AnmeldenKostenlos starten

The HTTP API

Public sample scans, authenticated access to your sites, and the private AX Rush engine. Use HTTP from your application or CI with the same capabilities available through MCP.

Diese Dokumentation ist in englischer Sprache verfasst.

The public API

Free, no key

No authentication and no account. Described by an OpenAPI 3.1 specification the site serves about itself; a test holds that specification against the routes that exist on disk, so what it promises is what runs.

Read the OpenAPI specification

POST /api/v1/scan

Measure a domain

Runs the checks against the site's home page and returns the score, the grade and every finding. Rate limited per caller and per target, because a scan sends real requests to somebody else's server.

curl -X POST https://axrush.com/api/v1/scan \
  -H "content-type: application/json" \
  -d '{"domain":"example.com"}'

GET /api/v1/report/{host}

Read a stored report

Returns the most recent public measurement without scanning again. Sends no traffic to the measured site and is not rate limited.

curl https://axrush.com/api/v1/report/example.com

GET /api/v1/agent-tasks/{host}

Read published agent task replays

Returns what an agent was asked to do on a site, whether it could, and what it reported. Only the runs the site's owner chose to publish are visible.

curl https://axrush.com/api/v1/agent-tasks/example.com

POST /api/v1/channel

Read a public YouTube channel

Reads a YouTube channel by handle or URL through the platform's public API and returns 8 verdicts rather than a score: identity, about, contact, hub, keywords, captions, chapters, naming. Checks that need a declared identity come back not applicable. Nothing is stored. Rate limited per caller and per account, because the read spends a shared API quota.

curl -X POST https://axrush.com/api/v1/channel \
  -H "content-type: application/json" \
  -d '{"handle":"@midudev"}'

Your sites, authenticated

Paid plan

Authenticated endpoints cover websites, social identities, exact channels, context and Answers. Each operation checks its own permissions, role, plan and revisions. Reading saved results never starts a paid execution.

Every endpoint below takes an organization API key as a bearer token and is part of the paid plan. Sign in, then create keys on your account page

Every request carries the key as a bearer token:

curl -H "authorization: Bearer axr_..." \
  https://axrush.com/api/v1/me/sites

Read every page

Pass limit (1–50, default 20) and offset (0–10000, default 0). Continue with nextOffset as the next offset, keeping the same limit, until it is null. On /me/sites, omit both parameters to keep the existing unpaged response. On /history, omit both to keep the existing 100-scan default. New lists default to 20. pass_id selects an Answers pass independently of the listed page; run_id selects one agent run and ignores pagination.

curl --fail-with-body -H "authorization: Bearer $AXRUSH_API_KEY" \
  "https://axrush.com/api/v1/me/sites/$SITE_ID/history?limit=20&offset=0"

Verify what changed

Omit both scan ids to compare the latest two finished scans, or supply both in chronological order. Read comparable and warnings before interpreting scoreDelta: changes in engine version, measured pages or applicability can prevent a fair comparison. Check differences describe the origin only. Answers, verification records and agent runs are read-only through these endpoints.

curl --fail-with-body -H "authorization: Bearer $AXRUSH_API_KEY" \
  "https://axrush.com/api/v1/me/sites/$SITE_ID/compare?before_scan_id=$BEFORE_SCAN_ID&after_scan_id=$AFTER_SCAN_ID"

Reports expose scope, checksScope, pageCount and informational checks. discoveredUrls counts discovery, not measured pages. For compatibility, v1 retains numeric scores for N/A checks: always inspect applicable before treating a score as a failure. Existing field names, including score, scannedAt and history finishedAt, are unchanged.

A CI gate that says what to fix

Trigger a scan after a deploy, poll until it settles, and fail the build when the score falls below your bar. A failing gate prints the work list, so the log says what to fix rather than only that something is wrong:

set -eu
SCAN=$(curl --fail-with-body -sS -X POST -H "authorization: Bearer $AXRUSH_API_KEY" \
  "https://axrush.com/api/v1/me/sites/$SITE_ID/scan" | jq -er .scanId)

for attempt in $(seq 1 60); do
  BODY=$(curl --fail-with-body -sS -H "authorization: Bearer $AXRUSH_API_KEY" \
    "https://axrush.com/api/v1/me/scans/$SCAN")
  STATUS=$(echo "$BODY" | jq -er .status)
  [ "$STATUS" = queued ] || [ "$STATUS" = running ] || break
  sleep 5
done

[ "$STATUS" = succeeded ] || { echo "Scan failed or timed out: $STATUS"; exit 1; }
SCORE=$(echo "$BODY" | jq -er .report.score)
[ "$SCORE" -ge 90 ] || {
  echo "score $SCORE fell below 90; what to fix first:"
  curl --fail-with-body -sS -H "authorization: Bearer $AXRUSH_API_KEY" \
    "https://axrush.com/api/v1/me/sites/$SITE_ID/fixes" \
    | jq -r '.fixes[] | select(.gain > 0) | "  +\(.gain)  \(.checkId)  \(.headline)"'
  exit 1
}

Run the private engine

Paid plan

POST /api/v1/engine/audit executes an audit on AX Rush servers. This is the endpoint used by ax-audit 6. Send an organization API key with an active paid subscription; every audit verifies access again.

curl --fail-with-body https://axrush.com/api/v1/engine/audit \
  -H "authorization: Bearer $AXRUSH_API_KEY" \
  -H "content-type: application/json" \
  -d '{"url":"https://example.com","profile":"auto"}'

Required: url. Optional: checks (1–26 check ids), profile (auto, api, mcp, agent, docs, commerce or all), timeout (100–10000 ms per request), and retries (0–2). The response is an AuditReport with overallScore, results and engine. It is not saved to your site history; use /api/v1/me/sites/SITE_ID/scan for a stored site scan.

Only public HTTP(S) URLs on ports 80 and 443 are accepted. Localhost and private networks are unavailable because execution is remote. Requests are limited to 8 KiB, 10 audits per organization per hour and 5 per target per hour, with target limits shared across scan surfaces. A 429 response includes Retry-After.

Handle errors

Check the HTTP status before reading a successful response. Errors contain error and message: 400 for invalid input, 401 for a missing or revoked key, 403 for insufficient access, 404 for unavailable owned data, 409 when a social account must first be connected in the panel, 413 for a body over 8 KiB on the scan, channel and engine endpoints, 429 for rate limits, 500 when a scan or a reading could not be queued, 502 when a public scan cannot measure the site, and 503 when a read or remote execution is temporarily unavailable. Asking for a scan of a site that already has one in flight answers 202 with that scan. Private responses are not cached.