Open navigation menu
CertScore.ai Pulse API beta
Retrieve a quick, evidence-backed CertScore.ai summary for a public URL. Pulse API beta is designed for AI agents, developer tools, CLIs, and humans that need a compact scan summary with links to the durable full report.
CertScore.ai Pulse uses automated runtime analysis of public websites to detect review signals around pre-consent tracking, third-party requests, consent enforcement gaps, cookie activity, accessibility issues, and disclosure inconsistencies.
CertScore.ai outputs are automated public-web observations for human and agentic review. They are not legal advice, certification, or a compliance determination. Always review the underlying evidence and consult qualified experts where appropriate.
For AI agents
Try CertScore.ai GPT beta
Paste a public website URL and get a CertScore.ai Pulse summary inside ChatGPT. Automated observations for human and agentic review, not legal advice or a compliance determination.
Open CertScore.ai GPT betaIf you are an agent with OpenAPI actions or HTTP tools, start here before trying ad hoc fetches. CertScore.ai Pulse works best when agents call Summary JSON or markdown for user-facing summaries and reserve Evidence JSON for evidence-heavy review.
Basic HTTP agent quick start: 1. If you do not support OpenAPI actions, call: GET https://certscore.ai/api/v1/pulse?url=<public URL>&format=markdown&detail=standard 2. For a quick check, call: GET https://certscore.ai/api/v1/pulse?url=<public URL>&format=markdown&detail=tiny 3. For structured evidence, call: GET https://certscore.ai/api/v1/pulse?url=<public URL>&format=json&detail=evidence 4. If you receive HTTP 202, read the returned statusUrl or poll: GET https://certscore.ai/api/v1/pulse/status/<jobId> 5. If the request fails before status/body/headers are visible, open: https://certscore.ai/api-pulse-agent-guide.txt
Recommended calls: - User-facing summary: GET /api/v1/pulse?url=https://kbdlab.io&format=markdown&detail=standard - Quick machine triage: GET /api/v1/pulse?url=https://kbdlab.io&detail=tiny - Evidence/deeper review: GET /api/v1/pulse?url=https://kbdlab.io&detail=evidence - Connectivity check: GET /api/v1/pulse-self-test - Health check: GET /api/v1/pulse-health Summary JSON is best for concise agent output. Markdown is best for conversational summaries. Tiny is best for badges, triage, and routing. Evidence JSON is best for evidence review and coverage diagnostics. Self-test is best for deployment and agent connectivity checks.
OpenAPI / GPT Action beta quick start: 1. If you support OpenAPI actions/tools, import: https://certscore.ai/api/v1/openapi.chatgpt.json 2. Call getPulseForUrl with: url: <public URL> format: markdown detail: standard scanFrom: eu_ie wait: 35 3. Use detail=tiny for quick checks. 4. Public GPT Action beta access uses latest-mode summaries. Use Evidence JSON or the linked CertScore.ai report when users need more support. 5. If API fetch fails before headers/body/status are visible, call checkPulseConnectivity once. 6. If checkPulseConnectivity succeeds, treat the scan failure as a transient client/action transport error and retry or use the markdown endpoint. 7. If checkPulseConnectivity also fails without CertScore.ai diagnostic headers, do not infer CertScore.ai returned an error. Report it as a client/network fetch limitation and read /api-pulse/agent and /api-pulse-agent-guide.txt.
Agent fetch limitations: Some agent environments may fail before receiving an HTTP response because of DNS, sandbox, TLS, proxy, or fetch-layer limitations. If a request fails before exposing an HTTP status, response body, or x-certscore-* diagnostic headers, do not conclude CertScore.ai Pulse is unavailable. First try /api/v1/pulse-self-test, /api/v1/pulse-health, /api-pulse-agent-guide.txt, /.well-known/certscore-pulse, and /api/v1/openapi.chatgpt.json.
Developer hub
Pulse v1 remains the compatibility entry point. For the resource-oriented CertScore.ai API v2, TypeScript SDK, MCP server, examples, and machine-readable discovery links, use the developer hub. For structured Pre-consent Cookies & Trackers table data, use API v2 instead of parsing Pulse prose or report HTML.
