Skip to main content

​
Base URLs

Interactive docs (Swagger UI) are available at /api/openapi.json on any running instance.

​
Authentication

All protected endpoints require a JWT bearer token obtained from POST /api/auth/login.
Tokens are RS256-signed JWTs stored in Redis. They expire after 7 days. Logging out immediately invalidates the token in Redis regardless of the expiry time.
The Stripe webhook endpoint (POST /api/stripe/webhook) is the only endpoint that uses Stripe signature verification instead of JWT. Do not send a bearer token to that endpoint.

​
Response Format

Every endpoint returns the same JSON envelope:

​
Rate Limiting

Sensitive endpoints are rate-limited to 10 requests per minute per IP via SlowAPI:
  • POST /api/auth/login
  • POST /api/user/ (registration)
  • POST /api/user/verify-email/
  • POST /api/user/verify-email-otp/
  • POST /api/user/verify-email-link/
  • POST /api/user/invite-user/

​
Permissions

Some endpoints require specific permission slugs on the authenticated user’s role in addition to a valid JWT. If the permission is missing the endpoint returns HTTP 403.

​
API Groups

Auth

Login, logout, OAuth (Google, Microsoft, Cognito)

Users

Registration, profile, email verification, invites

Websites

Add, list, update, and delete websites

Scans

Trigger, cancel, and track audit scans

Results

Audit results and accessibility data

Reports

Generate and download audit reports

AI Solutions

Gemini-powered accessibility fix suggestions

Billing

Stripe subscriptions, checkout, transactions

Organisations

Organisation CRUD and member management

Monitoring

Uptime monitors, RUM, scan schedules