# PageAudit

> Technical SEO auditor (title, meta description, canonical, Open Graph, Twitter
> Card, headings, JSON-LD, robots, alt, links, hreflang, redirects, robots.txt/sitemap)
> plus llms.txt, security.txt, API catalog, function-matched well-known files,
> favicon and missing-page response checks
> with the fix for every finding (`fixes[]` in the audit, ready patch at
> `GET /api/audits/:id/patch`) and a persistent tab workspace. The main client is an
> AI agent: everything the interface shows has an equivalent endpoint.

No key to start. `POST /api/audit` with `{"url": "..."}` returns the full report in one
call — 10 a day per IP, free. Past that, **402** with `accepts[]`: pay $0.02 in x402 and
repeat the call (Turnstile is the human path, not yours). Without paying: a person signs in
with an account at `/conta/global` — the account gets **90 days of full access**, counted from
its first use here (the session is an HttpOnly cookie, not a bearer).
Human micro-tools at `/tools` (JSON at `GET /api/tools`).
Score badge: `GET /badge/:slug.svg` (markdown at `GET /api/badge/:slug`).
To keep state between calls, get a guest token at `POST /api/guest` and use the tabs.
Discovery observations are in `summary.discovery`: pass, warn, info or unverified, with evidence and references. Optional absence and noindex are informational and do not lower new scores.
Five extra probes: at most 15 GETs including redirects, concurrency 2, 8 seconds total, 64 KiB per text body. Well-known extras join that batch only when declared or the page function matches. No recursive crawl, W3C validation, browser accessibility or performance measurement.

- Read this index, then the relevant `/llms-full.txt?prefix=/api/...` reference, then call HTTP or MCP. The main UI is for people; do not scrape it.


**Partnership, sponsorship and advertising**

Product placements on request, with a suggested price in USD per 30 days, the public numbers next to them and a proposal that reaches the person who answers.

- `GET https://staging.pageaudit.online/api/partners` — placements, suggested price, wallet and the proposal fields.
- [Send a proposal](https://staging.pageaudit.online/partners) — the same offer for people, with the form.
- `GET https://staging.pageaudit.online/okf/parceria.md` — the offer in markdown, to read without parsing JSON.


**Public data archives**

Browse addresses and procurement by location, then open the records you need. Up to 20 items per page, in formats ready for people and agents. Check coverage and the reference date before using a result. Access options are shown by each product.

- [Postal codes and addresses](https://api.pontofato.com/enderecos/index.json): Find addresses by location, with coordinates and a 2022 reference date. Not a current postal-code certification. State → municipality → locality → street → addresses. [HTML](https://api.pontofato.com/enderecos/) · [llms.txt](https://api.pontofato.com/enderecos/llms.txt) · [OKF](https://api.pontofato.com/enderecos/okf/index.md)
- [Public procurement](https://api.editalmd.com/licitacoes/index.json): Find public procurement by location and date. View documents and reading options in EditalMD. Procedure → state → year → month → day → municipality → purchases. [HTML](https://api.editalmd.com/licitacoes/) · [llms.txt](https://api.editalmd.com/licitacoes/llms.txt) · [OKF](https://api.editalmd.com/licitacoes/okf/index.md)


**What is kept**

- Each run writes one row in `audits` with the whole result: summary (including the redirect chain, the origin's robots.txt/sitemap, alt, links, word count, hreflang and legacy markup, discovery checks with evidence and references), issues, counts, the raw JSON-LD and every response header.
- Not kept: The page's HTML — downloaded up to 2 MB, analysed and discarded. Re-reading requires a new run.
- Not kept: The target's `Set-Cookie`, removed on purpose: it is a third party's credential and no check uses it.
- Not kept: Discovery-file bodies: only bounded observations are stored; their text is never executed and their links are not crawled.
- Nothing disappears silently. Size cuts show up in `truncated[]` (`jsonld_size`, `jsonld_nodes_over_50`, `result_size`) and `summary.jsonLdBlocks` / `summary.jsonLdDropped` say how many blocks existed and how many were left out.


**Quota**

- Free: audit (`POST /api/audit`) — 10 per IP per day.
- Free: audit — rate ceiling — 300 per IP per hour.
- Free: workspace tabs — 20 per owner.
- Paid: audit beyond the daily allowance — **$0.02** USDC via x402.
- Paid: tab beyond the allowance — **$0.05** USDC via x402.
- Paid: agent contact — **$0.10** USDC via x402.