MCP preview
CertScore.ai MCP is a developer-preview stdio server for teams that want to run Pulse checks inside AI development, security, and ops workflows. It uses the same evidence-backed Pulse surface: automated public-web observations for review, with stable scan and finding IDs.
certscore_scan_site
Creates a public-website privacy scan or reuses an eligible recent completed scan. Coverage includes pre-consent storage, trackers, consent and CMP signals, privacy-policy disclosures, transport security, and GDPR/ePrivacy or CCPA/CPRA review signals. The response contains a stable scanId, lifecycle status, retry timing, and sometimes a bounded preliminary preConsentPreview; preliminary data contains no final findings or score. Results are automated public-web observations, not legal advice, certification, or a compliance determination. Tool and workflow documentation: https://certscore.ai/developers/mcp.
certscore_get_scan
Retrieve the API v2 public-safe scan resource, including completed-limited no-go disposition, reason-specific guidance, and timing when available.
certscore_get_scan_status
Returns lifecycle status for a stable CertScore scanId. Active responses include phase, heartbeat, estimated progress, retryAfterSeconds, and sometimes a bounded preliminary preConsentPreview. Terminal responses include completion status, CertScore score and risk metadata when available, coverage, persisted execution region and timestamps, report URL, and a next-action field. Preliminary observations are distinct from completed findings.
certscore_get_report
Focused follow-up: retrieve a bounded Pulse report with high-signal TextContent and typed structuredContent, including customer-safe no-go messaging. For broad privacy questions, use certscore_get_scan_bundle first because it combines canonical findings, limitations, and pre-consent rows without redundant calls.
certscore_get_evidence
Focused follow-up: retrieve a bounded public-safe evidence packet with a concise TextContent digest and typed structuredContent. For broad privacy questions, use certscore_get_scan_bundle first. Excludes raw cookie values, raw bodies, sensitive payloads, full DOM, and unredacted query values.
certscore_get_scan_bundle
Returns the completed or completed-limited CertScore evidence bundle for a stable scanId as concise TextContent and matching structuredContent. Available sections include the canonical report overview, bounded projected findings, pre-consent cookie and tracker evidence, coverage limitations, persisted execution provenance, and retrieval URLs. Detail tiers and byte budgets control the bounded response, with explicit returned, total, truncated, and omitted-section metadata. Accept and Reject results distinguish registered decisions from retained after-click facts. Optional afterAction summaries remain useful when registration is unconfirmed; absent or failed capture remains explicitly limited. Consume canonical findings for any scoring effect. Results are automated public-web observations, not legal advice, certification, or a compliance determination.
certscore_export_findings
Return structured findings plus completed-limited no-go disposition and guidance for downstream review or ticketing workflows.
certscore_list_findings
Focused follow-up: list bounded API v2 public-safe findings already projected by the canonical pipeline, with matching high-signal TextContent and typed structuredContent. For broad privacy questions, use certscore_get_scan_bundle first.
certscore_get_pre_consent_cookies_trackers
Focused follow-up: retrieve bounded row-level public-safe pre-consent cookie/tracker evidence with matching TextContent and typed structuredContent. For a new broad request such as checking a site for pre-consent tracking, use certscore_scan_site then certscore_get_scan_bundle first.
certscore_explain_finding
Explain one projected finding with public evidence, caveats, reviewer next steps, and reason-specific no-go context when applicable.
certscore_get_latest_domain_scan
Retrieve the latest eligible API v2 public-safe scan for a domain.
certscore_get_latest_domain_pre_consent_cookies_trackers
Focused follow-up: retrieve bounded row-level public-safe pre-consent cookie/tracker evidence from the latest eligible scan for a domain, with matching TextContent and typed structuredContent. For a broad current-site review, use certscore_scan_site then certscore_get_scan_bundle first.
The first preview is intentionally narrow: create a scan, check status, retrieve a report, export findings, and explain a specific finding. Account browsing and drift comparison tools are not part of the initial MCP scope.
Local stdio preview: CERTSCORE_API_KEY=<token> pnpm mcp:certscore Optional: CERTSCORE_BASE_URL=https://certscore.ai CERTSCORE_REQUEST_TIMEOUT_MS=300000 Live smoke: CERTSCORE_API_KEY=<token> pnpm mcp:certscore:smoke Generate preview key: pnpm db:migrate pnpm mcp:certscore:generate-key -- --name "CertScore.ai MCP preview"
Example MCP client config:
{
"mcpServers": {
"certscore": {
"command": "pnpm",
"args": ["mcp:certscore"],
"cwd": "/path/to/CertScore.ai",
"env": {
"CERTSCORE_API_KEY": "YOUR_TOKEN",
"CERTSCORE_BASE_URL": "https://certscore.ai"
}
}
}
}Recommended workflow: call `certscore_scan_site` with a public URL. A new scan returns its stable scanId and may include a partial preConsentPreview when the runtime lane completes or reaches its six-second checkpoint. Captured totals are separate from bounded returned identities, and operational/security/consent vendors are separate from trackingVendorCount. Continue with `certscore_get_scan_status` while the scan is active, then use `certscore_list_findings` or `certscore_explain_finding` for review and ticketing. Fetch report, evidence, and cookie inventory resources only when the task needs them.
