. - `payments` (object, optional) — Finance summary; only with METRICS_TOKEN. - `achados` (object, may be null) — Which findings appear across stored audits: `audits` (total) and `por_codigo[]` with `code`, `n`, `audits` and `fracao_audits`. Aggregate, no URL and no owner; 1 h cache. `null` if the database did not answer. ### `PaymentQuota` - `free` (PaymentFree[]) — Free allowances and their windows. → see `PaymentFree` under **Structures**. - `paid` (PaymentPrice[]) — List prices in USD. The operation's 402 is the payable quote. → see `PaymentPrice` under **Structures**. - `how_to_pay` (string) — Payment instructions and availability restrictions. - `live` (string, may be null) — Authoritative product quota endpoint. - `free_now` (string[], optional) — SKUs temporarily free despite their list price. - `trial` (PaymentTrial, optional) — Registration trial, when offered. → see `PaymentTrial` under **Structures**. ### `Achado` A problem (or a pass) found on the page. - `severity` (string) — Severity of the finding. - `code` (string) — Stable check code, e.g. `title_missing`. It is what you filter by. - `message` (string) — The finding in one sentence, ready to show a person. ### `ResumoPagina` Everything the page declares about itself. It is the most consulted object of the API. - `finalUrl` (string) — URL after following every redirect. - `status` (int) — Final HTTP status of the target. - `contentType` (string, may be null) — Content-Type of the final response. - `title` (string, may be null) — Content of `<title>`. - `metaDescription` (string, may be null) — Content of `<meta name=description>`. - `canonical` (string, may be null) — Canonical URL declared by the page. - `robots` (string, may be null) — Content of `<meta name=robots>`. - `viewport` (string, may be null) — Content of `<meta name=viewport>`. - `charset` (string, may be null) — Declared encoding. - `lang` (string, may be null) — Language declared in `<html lang>`. - `favicon` (string, may be null) — URL of the favicon found. - `faviconSource` (string, may be null) — How the favicon was found: declared or by the default path. - `h1s` (string[]) — Every `<h1>` on the page, in order. - `openGraph` (object) — The `og:*` tags found, key by key. - `twitter` (object) — The `twitter:*` tags found. - `jsonLdCount` (int) — How many JSON-LD nodes the page had. - `jsonLdBlocks` (int) — How many `<script type=application/ld+json>` blocks existed. - `jsonLdErrors` (int, optional) — Invalid JSON syntax or non-object root values; not full JSON-LD/schema.org validation. - `jsonLdDropped` (bool) — `true` when nodes were dropped for passing the cap. - `jsonLdTypes` (string[]) — The `@type`s found, e.g. `Organization`, `WebSite`. - `images` (object) — Image count and how many have no `alt`. - `links` (object) — Count of internal, external and text-less links. - `words` (int) — Words in the visible content. - `hreflang` (object[]) — The declared language alternates. - `legacy` (object) — Old markup still present (e.g. `<font>`, layout tables). - `redirects` (object[]) — The redirect chain followed to the final URL. - `robotsTxt` (object) — What the origin's `robots.txt` says about this URL. - `sitemap` (object) — Whether the URL appears in the sitemap the origin declares. - `discovery` (Discovery, optional, may be null) — Selected discovery and delivery checks; optional files missing do not lower the score. Up to 15 additional GETs, concurrency 2, 8s total deadline and 64 KiB per text body. → see `Discovery` under **Structures**. ### `ContagemAchados` How many findings of each severity — the summary that fits in a badge. - `errors` (int) — Serious findings. - `warnings` (int) — Findings that deserve attention. - `info` (int) — Observations without severity. ### `Correcao` The ready fix of one finding. `classe` says whether it is to paste, to fill in or to decide. - `code` (string) — The same `code` as the finding (`Achado.code`). - `severity` (string) — Severity of the source finding. - `classe` (string) — `deterministico` comes whole from the page; `molde` has a `{{…}}` placeholder; `sem_patch` is an instruction. - `alvo` (string) — Where to apply: `head`, `corpo`, `img`, `arquivo` or `pagina` (instruction). - `snippet` (string, may be null) — The ready