Run accessibility checks from your own workflow
Use a scoped organization API key to start single-page or full-site scans and read stable, structured results.
Quickstart
Create a key in Settings, keep the secret in your secret manager, then send it as a Bearer token.
curl https://wcagc.com/api/v1/sites \
+ -H "Authorization: Bearer wcagc_your_api_key"Authentication
Keys begin with wcagc_ and are shown in full once. Store them as secrets, grant only the scopes you need, and revoke them immediately if exposed.
Rate limit
Each key allows 120 requests per minute by default. A 429 response includes Retry-After so clients can back off safely.
Scopes
sites:read- List registered sites in the key’s organization.
scans:write- Start single-page and full-site scans.
scans:read- Read scan status, counts, progress, and findings.
Signed outbound webhooks
Subscribe an HTTPS endpoint to terminal scan, regression, and remediation events. Every JSON delivery includes a timestamped HMAC-SHA256 signature, a stable delivery ID, and automatic retries.
Configure webhooksVerify X-Wcagc-Signature against timestamp + '.' + the unchanged raw request body. Reject old timestamps to reduce replay risk.
X-Wcagc-Event: scan_run.completed
X-Wcagc-Delivery: 019f…
X-Wcagc-Timestamp: 178406…
X-Wcagc-Signature: v1=<hmac-sha256>