API reference

Retrieve the completed report with GET /api/v2/scans/{scanId}/report-evidence. Follow its cursor for all entries, or request ?format=download for report-display JSON. Retained forms include field metadata, evidence references, capture status and snapshot links. Resolve reportContentRef pointers within the document; images are separate downloads.

Add workpaper=tracking for the starting-page tracking inventory, observed privacy choices, notice passages and GPC evidence. The response includes JSON and CSV download links; preserve the workpaper selector on cursor continuation. Workspace access and existing read quotas apply. Scan resources expose privacyAuditEvidence and gpcResponse.activityComparison when retained.

Public reports and workspace reports keep their existing access boundaries. Full-site exports include retained additional-page forms only after the crawl completes. Missing or withheld snapshots remain unavailable. Inventory review labels do not establish a finding or consent validity.

Reports provide verified, masked form crops when screenshot capture succeeds; not every detected form has a screenshot. A declared/configured destination is the form action, not evidence that CertScore.ai submitted the form or observed a transfer.

GET https://certscore.ai/api/v2/openapi.json

The OpenAPI contract uses stable operation IDs, explicit status examples, error examples, retry guidance, and public-safe evidence language for generic AI agents and developer tools.

Pulse is CertScore.ai's compact public projection for agents and developer workflows. It packages the scan summary, top findings, evidence highlights, caveats, links, and disclaimer text derived from the same already-projected public scan resources and findings. API v2 exposes the scan resource as the durable object, while the Pulse wrapper is useful when an agent needs the report-style projection in one response. Response types such as certscore_pulse and certscore_pulse_evidence refer to that projection.

None of these fields expresses a legal conclusion. They are automated observations with retained evidence for human and agentic review.

GET /api/v2/scans/{scanId}/pre-consent-cookies-trackers
GET /api/v2/domains/{domain}/latest/pre-consent-cookies-trackers

{
  "type": "certscore_pre_consent_cookies_trackers",
  "summary": {
    "rowCount": 12,
    "trackerCount": 6,
    "cookieCount": 8,
    "requestCount": 10
  },
  "rows": [
    {
      "kind": "cookie",
      "vendor": "Google",
      "host": "doubleclick.net",
      "purpose": "Advertising",
      "phase": "pre_consent",
      "evidenceBasis": "public_report_projection"
    }
  ]
}

This endpoint exposes the public report projection used for the Pre-consent Cookies & Trackers table. It strips cookie values, raw request bodies, full request URLs, sensitive query strings, internal artifacts, and scanner-only details. The initial version returns the complete table; server-side filters are deferred while integrations validate usage. Clients can group or filter rows by kind, priority, party, vendor, purpose, and host.

Authorization: Bearer <token>

Current scopes:
- scan:read
- scan:create
- mcp

Authentication is optional for low-volume scan creation: unauthenticated POST /api/v2/scanspermits up to 20 new scans per requester IP per UTC day, and eligible recent-result reuse is free. Contact [email protected] for a higher-volume allowance. Scoped integrations use bearer API keys. Read-only + MCP keys are self-serve for signed-in verified users through POST /api/v2/keys/request. Scan creation keys remain developer-preview; request those at [email protected] with your organization, integration type, expected volume, and requested scopes. Self-serve keys expire after 90 days, are prefixed cs_ro_, and are capped at 60 requests/minute and 500 scan reads/day. HTTP 202 pending responses and HTTP 429 throttled responses may include Retry-After; agents and SDKs should honor that value rather than tight polling.

{
  "type": "certscore_api_error",
  "error": {
    "code": "not_found",
    "message": "Scan not found."
  },
  "links": {
    "docs": "https://certscore.ai/developers/reference"
  }
}

HTTP 401
{
  "type": "certscore_api_error",
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key."
  }
}

HTTP 429
Retry-After: 60
{
  "type": "certscore_api_error",
  "error": {
    "code": "rate_limited",
    "message": "Retry later.",
    "retryAfterSeconds": 60
  }
}

HTTP 500
{
  "type": "certscore_api_error",
  "error": {
    "code": "internal_error",
    "message": "CertScore.ai API v2 is temporarily unavailable."
  }
}

API v2 exposes scan resources, status, already-projected findings, public-safe evidence summaries, latest-domain lookup, and report-ready review context. It does not expose raw DOM, raw request bodies, internal scanner artifacts, internal reasoning, or display-only findings. Failed or partial scans should be surfaced as incomplete evidence, not compliance failures. Do not infer legal conclusions from scan output.