tag (or with a placeholder). `null` for files and for `sem_patch`. - `arquivo` (object, may be null) — `path` and `conteudo` when the fix is a file at the host root. - `fonte` (string, may be null) — Where the value came from, or what the page already had (for the template or to check the cut). - `nota` (string, may be null) — How to apply, or what to decide. ### `CotaAudit` How much is still free and what it costs past that. - `free_per_day` (int) — Free audits per IP per day. - `price_usd` (number) — Price of an audit beyond the allowance, in USD. ### `LinksAudit` Addresses of the audit just created. Without a stored `id`, only `api_index` comes. - `self` (string, optional) — This audit, to re-read without re-auditing. - `patch` (string, may be null) — `GET /api/audits/:id/patch` — the consolidated patch of this audit. - `share` (string, optional) — Where to publish this audit under a public slug. - `api_index` (string) — Self-describing API index. ### `ArquivoPatch` A file to create at the host root. - `code` (string) — Finding that originated it (`robots_txt_missing`, `sitemap_missing`). - `path` (string) — Absolute path on the host, e.g. `/robots.txt`. - `conteudo` (string) — Full content of the file. ### `MoldePatch` A tag with a marked placeholder: content missing that only the owner knows. - `code` (string) — Source finding. - `alvo` (string) — `head`, `corpo` or `img`. - `snippet` (string) — The tag with `{{PLACEHOLDER}}`. - `fonte` (string, may be null) — Suggestion taken from the page itself (H1, og:description…), if any. - `nota` (string) — What to fill in and the limit. ### `SemPatch` Finding without an automatic fix: it is a decision or infrastructure. - `code` (string) — Source finding. - `nota` (string) — What to check or decide. ### `ResumoPatch` How many fixes of each class. - `deterministicos` (int) — Ready to paste (head + files). - `moldes` (int) — With a placeholder. - `sem_patch` (int) — Instruction only. - `total` (int) — Findings considered. ### `Mudanca` The difference between two runs of the same page. Findings are compared by code, never by message: the message carries the measured value and would change without anything getting worse. - `score` (int, may be null) — Point delta, signed (positive means it improved). - `from` (int, may be null) — Score of the previous run. - `to` (int, may be null) — Score of this run. - `broke` (object[]) — Findings that appeared, each with `code`, `severity` and `message`. - `fixed` (object[]) — Findings that disappeared, in the same shape. ### `Precos` Prices in force, in dollars. Read them here, not from the documentation. - `extra_tab_usd` (number) — Cost of a tab beyond the allowance. - `contact_agent_usd` (number) — Cost of an agent contact. ### `Uso` How much of the free allowance the owner has used. - `tabs` (int) — Tabs open now. - `free_slots_left` (int) — Free tabs still available. ### `PaymentFree` - `o_que` (string) — Operation or allowance. - `limite` (string) — Allowance and eligibility. - `janela` (string, may be null) — Reset window, when applicable. ### `PaymentPrice` - `o_que` (string) — Operation and billing unit. - `price_usd` (number) — Current list price in USD. ### `PaymentTrial` - `days` (int) — Trial duration in days. - `how` (string) — Eligibility and activation steps. ### `Discovery` Five fixed probes plus well-known extras only when the page declares them or matches their function. Absent in older reports; rerun to measure. No recursive crawling. - `llms` (DiscoveryCheck) — Root llms.txt or the most specific same-origin describedby guide found on the page. → see `DiscoveryCheck` under **Structures**. - `security` (DiscoveryCheck) — /.well-known/security.txt: selected RFC 9116 checks. → see `DiscoveryCheck` under **Structures**. - `apiCatalog` (DiscoveryCheck) — /.well-known/api-catalog: selected RFC 9727 Linkset checks. → see `DiscoveryCheck` under **Structures**. - `changePassword` (DiscoveryCheck, optional) — /.well-known/change-password when the page uses a password field. Redirect only; the form is never submitted. → see `DiscoveryCheck` under **Structures**. - `assetlinks` (DiscoveryCheck, optional) — /.well-known/assetlinks.json when Android app association is indicated. App binary is not compared. → see `DiscoveryCheck` under **Structures**. - `appleApp` (DiscoveryCheck, optional) — /.well-known/apple-app-site-association when Apple associated domains are indicated. No redirects. Entitlements are not checked. → see `DiscoveryCheck` under **Structures**. - `oauthResource` (DiscoveryCheck, optional) — OAuth protected resource metadata when WWW-Authenticate, MCP or the well-known URL is declared. Authorization servers are not fetched. → see `DiscoveryCheck` under **Structures**. - `oauthServer` (DiscoveryCheck, optional) — /.well-known/oauth-authorization-server when this host declares itself as the issuer. → see `DiscoveryCheck` under **Structures**. - `openidConfig` (DiscoveryCheck, optional) — /.well-known/openid-configuration when this host declares OpenID Provider discovery. → see `DiscoveryCheck` under **Structures**. - `agentCard` (DiscoveryCheck, optional) — A2A Agent Card when declared. MCP identity JSON at this URL is not an A2A pass. → see `DiscoveryCheck` under **Structures**. - `webauthn` (DiscoveryCheck, optional) — /.well-known/webauthn when related origins are declared. Same-host passkeys do not need it. → see `DiscoveryCheck` under **Structures**. - `favicon` (DiscoveryCheck) — HTTP status/media type of the selected favicon; no image decoding. → see `DiscoveryCheck` under **Structures**. - `notFound` (DiscoveryCheck) — One randomly generated missing path, checking for 404/410 or a possible soft 404. → see `DiscoveryCheck` under **Structures**. ### `DiscoveryCheck` A measured observation with scope and reference. pass is limited to the checks stated in message. - `status` (string) — pass: measured checks passed; warn: issue; info: optional resource absent; unverified: blocked, incomplete, timeout or unavailable. - `url` (string, may be null) — Final public resource URL; null when it cannot safely be probed. - `httpStatus` (int) — Final observed HTTP status, or 0 if unavailable. - `contentType` (string) — Observed Content-Type, or empty when unavailable. - `message` (string) — Measured evidence and limitations; plain text, never instructions to execute. - `reference` (string) — Fixed authoritative reference for the check. ## Public data archives Browse addresses and procurement by location, then open the records you need. Up to 20 items per page, in formats ready for people and agents. Check coverage and the reference date before using a result. Access options are shown by each product. - [Postal codes and addresses](https://api.pontofato.com/enderecos/index.json): Find addresses by location, with coordinates and a 2022 reference date. Not a current postal-code certification. State → municipality → locality → street → addresses. [HTML](https://api.pontofato.com/enderecos/) · [llms.txt](https://api.pontofato.com/enderecos/llms.txt) · [OKF](https://api.pontofato.com/enderecos/okf/index.md) - [Public procurement](https://api.editalmd.com/licitacoes/index.json): Find public procurement by location and date. View documents and reading options in EditalMD. Procedure → state → year → month → day → municipality → purchases. [HTML](https://api.editalmd.com/licitacoes/) · [llms.txt](https://api.editalmd.com/licitacoes/llms.txt) · [OKF](https://api.editalmd.com/licitacoes/okf/index.md) ## Quota - Free: audit (`POST /api/audit`) — 10 per IP per day. - Free: audit — rate ceiling — 300 per IP per hour. - Free: workspace tabs — 20 per owner. - Paid: audit beyond the daily allowance — **$0.02** USDC via x402. - Paid: tab beyond the allowance — **$0.05** USDC via x402. - Paid: agent contact — **$0.10** USDC via x402. - **Not charging right now**: audit, extra_tab. Call it directly — no 402. The price above is the list price and comes back without notice. - Trial: sign up and CONFIRM the e-mail → **90 days** of full access, free. Loop: Sign in with an account at /conta/global (browser: e-mail code or link, password or passkey) → 90 days without paywall, counted from the account's first use of PageAudit Past the allowance → **402** with `accepts[]` (x402, USDC on Base). Pay and repeat the same call with `X-PAYMENT`. A human in a browser solves Turnstile and does not pay. Free alternative: a person signs in with an account (trial below). Numbers in force: https://staging.pageaudit.online/api/billing