Open navigation menu
CertScore.ai API
Discover the CertScore.ai API, TypeScript SDK, and MCP server for evidence-backed website risk API workflows, privacy scan API use cases, cookie compliance scan API checks, and AI agent integrations.
CertScore.ai outputs are automated public-web observations for review. They are not legal advice, certification, or a compliance determination.
For AI agents
Agent quick path
- Read /llms.txt.
- Read /.well-known/certscore-ai.json.
- Fetch /api/v2/openapi.json.
- Check /api/v2/health before creating scan requests.
- Create or reuse a scan with POST /api/v2/scans; authentication is optional for up to 20 new scans per requester IP per UTC day. Contact [email protected] for higher volume.
- Poll status and honor Retry-After.
- Retrieve findings and pre-consent cookies/trackers.
- Treat outputs as automated public-web observations for review, not legal advice, certification, or a compliance determination.
Start here
One public integration surface for humans and agents.
Canonical links
Machine-readable discovery
API key access
Get an API key
Use a scoped bearer API key for the REST API, TypeScript SDK, or MCP server. Read-only + MCP access is self-serve for signed-in verified users through POST /api/v2/keys/request. Request scan:create preview access at [email protected]. Include your organization, intended workflow, expected request volume, and requested scopes.
Agents that do not have an account can use POST /api/v2/scans without a bearer token. New anonymous scans are limited to 20 per requester IP per UTC day; recent-result reuse does not consume that quota. Every response points higher-volume users to [email protected].
API v2
Resource-oriented routes
| Method | Route | Purpose |
|---|---|---|
| POST | /api/v2/keys/request | Issue a self-serve read-only + MCP key for a signed-in verified user. |
| GET | /api/v2/auth/check | Validate a bearer credential and return its granted scopes without creating a scan. |
| POST | /api/v2/scans | Create or reuse a public scan; authentication is optional for 20 new anonymous scans per requester IP per UTC day. |
| GET | /api/v2/scans/{scanId} | Retrieve the public-safe scan resource. |
| GET | /api/v2/scans/{scanId}/diagnostics | Retrieve bounded scan timing and collection diagnostics. |
| GET | /api/v2/scans/{scanId}/status | Check scan or job status without inferring from partial evidence. |
| GET | /api/v2/scans/{scanId}/findings | List already-projected public findings for a scan. |
| GET | /api/v2/scans/{scanId}/findings/{findingId} | Retrieve one public-safe finding and capped evidence summary. |
| GET | /api/v2/scans/{scanId}/pulse | Retrieve the Pulse projection wrapper for a completed public scan. |
| GET | /api/v2/scans/{scanId}/pre-consent-cookies-trackers | Retrieve Pre-consent Cookies & Trackers report table data as public-safe JSON. |
| GET | /api/v2/domains/{domain}/latest | Find the latest eligible public scan for a domain. |
| GET | /api/v2/domains/{domain}/latest/pre-consent-cookies-trackers | Retrieve the latest-domain Pre-consent Cookies & Trackers table projection. |
| GET | /api/v2/health | Check API v2 discovery health. |
Agent workflow
Recommended request sequence
1. GET https://certscore.ai/api/v2/health
2. GET https://certscore.ai/api/v2/openapi.json
3. POST https://certscore.ai/api/v2/scans
4. GET https://certscore.ai/api/v2/scans/{scanId}/status
5. GET https://certscore.ai/api/v2/scans/{scanId}/findings
6. GET https://certscore.ai/api/v2/domains/{domain}/latestThe API, SDK, and MCP server expose already-projected public-safe artifacts. They do not create findings from raw scanner evidence or turn display text into policy conclusions.
Search phrases
How this surface should be described
Developer support
Need an API key, endpoint, SDK helper, MCP tool, or docs fix?
Contact [email protected] for preview API keys, feature requests, broken examples, schema questions, integration issues, or missing API coverage. Include the route, SDK method, MCP tool, scan ID, requested scopes, expected volume, or page URL when useful.