Scanner API reference

POST /api/v1/scan with JSON and Content-Type: application/json. GET /api/v1/scan?url=https://example.com is also available with unknown applicability.

{
  "url": "https://example.com/support",
  "private": true,
  "fresh": true,
  "applicability": {
    "chatbot": "yes",
    "publicInterestText": "unknown",
    "provider": "no"
  }
}

Applicability accepts yes, no or unknown. Omitted answers default to unknown. private skips cache storage and fresh skips cache reads. URL paths and answers are included in cache keys.

Response fields

• checks.chatbot, checks.media, checks.text: issue-observed, no-issue-observed, not-applicable or unable-to-assess.
• evidence: finalUrl, pageTitle, sourceHash, disclosureExcerpts and limitations.
• ruleVersion, scannedAt, applicability, issues and sampled media findings.
• score is null. riskLevel is a technical observation label, not the AI Act legal risk category.

A blocked website returns a report with unable-to-assess outcomes and no source hash. Invalid input returns HTTP 400. Rate limits return 429. The API allows 60 requests per IP per ten-minute window; degraded storage uses a per-process fallback, not a distributed quota. This API does not provide paid quotas or service guarantees.

Browser-rendered interactions, screenshots, audio/video and cryptographic C2PA verification are outside the scanner's scope.