- **Not charging right now**: audit, extra_tab. Call it directly — no 402. The price above is the list price and comes back without notice.

- Trial: sign up and CONFIRM the e-mail → **90 days** of full access, free. Loop: Sign in with an account at /conta/global (browser: e-mail code or link, password or passkey) → 90 days without paywall, counted from the account's first use of PageAudit

Past the allowance → **402** with `accepts[]` (x402, USDC on Base). Pay and repeat the same call with `X-PAYMENT`. A human in a browser solves Turnstile and does not pay. Free alternative: a person signs in with an account (trial below).

Numbers in force: https://staging.pageaudit.online/api/billing

What is left RIGHT NOW for your IP: https://staging.pageaudit.online/api/gate

**MCP**

- **Endpoint:** `POST https://staging.pageaudit.online/mcp` — Streamable HTTP, JSON-RPC 2.0. Nothing to install.
- Check it with `GET https://staging.pageaudit.online/mcp` (server card) or `tools/list`.
- Every tool is a call on this same API — the MCP has no backend of its own.
- Credentials (`X-Guest-Token`, `Authorization`, `X-PAYMENT`) go in the header and are forwarded.

**Skill**

- `.agents/skills/pageaudit/SKILL.md` — parity with this surface.
- **Golden rule:** touched the UI/API → update `apidocs.js` + skill + this llms.txt in the same PR.


## Discovery

- [API index](https://staging.pageaudit.online/api/): the whole surface, self-described, in JSON
- [llms.txt](https://staging.pageaudit.online/llms.txt): this file
- [OpenAPI](https://staging.pageaudit.online/openapi.json): machine spec (`operationId` = MCP tool name)
- [MCP](https://staging.pageaudit.online/mcp): MCP server over HTTP — plugs straight in, nothing to install
- [Health](https://staging.pageaudit.online/api/health): liveness and deployed commit
- [Integrations and agents](https://staging.pageaudit.online/developers): HTTP reference and MCP setup.

## Conventions

- Read routes accept `GET` and also `POST`, `PUT` or `PATCH` with the same parameters as JSON or form data.
- JSON is the default; `Accept: text/html` returns the same answer as HTML.
- `/skill.md` is the ready-made agent skill; `/.well-known/api-catalog` (or `/discovery/resources`) lists every surface; `/mcp` also answers at `/mcp/v1`.

