wcagc
Production API

Run accessibility checks from your own workflow

Use a scoped organization API key to start single-page or full-site scans and read stable, structured results.

Create an API keyInteractive API reference

Quickstart

The Developer API uses scoped keys, not the browser login endpoint.

  1. Sign in to wcagc and create a key under Settings → Developer API.
  2. Copy the complete key when it is shown once and store it in your secret manager.
  3. Grant only the scopes your client needs. In Swagger, choose Authorize and paste the key without adding the word Bearer.
  4. Send the key to https://api.wcagc.com as an Authorization: Bearer header.
curl https://api.wcagc.com/api/v1/sites \
  -H "Accept: application/json" \
  -H "Authorization: Bearer $WCAGC_API_KEY"

Authentication

Keys begin with wcagc_ and are shown in full once. Store them as secrets, grant only the scopes you need, and revoke them immediately if exposed.

You will not see /api/auth/login in the public specification: it creates a cookie session for the web app and is intentionally not the authentication method for scripts.

Rate limit

Each key allows 120 requests per minute by default. A 429 response includes Retry-After so clients can back off safely.

Scopes

Most REST routes require the Developer API plan feature. CI uses a separate ci:check scope and plan quota; assistant and browser-extension credentials have their own documentation.

sites:read
List registered sites in the key’s organization.
scans:write
Start single-page and full-site scans.
scans:read
Read scan status, counts, progress, and findings.
ci:check
Start and read bounded multi-URL CI checks under the organization’s CI quota.

Choose the API job you need

The reference is organized around stable jobs rather than the internal web-app endpoints. Every resource is tenant-scoped to the organization that owns the credential.

Discover sites

Get registered site IDs before starting a full-site run, reading a trend, or selecting a saved journey. Requires sites:read.

GET /api/v1/sites

Check one page

Queue a page on a registered site, poll the scan, then read its stable finding records. Requires scans:write and scans:read.

POST /api/v1/scans GET /api/v1/scans/{id} GET /api/v1/scans/{id}/violations

Crawl a registered site

Queue a full-site run, read progress, findings, and deterministic root-cause groups. Requires scans:write and scans:read.

POST /api/v1/scan-runs GET /api/v1/scan-runs/{id} GET /api/v1/scan-runs/{id}/violations GET /api/v1/scan-runs/{id}/root-causes

Run saved journeys and verify fixes

Use server-stored steps and credentials; API requests never carry login secrets. Site trends and targeted re-checks reuse the normal read/write scopes.

GET /api/v1/sites/{id}/journeys POST /api/v1/journeys/{id}/runs GET /api/v1/sites/{id}/trend POST /api/v1/remediation-items/{id}/verifications

Gate CI

Check up to the plan limit of URLs on one verified site, read the verdict, and retrieve baseline-aware findings. Requires ci:check.

POST /api/v1/ci/checks GET /api/v1/ci/checks/{id} GET /api/v1/ci/checks/{id}/violations

Create, poll, then read findings

Scan, run, CI, journey, and fix-verification creation is asynchronous. A successful POST returns 202 Accepted, a resource ID, and a Location header.

Poll the Location resource with bounded backoff until it reaches a terminal state. Read findings only after completion; do not treat a queued or running response as a result.

curl -X POST https://api.wcagc.com/api/v1/scans \
  -H "Authorization: Bearer $WCAGC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/checkout"}'
curl https://api.wcagc.com/api/v1/scans/{id} \
  -H "Authorization: Bearer $WCAGC_API_KEY"

curl https://api.wcagc.com/api/v1/scans/{id}/violations \
  -H "Authorization: Bearer $WCAGC_API_KEY"

Handle stable error codes

Errors use application/problem+json. Branch on code, keep traceId for support, and treat detail as human-readable context that may change.

  • 401 API_KEY_INVALID
  • 403 API_KEY_SCOPE_MISSING / FEATURE_NOT_IN_PLAN
  • 404 *_NOT_FOUND
  • 409 *_ALREADY_RUNNING
  • 422 VALIDATION_FAILED / INVALID_URL
  • 429 RATE_LIMITED + Retry-After
{
  "type": "https://wcagc.com/problems/api-key-scope-missing",
  "title": "API key scope missing",
  "status": 403,
  "detail": "The API key does not grant the required scope.",
  "instance": "/api/v1/sites",
  "code": "API_KEY_SCOPE_MISSING",
  "traceId": "019c…",
  "timestamp": "2026-08-19T20:57:19Z"
}

Interactive and machine-readable reference

Swagger lists every supported Developer API v1 operation, required scope, request schema, response status, and example. The raw OpenAPI 3.1 JSON can be imported into API clients and code generators.

Open Swagger UIDownload OpenAPI JSON

Signed outbound webhooks

Subscribe an HTTPS endpoint to terminal scan, regression, and remediation events. Every JSON delivery includes a timestamped HMAC-SHA256 signature, a stable delivery ID, and automatic retries.

Configure webhooks

Verify X-Wcagc-Signature against timestamp + '.' + the unchanged raw request body. Reject old timestamps to reduce replay risk.

X-Wcagc-Event: scan_run.completed
X-Wcagc-Delivery: 019f…
X-Wcagc-Timestamp: 178406…
X-Wcagc-Signature: v1=<hmac-sha256>