Preview keys are scoped to `pulse:read`, `pulse:scan`, and `mcp`; CertScore.ai validates bearer tokens before request attribution and rate-limit policy, without changing evidence, concern, finding, or projection logic.
Operators should apply the integration-key migration, generate a scoped preview key, and run authenticated MCP smoke before promoting the preview beyond internal use.
Quick start
GET https://certscore.ai/api/v1/pulse?url=https://kbdlab.io
If a completed eligible scan exists within the 24-hour reuse window, the API returns that completed Pulse. If no completed scan exists within that UTC-normalized window, the API may queue a new scan and return HTTP 202 with `jobId`, `statusUrl`, `nextCheckUrl`, and any `scanId` available for the queued scan.
Copy/paste examples
curl "https://certscore.ai/api/v1/pulse?url=https://kbdlab.io&detail=tiny"
curl "https://certscore.ai/api/v1/pulse?url=https://kbdlab.io"
curl "https://certscore.ai/api/v1/pulse?url=https://kbdlab.io&detail=evidence"
curl "https://certscore.ai/api/v1/pulse?url=https://kbdlab.io&format=markdown"
curl "https://certscore.ai/api/v1/pulse?url=https://kbdlab.io&freshness=refresh"
curl "https://certscore.ai/api/v1/pulse?url=https://kbdlab.io&forceNewScan=true"
curl "https://certscore.ai/api/v1/pulse?url=https://kbdlab.io&wait=35"
curl "https://certscore.ai/api/v1/pulse/status/<jobId>"
curl "https://certscore.ai/api/v1/pulse-self-test"
curl "https://certscore.ai/api/v1/pulse-health"
Parameters
url
Public URL or domain to summarize. Use this for first-time or latest-domain lookup.
scanId
Existing public eligible scan ID. Use this later for an immutable scan-backed Pulse response.
jobId
Existing Pulse job ID. Use this to resolve or check an async Pulse request.
format
`json` or `markdown`. Defaults to `json`.
detail
`summary`, `evidence`, `tiny`, `quick`, `standard`, or `full`. Defaults to `summary`. `quick` is an alias for `tiny`.
freshness
`latest` or `refresh`. Defaults to `latest`.
scanFrom
`eu_ie`. Selects the geo execution context for newly queued public scans. Defaults to `eu_ie`.
geo
Alias for `scanFrom`; accepts `eu_ie`.
forceNewScan
`true` or `1` bypasses the 24-hour recent-scan reuse check. It does not bypass throttles or validation.
wait
Integer seconds from 0 to 80. This is only the maximum HTTP hold window for the current request; total queue plus scan time can be longer when workers are busy.
Detail levels
detail=summary
Default agent-friendly JSON artifact with executive metrics, surfaced results, key counts, and links.
detail=evidence
Bounded structured evidence packet for human and agentic review. Includes projected findings, GDPR/ePrivacy checklist rows, tracker/cookie inventories, timing summaries, and safety notes without raw payloads.
detail=tiny
Quick compact summary for badges, CLI output, widgets, and simple agents.
detail=quick
Alias for `detail=tiny`. Responses normalize to the tiny shape.
detail=standard
Backward-compatible report projection for quick evidence-backed summaries.
detail=full
Structured public report projection with more findings, review lenses, vendor/domain summaries, policy surfaces, fingerprinting context, interruptions, coverage diagnostics, and benchmark context. It does not expose raw internal artifacts.
Response examples
200 completed tiny JSON
{
"type": "certscore_pulse",
"meta": {
"apiVersion": "v1",
"schemaVersion": "0.5.5",
"pulseVersion": "2026-05-18",
"projectionVersion": "pulse-public-v4",
"generatedAt": "2026-05-18T23:15:32Z",
"source": "certscore.ai",
"format": "json",
"detail": "tiny"
},
"domain": "kbdlab.io",
"scanId": "scan_abc123",
"scanStatus": "completed",
"summary": {
"headline": "Automated scan surfaced consent-timing and third-party collection review signals.",
"score": 72,
"riskLevel": "review_recommended"
},
"topFindings": [
{
"id": "pre_consent_tracking_detected",
"label": "Tracking started before consent",
"criticality": "critical",
"confidence": "strong"
}
],
"coverage": {
"status": "partial",
"summary": "Automated public-web scan completed with coverage limitations."