## Main endpoints

- [`GET /agent.json`](/llms-full.txt?prefix=%2Fagent.json): Agent card: identity, operator, documentation, the MCP endpoint and the tools it serves. Same document as `/.well-known/agent-card.json`. (auth: none)
- [`GET /okf/:arquivo`](/llms-full.txt?prefix=%2Fokf%2F%3Aarquivo): OKF bundle (Open Knowledge Format v0.1): markdown with frontmatter so an agent reads the whole product without parsing HTML. (auth: none)
- [`GET /.well-known/:arquivo`](/llms-full.txt?prefix=%2F.well-known%2F%3Aarquivo): Machine discovery before the home page: `api-catalog` (RFC 9727, a linkset with the API and the MCP), `security.txt` (RFC 9116), `x402` (payment manifest: network, wallet and the routes that charge) and `mcp-registry-auth` (the official MCP registry key). (auth: none)
- [`GET /apis.json`](/llms-full.txt?prefix=%2Fapis.json): APIs.json (apisjson.org, 0.19): the index APIs.io harvests — the API, the MCP, OpenAPI, guide and OKF bundle in one file. Also at `/.well-known/apis.json`. (auth: none)
- [`POST /mcp`](/llms-full.txt?prefix=%2Fmcp): MCP server over HTTP (Streamable HTTP, JSON-RPC 2.0) — plugs into the client with nothing to install. (auth: none)
- [`POST /api/audit`](/llms-full.txt?prefix=%2Fapi%2Faudit): Audits a URL and returns the full report in one call, without a token or a tab. (auth: none)
- [`GET /api/audits/:id`](/llms-full.txt?prefix=%2Fapi%2Faudits%2F%3Aid): Re-reads an audit already made, in full, without re-auditing the page. (auth: guest)
- [`GET /api/audits/:id/patch`](/llms-full.txt?prefix=%2Fapi%2Faudits%2F%3Aid%2Fpatch): The consolidated patch of an audit: the <head> block ready to paste, the files to create at the root and the templates for what only the owner can fill in — no model, only facts from the page itself. (auth: guest)
- [`GET /api/tools`](/llms-full.txt?prefix=%2Fapi%2Ftools): The micro-tools: one landing per check, all driven by the same engine as the audit. (auth: none)
- [`GET /api/tools/:slug`](/llms-full.txt?prefix=%2Fapi%2Ftools%2F%3Aslug): Metadata and copy of one micro-tool. (auth: none)
- [`GET /tools`](/llms-full.txt?prefix=%2Ftools): HTML hub of the micro-tools, indexable. For JSON use `GET /api/tools`. (auth: none)
- [`GET /tools/:slug`](/llms-full.txt?prefix=%2Ftools%2F%3Aslug): HTML landing of one check, indexable. An unknown slug returns a real 404. (auth: none)
- [`POST /api/audits/:id/share`](/llms-full.txt?prefix=%2Fapi%2Faudits%2F%3Aid%2Fshare): Publishes the audit under a non-enumerable slug. Calling again returns the same slug. (auth: guest)
- [`DELETE /api/audits/:id/share`](/llms-full.txt?prefix=%2Fapi%2Faudits%2F%3Aid%2Fshare): Revokes the share; the slug stops serving the report. (auth: guest)
- [`GET /api/shared/:slug`](/llms-full.txt?prefix=%2Fapi%2Fshared%2F%3Aslug): Shared report as JSON, without credentials — the machine twin of `/r/:slug`. (auth: none)
- [`GET /r/:slug`](/llms-full.txt?prefix=%2Fr%2F%3Aslug): HTML page of the shared report, indexable, canonical at `/r/:slug`. (auth: none)
- [`GET /api/badge/:slug`](/llms-full.txt?prefix=%2Fapi%2Fbadge%2F%3Aslug): Metadata of the score badge, including the markdown ready for the README. (auth: none)
- [`GET /badge/:slug.svg`](/llms-full.txt?prefix=%2Fbadge%2F%3Aslug.svg): SVG score badge, to paste in the README of the audited project. (auth: none)
- [`GET /api/embed`](/llms-full.txt?prefix=%2Fapi%2Fembed): The embeddable widget's contract: what you can configure and the snippet to paste. (auth: none)
- [`GET /embed.js`](/llms-full.txt?prefix=%2Fembed.js): The loader you paste: it creates the widget's iframe and keeps it the right height. (auth: none)
- [`GET /embed`](/llms-full.txt?prefix=%2Fembed): The widget page itself, made to be framed (`frame-ancestors *`) and not indexed. (auth: none)
- [`POST /api/guest`](/llms-full.txt?prefix=%2Fapi%2Fguest): Creates a guest `pa_…` — it is what gives access to the tab workspace without an account. (auth: none)
- [`GET /api/tabs`](/llms-full.txt?prefix=%2Fapi%2Ftabs): The owner's whole workspace, with the active tab's result already rehydrated. (auth: guest)
- [`POST /api/tabs`](/llms-full.txt?prefix=%2Fapi%2Ftabs): Opens a tab for the URL, or focuses the one that already exists for it. (auth: guest)
