mtc.berlin xcheck

API documentation

Start website checks and fetch reports programmatically. Ideal for CI pipelines and your own tools.

Authentication

Create an API key in your account and send it as a bearer token: “Authorization: Bearer xck_…”. Each key belongs to your account; scans run in your organization’s context.

Quick start

Start a scan (returns 202 with a job id):

curl -X POST https://xcheck.dev/api/v1/scans \
  -H "Authorization: Bearer xck_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/","wcag":"2.2-AA"}'

Check the status (queued/running/done/failed); when “done”, the response includes the reportId:

curl https://xcheck.dev/api/v1/scans/SCAN_ID \
  -H "Authorization: Bearer xck_YOUR_KEY"

Fetch the finished report as JSON:

curl https://xcheck.dev/api/v1/reports/REPORT_ID \
  -H "Authorization: Bearer xck_YOUR_KEY"

Error codes

  • 401 unauthorized API key missing or invalid.
  • 403 org_limit The organization’s monthly scan limit is reached.
  • 404 not_found Scan/report not found or no access.
  • 429 rate_limited Rate limit reached. The “Retry-After” header gives the wait time in seconds.

Default rate limit: 30 scans per hour per key holder. Errors always carry the fields error.code and error.message.

OpenAPI spec

The full, machine-readable specification is at https://xcheck.dev/api/v1/openapi.json