},
"links": {
"canonicalPulseUrl": "https://certscore.ai/pulse/kbdlab.io",
"jsonUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123",
"markdownUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123&format=markdown",
"summaryJsonUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123&detail=summary",
"evidenceJsonUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123&detail=evidence",
"fullJsonUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123&detail=full",
"fullReportUrl": "https://certscore.ai/scan/scan_abc123",
"docsUrl": "https://certscore.ai/api-pulse",
"findingsReferenceUrl": "https://certscore.ai/findings"
},
"feedback": {
"prompt": "Was this Pulse useful?",
"email": "[email protected]",
"feedbackUrl": "https://certscore.ai/pulse/feedback?pulseRequestId=pulse_req_123",
"positiveUrl": "https://certscore.ai/pulse/feedback?pulseRequestId=pulse_req_123&rating=useful",
"negativeUrl": "https://certscore.ai/pulse/feedback?pulseRequestId=pulse_req_123&rating=not_useful"
},
"capabilities": {
"method": "automated_runtime_analysis",
"observes": [
"pre_consent_tracking",
"third_party_requests",
"consent_enforcement_gaps",
"cookie_activity",
"accessibility_signals",
"disclosure_inconsistencies"
],
"doesNotProvide": [
"legal_advice",
"certification",
"compliance_determination"
]
},
"agentInterpretation": {
"responseClass": "completed_pulse",
"safeSummaryUse": true,
"requiresHumanReview": true,
"doNotCallThis": [
"legal_advice",
"certification",
"compliance_determination"
]
},
"disclaimer": "CertScore.ai outputs are automated public-web observations for human and agentic review. They are not legal advice, certification, or a compliance determination. Always review the underlying evidence and consult qualified experts where appropriate."
}200 completed standard JSON
{
"type": "certscore_pulse",
"meta": {
"apiVersion": "v1",
"schemaVersion": "0.5.5",
"pulseVersion": "2026-05-18",
"projectionVersion": "pulse-public-v4",
"generatedAt": "2026-05-18T23:15:32Z",
"source": "certscore.ai",
"format": "json",
"detail": "standard"
},
"request": {
"pulseRequestId": "pulse_req_123",
"url": "https://kbdlab.io",
"normalizedUrl": "https://kbdlab.io/",
"domain": "kbdlab.io",
"detail": "standard",
"format": "json",
"freshness": "latest",
"waitSeconds": 0,
"resolutionMode": "reused_existing_scan"
},
"scan": {
"scanId": "scan_abc123",
"scanStatus": "completed",
"completedAt": "2026-05-18T23:15:31Z"
},
"timestamps": {
"createdAt": "2026-05-18T23:14:22Z",
"startedAt": "2026-05-18T23:14:31Z",
"completedAt": "2026-05-18T23:15:31Z",
"generatedAt": "2026-05-18T23:15:32Z",
"lastUpdatedAt": "2026-05-18T23:15:31Z"
},
"freshness": {
"status": "fresh",
"ageSeconds": 4,
"ageHours": 0.001,
"maxRecommendedAgeHours": 168
},
"summary": {
"headline": "Automated scan surfaced consent-timing and third-party collection review signals.",
"score": 72,
"riskLevel": "review_recommended",
"humanSummary": "Automated scan surfaced consent-timing and third-party collection review signals."
},
"topFindings": [
{
"id": "pre_consent_tracking_detected",
"label": "Tracking started before consent",
"criticality": "critical",
"confidence": "strong",
"plainEnglish": "Runtime evidence showed non-essential tracking activity before a consent choice was recorded.",
"evidence": {
"summary": "A non-essential third-party tracking request was observed before the scan recorded a consent choice.",
"observedPhase": "before_consent",
"exampleEvents": [
{
"type": "request",
"vendor": "Example Analytics Vendor",
"urlHost": "analytics.example-vendor.test",
"timestampMs": 1137
}
],
"fullEvidenceUrl": "https://certscore.ai/scan/scan_abc123#finding-pre_consent_tracking_detected"
},
"evidenceDigest": {
"basis": "runtime_observation",
"phase": "before_consent",
"exampleCount": 2,
"examplesShown": 1,
"hasTimingAnchor": true,
"hasVendorAnchor": true,
"hasConsentContext": true
},
"reviewLenses": [
"GDPR / ePrivacy",
"FTC"
],
"anchorUrl": "https://certscore.ai/scan/scan_abc123#finding-pre_consent_tracking_detected",
"nextStep": "Review whether observed vendors are necessary before consent or should be consent-gated."