- [`GET /api/tabs/:id`](/llms-full.txt?prefix=%2Fapi%2Ftabs%2F%3Aid): One tab with the full report of its last run. (auth: guest)
- [`PATCH /api/tabs/:id`](/llms-full.txt?prefix=%2Fapi%2Ftabs%2F%3Aid): Renames the tab, puts it in focus or turns the daily watch on and off. (auth: guest)
- [`DELETE /api/tabs/:id`](/llms-full.txt?prefix=%2Fapi%2Ftabs%2F%3Aid): Closes the tab. Its audit history keeps existing. (auth: guest)
- [`POST /api/tabs/:id/run`](/llms-full.txt?prefix=%2Fapi%2Ftabs%2F%3Aid%2Frun): Re-audits the tab's URL and stores a new report. (auth: guest)
- [`GET /api/tabs/:id/history`](/llms-full.txt?prefix=%2Fapi%2Ftabs%2F%3Aid%2Fhistory): Previous runs of that tab and what changed between each one and the one before it. (auth: guest)
- [`GET /api/gate`](/llms-full.txt?prefix=%2Fapi%2Fgate): How many free audits remain for this IP and whether Turnstile is about to be required. (auth: none)
- [`GET /api/billing`](/llms-full.txt?prefix=%2Fapi%2Fbilling): Tab allowance, prices, full x402 configuration and the state of the trial. (auth: none)
- [`GET /api/me`](/llms-full.txt?prefix=%2Fapi%2Fme): The session's account, its last 50 audits and the state of the trial. (auth: session)
- [`GET /api/auth/bootstrap`](/llms-full.txt?prefix=%2Fapi%2Fauth%2Fbootstrap): Prepare the browser for global sign-in. (auth: none)
- [`GET /api/account/profile`](/llms-full.txt?prefix=%2Fapi%2Faccount%2Fprofile): Read your global profile. (auth: session)
- [`GET /api/account/avatar`](/llms-full.txt?prefix=%2Fapi%2Faccount%2Favatar): Read your global profile photo. (auth: session)
- [`POST /api/auth/logout`](/llms-full.txt?prefix=%2Fapi%2Fauth%2Flogout): Revoke this product session. (auth: session)
- [`GET /api/account/keys`](/llms-full.txt?prefix=%2Fapi%2Faccount%2Fkeys): List your API keys in this product. (auth: session)
- [`POST /api/account/keys/create`](/llms-full.txt?prefix=%2Fapi%2Faccount%2Fkeys%2Fcreate): Create an API key for agents and scripts. (auth: session)
- [`POST /api/account/keys/revoke`](/llms-full.txt?prefix=%2Fapi%2Faccount%2Fkeys%2Frevoke): Revoke one of your API keys. (auth: session)
- [`POST /api/auth/claim`](/llms-full.txt?prefix=%2Fapi%2Fauth%2Fclaim): Moves what the guest created to the signed-in account: tabs and audits. (auth: session)
- [`POST /api/contact`](/llms-full.txt?prefix=%2Fapi%2Fcontact): Talks to support: a human solves Turnstile, an agent pays $0.10 in x402. (auth: none)
- [`POST /api/visit`](/llms-full.txt?prefix=%2Fapi%2Fvisit): Ping from the interface that increments the day's visits. Agents need not call it. (auth: none)
- [`POST /api/pagamento/aberto`](/llms-full.txt?prefix=%2Fapi%2Fpagamento%2Faberto): The interface reports a visible payment prompt. Agents must not call this route. (auth: none)
- [`GET /api/vitrine`](/llms-full.txt?prefix=%2Fapi%2Fvitrine): The product's public numbers: traffic, agents, usage and reliability, no money. (auth: none)
- [`GET /api/vitrine/operador`](/llms-full.txt?prefix=%2Fapi%2Fvitrine%2Foperador): The product's full document on the operator panel — operator token only. (auth: none)
- [`GET /api/vitrine/painel`](/llms-full.txt?prefix=%2Fapi%2Fvitrine%2Fpainel): The whole house panel, in the shape the gm reads — operator token only. (auth: none)
- [`GET /api/vitrine/cursores`](/llms-full.txt?prefix=%2Fapi%2Fvitrine%2Fcursores): The resolved-error cursor per product (`borda`, `cli`) — operator token only. (auth: none)
- [`GET /api/partners`](/llms-full.txt?prefix=%2Fapi%2Fpartners): Partnership, sponsorship and advertising: the product's placements with a suggested price, the public numbers next to them and how to propose. (auth: none)
- [`GET /api/metrics`](/llms-full.txt?prefix=%2Fapi%2Fmetrics): Metrics of the last 7 days and the most frequent findings across audits. With the operator token, includes payments. (auth: none)
- [`POST /api/credito`](/llms-full.txt?prefix=%2Fapi%2Fcredito): Top up prepaid credit: pay once with x402 and get the token that debits on any API of the house. (auth: none)
- [`GET /api/credito`](/llms-full.txt?prefix=%2Fapi%2Fcredito): Credit balance and statement — the latest movements, without returning the token. (auth: credito)
- [`GET /api/pricing`](/llms-full.txt?prefix=%2Fapi%2Fpricing): Current prices and free allowances. (auth: none)