API reference

GET https://certscore.ai/api/v2/openapi.json

The OpenAPI contract uses stable operation IDs, explicit status examples, error examples, retry guidance, and public-safe evidence language for generic AI agents and developer tools.

Pulse is CertScore.ai's compact public projection for agents and developer workflows. It packages the scan summary, top findings, evidence highlights, caveats, links, and disclaimer text derived from the same already-projected public scan resources and findings. API v2 exposes the scan resource as the durable object, while the Pulse wrapper is useful when an agent needs the report-style projection in one response. Response types such as certscore_pulse and certscore_pulse_evidence refer to that projection.

GET /api/v2/scans/{scanId}/pre-consent-cookies-trackers
GET /api/v2/domains/{domain}/latest/pre-consent-cookies-trackers

{
  "type": "certscore_pre_consent_cookies_trackers",
  "summary": {
    "rowCount": 12,
    "trackerCount": 6,
    "cookieCount": 8,
    "requestCount": 10
  },
  "rows": [
    {
      "kind": "cookie",
      "vendor": "Google",
      "host": "doubleclick.net",
      "purpose": "Advertising",
      "phase": "pre_consent",
      "evidenceBasis": "public_report_projection"
    }
  ]
}

This endpoint exposes the public report projection used for the Pre-consent Cookies & Trackers table. It strips cookie values, raw request bodies, full request URLs, sensitive query strings, internal artifacts, and scanner-only details. The initial version returns the complete table; server-side filters are deferred while integrations validate usage. Clients can group or filter rows by kind, priority, party, vendor, purpose, and host.

Authorization: Bearer <token>

Current scopes:
- scan:read
- scan:create
- mcp

Authentication is optional for low-volume scan creation: unauthenticated POST /api/v2/scanspermits up to 20 new scans per requester IP per UTC day, and eligible recent-result reuse is free. Contact [email protected] for a higher-volume allowance. Scoped integrations use bearer API keys. Read-only + MCP keys are self-serve for signed-in verified users through POST /api/v2/keys/request. Scan creation keys remain developer-preview; request those at [email protected] with your organization, integration type, expected volume, and requested scopes. Self-serve keys expire after 90 days, are prefixed cs_ro_, and are capped at 60 requests/minute and 500 scan reads/day. HTTP 202 pending responses and HTTP 429 throttled responses may include Retry-After; agents and SDKs should honor that value rather than tight polling.

{
  "type": "certscore_api_error",
  "error": {
    "code": "not_found",
    "message": "Scan not found."
  },
  "links": {
    "docs": "https://certscore.ai/developers/reference"
  }
}

HTTP 401
{
  "type": "certscore_api_error",
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key."
  }
}

HTTP 429
Retry-After: 60
{
  "type": "certscore_api_error",
  "error": {
    "code": "rate_limited",
    "message": "Retry later.",
    "retryAfterSeconds": 60
  }
}

HTTP 500
{
  "type": "certscore_api_error",
  "error": {
    "code": "internal_error",
    "message": "CertScore.ai API v2 is temporarily unavailable."
  }
}

API v2 exposes scan resources, status, already-projected findings, public-safe evidence summaries, latest-domain lookup, and report-ready review context. It does not expose raw DOM, raw request bodies, internal scanner artifacts, internal reasoning, or display-only findings. Failed or partial scans should be surfaced as incomplete evidence, not compliance failures. Do not infer legal conclusions from scan output.