# AgentSiteAudit

> Website audit API built for AI agents. Send one URL with GET /v1/audit?url=... and receive one structured JSON report: a score, a priority-ordered issue list, and for every check its result, severity, evidence and an exact fix.

AgentSiteAudit is in beta and free to use. All 60 checks across the nine categories are live.

## Endpoints

- [Audit a page](https://agentsiteaudit.com/v1/audit?url=https://example.com): GET with a url parameter. Returns the full report.
- [Check registry](https://agentsiteaudit.com/v1/checks.json): every check ID, category, severity and threshold, plus scoring weights and caps.
- [Health](https://agentsiteaudit.com/v1/health): service status, api_version and rule_version.

## Reading a report

- Every response has the same 15 top-level fields: schema_version, api_version, rule_version, audit_id, status, checked_at, duration_ms, target, summary, categories, issues, checks, data, limitations, error.
- status is complete, partial, failed (the site could not be reached), rejected (we refused the URL) or error (our fault).
- issues lists check IDs with FAIL or WARNING, most important first. Fix from the top.
- Each check result is PASS, WARNING, FAIL or NOT_TESTED. NOT_TESTED always has a not_tested_reason and never counts as a pass.
- summary.score is null when fewer than 60% of checks ran. A CRITICAL failure caps the score at 49, a HIGH failure at 79.
- Check IDs are permanent and never reused. Ignore IDs and fields you do not recognise; new ones are added over time.

## HTTP status codes

- 200: the audit ran; read status.
- 400: invalid URL, scheme or port.
- 403: the URL points to a private, internal or reserved address.
- 429: rate limited; wait for Retry-After seconds.
- 500: our error; safe to retry.

## Limits and safety

- Free beta limit: 10 audits a minute and 500 a day per IP address.
- Audits are passive: the page, robots.txt, sitemap and linked resources only. No form submission, no probing for hidden files.
- Private, internal, reserved and cloud-metadata addresses are refused, and every redirect is re-checked.
- No browser rendering: Core Web Vitals and visual layout are not measured.

## Pricing

- Free during the beta.
- Pay-per-request using the x402 protocol is planned.