}
],
"coverage": {
"status": "partial",
"homepageObserved": true,
"summary": "Homepage findings are based on observable public-page evidence.",
"limitations": [
"Automated public-web scan only.",
"Coverage may be affected by bot defenses, geography, consent flow branching, lazy loading, protected routes, authenticated-only areas, or other runtime conditions. Absence of findings should not be interpreted as absence of risk."
]
},
"links": {
"canonicalPulseUrl": "https://certscore.ai/pulse/kbdlab.io",
"jsonUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123",
"markdownUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123&format=markdown",
"summaryJsonUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123&detail=summary",
"evidenceJsonUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123&detail=evidence",
"fullJsonUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123&detail=full",
"fullReportUrl": "https://certscore.ai/scan/scan_abc123",
"docsUrl": "https://certscore.ai/api-pulse",
"findingsReferenceUrl": "https://certscore.ai/findings"
},
"feedback": {
"prompt": "Was this Pulse useful?",
"email": "[email protected]",
"feedbackUrl": "https://certscore.ai/pulse/feedback?pulseRequestId=pulse_req_123",
"positiveUrl": "https://certscore.ai/pulse/feedback?pulseRequestId=pulse_req_123&rating=useful",
"negativeUrl": "https://certscore.ai/pulse/feedback?pulseRequestId=pulse_req_123&rating=not_useful"
},
"capabilities": {
"method": "automated_runtime_analysis",
"observes": [
"pre_consent_tracking",
"third_party_requests",
"consent_enforcement_gaps",
"cookie_activity",
"accessibility_signals",
"disclosure_inconsistencies"
],
"doesNotProvide": [
"legal_advice",
"certification",
"compliance_determination"
]
},
"agentInterpretation": {
"responseClass": "completed_pulse",
"safeSummaryUse": true,
"requiresHumanReview": true,
"doNotCallThis": [
"legal_advice",
"certification",
"compliance_determination"
]
},
"disclaimer": "CertScore.ai outputs are automated public-web observations for human and agentic review. They are not legal advice, certification, or a compliance determination. Always review the underlying evidence and consult qualified experts where appropriate."
}200 completed Evidence JSON
{
"type": "certscore_pulse_evidence",
"meta": {
"apiVersion": "v1",
"schemaVersion": "0.5.5",
"pulseVersion": "2026-05-18",
"projectionVersion": "pulse-public-v4",
"generatedAt": "2026-05-18T23:15:32Z",
"source": "certscore.ai",
"format": "json",
"detail": "evidence"
},
"domain": "kbdlab.io",
"scanId": "scan_abc123",
"scanStatus": "completed",
"findings": [
{
"id": "pre_consent_tracking_detected",
"label": "Tracking started before consent",
"criticality": "critical",
"confidence": "strong",
"plainEnglish": "Runtime evidence showed non-essential tracking activity before a consent choice was recorded.",
"evidence": {
"summary": "A non-essential third-party tracking request was observed before the scan recorded a consent choice.",
"observedPhase": "before_consent",
"exampleEvents": [
{
"type": "request",
"vendor": "Example Analytics Vendor",
"urlHost": "analytics.example-vendor.test",
"timestampMs": 1137
}
],
"fullEvidenceUrl": "https://certscore.ai/scan/scan_abc123#finding-pre_consent_tracking_detected"
},
"evidenceDigest": {
"basis": "runtime_observation",
"phase": "before_consent",
"exampleCount": 2,
"examplesShown": 1,
"hasTimingAnchor": true,
"hasVendorAnchor": true,
"hasConsentContext": true
},
"reviewLenses": [
"GDPR / ePrivacy",
"FTC"
],
"anchorUrl": "https://certscore.ai/scan/scan_abc123#finding-pre_consent_tracking_detected",
"nextStep": "Review whether observed vendors are necessary before consent or should be consent-gated."
}
],
"reviewContext": {
"disclaimer": "Findings are organized by privacy, consumer protection, accessibility, and other review contexts. These are automated signals for human and agentic review, not legal determinations.",
"lenses": [
{
"name": "GDPR / ePrivacy",
"status": "needs_work",
"score": 28,
"contributingFindingIds": [
"pre_consent_tracking_detected"
]
}
]
},
"evidenceHighlights": {
"trackerFootprint": {
"thirdPartyDomainsObserved": 7,
"classifiedTrackerVendors": 2,
"summary": "7 third-party domains observed; 2 classified tracker vendors identified."
},
"policySurfaces": {
"policyUrlCount": 2,
"covered": [
"privacy_policy",
"terms_of_service"
]
}
},
"coverage": {
"status": "partial",
"interruptionCount": 1,
"interruptions": [
{
"label": "Access limited",
"reason": "Protected route encountered outside the public homepage."
