Three endpoints
/inspect takes no credentials. See authentication
for what a session adds and why there are no API keys yet.
Responses are one document
There are no jobs, no polling and no webhooks. A check is a single synchronous request that returns the whole report — score, metadata, all eight previews and every issue. Typical responses are a few hundred milliseconds; a slow target can take up to the 15-second fetch timeout.Two fields are a contract
issues[].code and the top-level error are stable identifiers. New values get
added; existing ones are not renamed or removed without deprecation, and a guard
test in the codebase makes breaking one deliberate rather than accidental.
Everything else — title, description, message, basis — is prose written
for people and may be reworded. Do not match on it.
Errors do not carry reports
score, metadata or previews. Check error first.
Every code.
Rate limits are on every response
Caching
Reports are cached for fifteen minutes andx-cache says hit or miss. Add
fresh=1 to bypass. Cached responses still count against your limit.