Documentation

Every request must carry an API key. Generate one from your dashboard — the full key is shown once at creation time, so store it securely. Keys are scoped to your organization. Live keys start with ak_live_.

Pass the key in either header — both are accepted:

curl https://go.agentchecker.ai/api/v1/scan \
  -X POST \
  -H "X-API-Key: ak_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

# or, equivalently:
  -H "Authorization: Bearer ak_live_your_key_here"

Requests without a valid key return 401. A key on a plan that no longer includes API access returns 403. Revoke a key any time from the dashboard; revocation takes effect immediately.

Each API key is limited to 30 requests per minute. Every response includes X-RateLimit-Limit and X-RateLimit-Remaining. When you exceed the limit you get 429 Too many requests with a Retry-After header (seconds to wait).

Runs the deterministic quick check against a URL and returns the full set of agent-readiness signals. This does not consume behavioural audit credits.

{
  "url": "https://example.com",   // required
  "industry": "ecommerce"          // optional, helps tailor checks
}

{
  "url": "https://example.com",
  "industry": null,
  "summary": {
    "passed": 12,
    "failed": 3,
    "warnings": 2,
    "notApplicable": 1
  },
  "sources": {
    "webmcp":          { "checks": [ /* ReadinessCheck[] */ ] },
    "google":          { "checks": [ ... ] },
    "agent-protocols": { "checks": [ ... ] },
    "accessibility":   { "checks": [ ... ] }
    // ...one entry per check source that applied
  },
  "standards_coverage": { /* per-standard pass summary, or null */ },
  "generated_at": "2026-07-10T12:00:00.000Z"
}

Register an HTTPS endpoint from your dashboard to be notified when audits finish. The signing secret (prefix whsec_) is shown once at creation. Currently one event is emitted:

• audit.completed — fired when a full audit finishes and its report is ready.

Delivery request

We POST JSON to your URL with these headers (HTTPS only, 10s timeout, no redirects):

X-AgentChecker-Event: audit.completed
X-AgentChecker-Signature: sha256=<hex>
Content-Type: application/json
User-Agent: AgentChecker-Webhooks/1.0

{
  "event": "audit.completed",
  "created_at": "2026-07-10T12:00:00.000Z",
  "data": {
    "audit_id": "aud_...",
    "url": "https://example.com",
    "business_name": "Example Inc",
    "pass_rate": 0.78,
    "overall_score": 7,
    "passed_count": 12,
    "warning_count": 2,
    "critical_count": 3,
    "site_id": "site_..."
  }
}

Verifying the signature

The signature is an HMAC-SHA256 of the raw request body, keyed with your webhook secret, hex-encoded and prefixed with sha256=. Compare it in constant time:

import crypto from 'node:crypto';

function verify(rawBody, header, secret) {
  const expected =
    'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected));
}

Errors are returned as JSON with an appropriate status code:

{ "error": "Human-readable message" }