}
],
"limitations": [
"Full mode is still a public report projection; raw internal artifacts are not included."
]
},
"links": {
"canonicalPulseUrl": "https://certscore.ai/pulse/kbdlab.io",
"jsonUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123",
"markdownUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123&format=markdown",
"summaryJsonUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123&detail=summary",
"evidenceJsonUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123&detail=evidence",
"fullJsonUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123&detail=full",
"fullReportUrl": "https://certscore.ai/scan/scan_abc123",
"docsUrl": "https://certscore.ai/api-pulse",
"findingsReferenceUrl": "https://certscore.ai/findings"
},
"feedback": {
"prompt": "Was this Pulse useful?",
"email": "[email protected]",
"feedbackUrl": "https://certscore.ai/pulse/feedback?pulseRequestId=pulse_req_123",
"positiveUrl": "https://certscore.ai/pulse/feedback?pulseRequestId=pulse_req_123&rating=useful",
"negativeUrl": "https://certscore.ai/pulse/feedback?pulseRequestId=pulse_req_123&rating=not_useful"
},
"capabilities": {
"method": "automated_runtime_analysis",
"observes": [
"pre_consent_tracking",
"third_party_requests",
"consent_enforcement_gaps",
"cookie_activity",
"accessibility_signals",
"disclosure_inconsistencies"
],
"doesNotProvide": [
"legal_advice",
"certification",
"compliance_determination"
]
},
"agentInterpretation": {
"responseClass": "completed_pulse",
"safeSummaryUse": true,
"requiresHumanReview": true,
"doNotCallThis": [
"legal_advice",
"certification",
"compliance_determination"
]
},
"disclaimer": "CertScore.ai outputs are automated public-web observations for human and agentic review. They are not legal advice, certification, or a compliance determination. Always review the underlying evidence and consult qualified experts where appropriate."
}202 pending/running response
{
"type": "certscore_pulse_status",
"meta": {
"apiVersion": "v1",
"schemaVersion": "0.5.5",
"pulseVersion": "2026-05-18",
"projectionVersion": "pulse-public-v4",
"generatedAt": "2026-05-18T23:15:32Z",
"source": "certscore.ai",
"format": "json",
"detail": "standard"
},
"jobId": "pulse_job_123",
"scanId": "scan_abc123",
"domain": "kbdlab.io",
"status": "running",
"phase": "runtime_observation",
"message": "Observing public-page behavior and collecting automated evidence signals.",
"elapsedSeconds": 28,
"estimatedWaitSeconds": 45,
"statusUrl": "https://certscore.ai/api/v1/pulse/status/pulse_job_123",
"nextCheckUrl": "https://certscore.ai/api/v1/pulse/status/pulse_job_123",
"reportUrl": "https://certscore.ai/scan/scan_abc123",
"capabilities": {
"method": "automated_runtime_analysis",
"observes": [
"pre_consent_tracking",
"third_party_requests",
"consent_enforcement_gaps",
"cookie_activity",
"accessibility_signals",
"disclosure_inconsistencies"
],
"doesNotProvide": [
"legal_advice",
"certification",
"compliance_determination"
]
},
"agentInterpretation": {
"responseClass": "pending_pulse",
"safeSummaryUse": false,
"requiresHumanReview": true,
"doNotCallThis": [
"legal_advice",
"certification",
"compliance_determination"
]
},
"disclaimer": "CertScore.ai outputs are automated public-web observations for human and agentic review. They are not legal advice, certification, or a compliance determination. Always review the underlying evidence and consult qualified experts where appropriate."
}200 completed status response
{
"type": "certscore_pulse_status",
"jobId": "pulse_job_123",
"scanId": "scan_abc123",
"domain": "kbdlab.io",
"status": "completed",
"completedAt": "2026-05-18T23:15:31Z",
"resultUrl": "https://certscore.ai/api/v1/pulse?scanId=scan_abc123",
"reportUrl": "https://certscore.ai/scan/scan_abc123",
"capabilities": {
"method": "automated_runtime_analysis",
"observes": [
"pre_consent_tracking",
"third_party_requests",
"consent_enforcement_gaps",
"cookie_activity",
"accessibility_signals",
"disclosure_inconsistencies"
],
"doesNotProvide": [
"legal_advice",
"certification",
"compliance_determination"
]
},
"agentInterpretation": {
"responseClass": "completed_pulse",
"safeSummaryUse": true,
"requiresHumanReview": true,
"doNotCallThis": [
"legal_advice",
"certification",
"compliance_determination"
]
},
"disclaimer": "CertScore.ai outputs are automated public-web observations for human and agentic review. They are not legal advice, certification, or a compliance determination. Always review the underlying evidence and consult qualified experts where appropriate."
