API Documentation

Free scan. Returns grade, header analysis (without fix values), TLS, and DNS. Cookies and cross-origin results are omitted — use /api/scan/pro for the full report. IP-based quota applies.

Request body

Query params: Add ?full=1 to include fix values in the response — used internally by the Hall of Fame feature.

Response fields

curl

curl -s -X POST https://api.webaudit.in/api/scan \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'

Python

import requests

result = requests.post(
    "https://api.webaudit.in/api/scan",
    json={"url": "https://example.com"},
).json()

print(f"Grade: {result['grade']}  Score: {result['score']}")

Full Pro scan. Returns everything including fix recommendations, cookie analysis, and cross-origin isolation headers. Consumes one scan from your monthly quota.

Request body

Response fields

curl

curl -s -X POST https://api.webaudit.in/api/scan/pro \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'

Python

import requests

resp = requests.post(
    "https://api.webaudit.in/api/scan/pro",
    headers={"X-API-Key": "YOUR_API_KEY"},
    json={"url": "https://example.com"},
)
result = resp.json()

print(f"Grade: {result['grade']}  Score: {result['score']}")
print(f"Scans remaining: {resp.headers.get('X-Scans-Remaining')}")

# Iterate over header results
for name, info in result["headers"].items():
    if info["status"] != "good":
        print(f"  [{info['status'].upper()}] {name}: {info.get('fix', 'N/A')}")

Runs a full Pro scan and returns the result as a formatted PDF report — ready to hand to a client. Consumes one scan from your monthly quota.

Request body

Response

Returns a binary PDF file (application/pdf) with a Content-Disposition: attachment header. The filename is derived from the target domain, e.g. webaudit_example_com.pdf.

X-Scans-Remaining is also set in the response headers.

curl (save to file)

curl -s -X POST https://api.webaudit.in/api/report/pdf \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com", "name": "Acme Corp"}' \
  -o report.pdf

Python

import requests

resp = requests.post(
    "https://api.webaudit.in/api/report/pdf",
    headers={"X-API-Key": "YOUR_API_KEY"},
    json={"url": "https://example.com", "name": "Acme Corp"},
)

with open("report.pdf", "wb") as f:
    f.write(resp.content)

print(f"Saved  ({len(resp.content):,} bytes)  "
      f"Remaining: {resp.headers.get('X-Scans-Remaining')}")

Checks whether an API key is valid and active. Use this to confirm a key before running scans.

Response fields

curl

curl -s https://api.webaudit.in/api/verify-key \
  -H "X-API-Key: YOUR_API_KEY"

Expected response

{
  "valid": true,
  "plan":  "pro"
}

Returns the current month's usage statistics for a given API key. Useful for dashboards and quota monitoring.

Query parameters

Response fields

curl

curl -s "https://api.webaudit.in/api/usage?key=YOUR_API_KEY"

Expected response

{
  "valid":        true,
  "email":        "you@example.com",
  "plan":         "pro",
  "scans_used":   12,
  "scans_limit":  50
}

Verify a Razorpay one-time payment and receive a 24-hour single-use scan token. Used by the One-Time Scan checkout flow after Razorpay redirects back with a razorpay_payment_id. LemonSqueezy one-time purchases deliver the token by email via webhook automatically.

Request body

Response fields

Using the token in a scan

curl -s -X POST https://api.webaudit.in/api/scan \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com", "one_time_token": "TOKEN"}'

Creates a Razorpay order for a one-time compliance report (₹249 India) or returns the LemonSqueezy checkout URL ($3 international). The frontend calls this to initiate the payment flow, then calls /api/compliance-report/generate after payment succeeds.

Request body

Response fields

Runs a full Pro-level scan on the given URL, maps results to all four compliance frameworks (OWASP Top 10 2021, PCI-DSS v4.0, GDPR Article 32, ISO 27001:2022), and emails a PDF compliance report to the supplied address. The token from /api/compliance-report/pay is required and is single-use.

Request body

Response fields

curl (with a valid token)

curl -s -X POST https://api.webaudit.in/api/compliance-report/generate \
  -H "Content-Type: application/json" \
  -d '{
    "token": "YOUR_PAYMENT_TOKEN",
    "url": "https://example.com",
    "email": "you@example.com"
  }'