{"openapi":"3.1.0","info":{"title":"WebsiteIQ Audit API","version":"1.2.0","description":"Bounded public website audits. WebsiteIQBot obeys robots.txt, rejects private targets, and stops on HTTP 402. Reports are unlisted token-bearing links, excluded from indexing, and retained until deletion is requested.","contact":{"url":"https://websiteiq.xyz/contact/"},"license":{"name":"Proprietary service terms","identifier":"LicenseRef-WebsiteIQ-Terms"}},"servers":[{"url":"https://websiteiq.xyz"}],"paths":{"/api/health":{"get":{"operationId":"getHealth","summary":"Service health and public limits","responses":{"200":{"description":"Health response"}}}},"/api/stats":{"get":{"operationId":"getStats","summary":"Aggregate public audit counts","responses":{"200":{"description":"Aggregate counts"}}}},"/api/checks/catalog":{"get":{"operationId":"listChecks","summary":"List public check categories and caveats","responses":{"200":{"description":"Check catalog"}}}},"/api/x402/status":{"get":{"operationId":"getX402Status","summary":"Truthful production-payment status","responses":{"200":{"description":"Current x402 integration status"}}}},"/api/estimate":{"post":{"operationId":"estimateAudit","summary":"Count robots-permitted sitemap URLs for future API/MCP audit scope","description":"Reads robots.txt first and follows a bounded same-host sitemap tree. It reports estimated crawl scope only. A new cost structure will be published when production x402 settlement goes live.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["url"],"properties":{"url":{"type":"string","format":"uri"}},"additionalProperties":false}}}},"responses":{"200":{"description":"Sitemap scope estimate and current pricing status"},"400":{"description":"Invalid input"},"422":{"description":"Target could not be estimated safely"},"429":{"description":"Estimator rate limit"}}}},"/api/intake":{"post":{"operationId":"startAudit","summary":"Start a bounded audit","description":"The new beta sample provides one comprehensive single-page audit per connection per 24 hours. A valid email and explicit audit-processing consent are mandatory. Future paid access will be API/MCP-only after x402 launches; the normal website has no paid checkout path.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["url","email","contactConsent"],"properties":{"url":{"type":"string","format":"uri"},"email":{"type":"string","format":"email"},"contactConsent":{"type":"boolean","const":true,"description":"Required consent to process, retain, and administer the requested audit and contact the requester about it."},"referrer":{"type":"string","format":"uri-reference"},"landingPath":{"type":"string","pattern":"^/"},"utm":{"type":"object","properties":{"source":{"type":"string"},"medium":{"type":"string"},"campaign":{"type":"string"}},"additionalProperties":false}},"additionalProperties":false}}}},"responses":{"202":{"description":"Audit accepted; returned status and report URLs contain the one-time access token"},"400":{"description":"Invalid input"},"429":{"description":"Rate limit"},"503":{"description":"Storage unavailable"}}}},"/api/contact":{"post":{"operationId":"submitContact","summary":"Submit the human contact form","description":"Human-facing endpoint protected by Cloudflare Turnstile. Software agents should use /mcp or /api/intake instead.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["name","email","message","turnstileToken","formStartedAt"],"properties":{"name":{"type":"string","maxLength":120},"email":{"type":"string","format":"email","maxLength":254},"topic":{"type":"string","maxLength":48},"message":{"type":"string","minLength":20,"maxLength":4000},"context":{"type":"string","maxLength":240},"turnstileToken":{"type":"string","maxLength":2048},"formStartedAt":{"type":"integer"}},"additionalProperties":false}}}},"responses":{"202":{"description":"Message accepted"},"400":{"description":"Invalid form or verification"},"403":{"description":"Forbidden Origin"},"503":{"description":"Verification unavailable"}}}},"/api/status/{id}":{"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"get":{"operationId":"getAuditStatus","summary":"Get privacy-filtered audit status","security":[{"AuditAccessToken":[]}],"responses":{"200":{"description":"Status"},"401":{"description":"Access token required"},"404":{"description":"Not found"}}},"delete":{"operationId":"deleteAudit","summary":"Delete audit metadata, report, and delivery record","security":[{"AuditAccessToken":[]}],"responses":{"200":{"description":"Deleted"},"401":{"description":"Access token required"},"404":{"description":"Not found"}}}},"/api/report/{id}":{"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"get":{"operationId":"getAuditReport","summary":"Get pending or complete HTML report","security":[{"AuditAccessToken":[]}],"responses":{"200":{"description":"HTML report","content":{"text/html":{"schema":{"type":"string"}}}},"401":{"description":"Access token required"},"404":{"description":"Not found"}}}}},"components":{"schemas":{"ProblemDetails":{"type":"object","description":"RFC 9457 problem details. The status member matches the HTTP response status.","required":["type","title","status","detail","instance"],"properties":{"type":{"type":"string","format":"uri-reference","default":"about:blank"},"title":{"type":"string"},"status":{"type":"integer","minimum":400,"maximum":599},"detail":{"type":"string"},"instance":{"type":"string","format":"uri-reference"},"allowedMethods":{"type":"array","items":{"type":"string"}}},"additionalProperties":true}},"responses":{"Problem":{"description":"A protocol-appropriate HTTP error. Browser navigation can receive an equivalent noindex HTML recovery page through content negotiation.","content":{"application/problem+json":{"schema":{"$ref":"#/components/schemas/ProblemDetails"}}}}},"securitySchemes":{"AuditAccessToken":{"type":"apiKey","in":"header","name":"X-WebsiteIQ-Access-Token","description":"Returned once when an audit is created. Bearer authorization and the access query parameter are also supported for report links."}}},"externalDocs":{"description":"WebsiteIQ audit scope and methodology","url":"https://websiteiq.xyz/website-audits/"}}