}429 rate-limit response
{
"type": "certscore_pulse_error",
"meta": {
"apiVersion": "v1",
"schemaVersion": "0.5.5",
"pulseVersion": "2026-05-18",
"projectionVersion": "pulse-public-v4",
"generatedAt": "2026-05-18T23:15:32Z",
"source": "certscore.ai"
},
"error": {
"code": "rate_limited",
"message": "This CertScore.ai API key has reached its Pulse request limit. Try again after the retry window or manage your plan.",
"retryAfterSeconds": 240
},
"resolution": {
"label": "Manage plan",
"url": "https://certscore.ai/app/modify-plan"
},
"feedback": {
"email": "[email protected]"
},
"agentInterpretation": {
"responseClass": "rate_limited",
"safeSummaryUse": false,
"requiresHumanReview": true,
"doNotCallThis": [
"legal_advice",
"certification",
"compliance_determination"
]
},
"disclaimer": "CertScore.ai outputs are automated public-web observations for human and agentic review. They are not legal advice, certification, or a compliance determination. Always review the underlying evidence and consult qualified experts where appropriate."
}400 invalid URL response
{
"type": "certscore_pulse_error",
"meta": {
"apiVersion": "v1",
"schemaVersion": "0.5.5",
"pulseVersion": "2026-05-18",
"projectionVersion": "pulse-public-v4",
"generatedAt": "2026-05-18T23:15:32Z",
"source": "certscore.ai"
},
"request": {
"url": "not-a-url",
"detail": "standard",
"format": "json"
},
"error": {
"code": "invalid_url",
"message": "Enter a valid public website URL or domain.",
"retryAfterSeconds": null
},
"feedback": {
"email": "[email protected]"
},
"agentInterpretation": {
"responseClass": "api_error",
"safeSummaryUse": false,
"requiresHumanReview": true,
"doNotCallThis": [
"legal_advice",
"certification",
"compliance_determination"
]
},
"disclaimer": "CertScore.ai outputs are automated public-web observations for human and agentic review. They are not legal advice, certification, or a compliance determination. Always review the underlying evidence and consult qualified experts where appropriate."
}Markdown response
# CertScore.ai Pulse | Field | Value | |---|---| | Domain | kbdlab.io | | Score | 72/100 | | Risk level | Review recommended | | High-priority findings | 1 | | Total observations | 3 | | Scan completed | 2026-05-18T23:15:31Z | | Coverage status | Partial | ## Summary Automated scan surfaced consent-timing and third-party collection review signals. ## Highest-priority findings 1. Tracking started before consent ## Privacy and consent signals - Tracker footprint: 7 third-party domains observed; 2 classified tracker vendors identified. ## Cookie and third-party request activity - Vendor mix: cdn infra 1 · session replay 1 ## Accessibility signals - Accessibility-related findings: 0 ## Disclosure and trust signals - Policy surfaces: 2 policy URLs covered. ## Coverage and limitations Coverage was limited; absence of findings should not be interpreted as absence of risk. ## Links Full report: https://certscore.ai/scan/scan_abc123 ## Disclaimer CertScore.ai outputs are automated public-web observations for human and agentic review. They are not legal advice, certification, or a compliance determination. Always review the underlying evidence and consult qualified experts where appropriate.
Async and status behavior
Status lifecycle: queued to running to finalizing to completed. Edge or terminal statuses include completed_limited, failed, expired, and rate_limited.
HTTP 202 means the scan or Pulse request is accepted but not complete. Clients should poll `statusUrl` or `nextCheckUrl`. `wait` accepts 0 to 80 seconds and may return a completed Pulse if the scan finishes during that window.
Pending HTTP 202 responses include `Retry-After` when CertScore.ai can recommend a polling delay. Throttled HTTP 429 responses include `Retry-After` when retry timing is known.
Estimated wait values are approximate. Queue backlog, worker availability, page load time, and scan finalization can make total completion take longer than 80 seconds.
queued -> running -> finalizing -> completed Other statuses: completed_limited, failed, expired, rate_limited Public-safe phase message: "Observing public-page behavior and collecting automated evidence signals."
Weighted scan-resource limits
Completed scan and domain resources use weighted, rolling limits. These protections apply in addition to account, API-key, and scan-creation quotas. Policy version 2026-08-14.
| Terminal-read scope | Rolling 10 minutes | Rolling 24 hours |
|---|---|---|
| Caller + scan/resource | 120 units | 1200 units |
| Scan/resource across callers | 4000 units | — |
| Caller across scans/resources | 480 units | — |
Read weights
- Ordinary scan, finding, inventory, or domain read: 1 unit.
- Evidence, full report, diagnostics, export, or composite bundle: 4 units.
- That permits 30 direct heavy reads per caller and resource in 10 minutes, and 300 in a rolling 24 hours.
Status polling
- Caller + scan: 120 units per rolling 10 minutes.
- Scan across callers: 10000 units per rolling 10 minutes.
- Caller across scans: 600 units per rolling 10 minutes.
HTTP 429 and MCP rate-limit errors include Retry-After when a retry time is available, plus machine-readable policy version, profile, scope, window, limit, usage, and requested-unit fields. Wait for that delay. Poll only active status resources and stop polling when a scan becomes terminal.
Freshness and throttling
`freshness=latest` returns the latest eligible completed Pulse when it was completed in the prior 24 hours. If no completed eligible scan exists within that UTC-normalized window, CertScore.ai may queue a new scan.
`freshness=refresh` requests a new scan when eligible and bypasses the 24-hour reuse check. `forceNewScan=true` is a compatibility override with the same reuse-bypass behavior. Scan generation is still limited to one new Pulse scan per normalized domain every one minute under the 1-minute normalized-domain throttle.
If refresh is throttled but a completed scan exists, CertScore.ai may return the latest completed Pulse with `refresh.requested=true`, `refresh.performed=false`, `refresh.reason="domain_throttle"`, and `refresh.retryAfterSeconds`. If no completed scan exists and scan creation is throttled, the API returns HTTP 429 with `Retry-After`, `error.code="pulse_throttled"`, and support contact guidance at [email protected].
Pulse uses `freshness=latest` and `freshness=refresh`; there is no separate `refresh=true` parameter. Broad `X-RateLimit-*` headers are not emitted unless the route has accurate enforced bucket state.
Durable scan handles
`scanId` is the canonical field name. `scan_id` may appear as a compatibility alias, but new integrations should use `scanId`.
https://certscore.ai/scan/<scanId> https://certscore.ai/api/v1/pulse?scanId=<scanId> https://certscore.ai/api/v1/pulse?scanId=<scanId>&detail=summary https://certscore.ai/api/v1/pulse?scanId=<scanId>&detail=evidence https://certscore.ai/api/v1/pulse?scanId=<scanId>&format=markdown
Markdown structure
Standard markdown starts with a compact summary table and stable headings so agents can parse it reliably without large JSON blocks.
# CertScore.ai Pulse | Field | Value | |---|---| | Domain | kbdlab.io | | Score | 72/100 | | Risk level | Review recommended | | High-priority findings | 1 | | Total observations | 3 | | Scan completed | 2026-05-18T23:15:31Z | | Coverage status | Partial | ## Summary ## Highest-priority findings ## Privacy and consent signals ## Cookie and third-party request activity ## Accessibility signals ## Disclosure and trust signals ## Coverage and limitations ## Links ## Disclaimer
Feedback
Pulse responses include feedback metadata when available. Direct comments can be sent to [email protected]. Feedback is private and used to improve CertScore.ai Pulse. No star ratings are used.
Supported ratings: `useful`, `not_useful`, `unclear`, `incorrect`, `too_limited`. Helpful reasons include incorrect finding, missing evidence, too much detail, not enough detail, coverage seemed limited, hard to understand, API issue, and other.
POST https://certscore.ai/api/v1/pulse/feedback
Content-Type: application/json
{
"pulseRequestId": "pulse_req_123",
"rating": "useful",
"reason": "not_enough_detail",
"comment": "Optional comment up to 2000 characters.",
"email": "[email protected]"
}The feedback endpoint validates rating and reason values, caps comments at 2000 characters, accepts an optional email field, and may return HTTP 429 when feedback is submitted too frequently for the same Pulse request context.
Interpreting findings
Pulse summarizes already-surfaced public report findings and review context. It does not create findings from raw signals, and absence of findings should not be interpreted as absence of risk. If no major findings are surfaced, Pulse says: “No top automated findings were surfaced in this scan.”
Coverage may be affected by bot defenses, geography, consent flow branching, lazy loading, protected routes, authenticated-only areas, or other runtime conditions. Absence of findings should not be interpreted as absence of risk.
For finding definitions, evidence standards, and reviewer questions, use the CertScore.ai findings reference.
Automated public-web observations for human and agentic review. Not legal advice, certification, or a compliance determination.