Website audit API: run site audits from your own code
A site audit API for building website audits into your own tools and workflows. Queue a scan with one POST request, fetch scores and fixes as JSON, and react to completed audits through signed webhooks.
What it checks
Everything the website audit api looks at
Bearer token authentication
Authenticate API requests with tokens created in your account.
Queue scans
Start a full website audit for any URL with a single API call.
Read results
Fetch scores, category results and fixes as structured data.
Site crawls
Start and read whole-site crawls through the API on Pro and Agency.
Batches
Create and track bulk audits of up to 100 URLs through the API on Agency.
Signed webhooks
Receive scan.completed, scan.failed and batch.completed events, signed with HMAC so you can verify they came from us.
How it works
Three steps, about a minute.
-
1
Create a token
Generate an API token in your account settings.
-
2
Queue an audit
Send a request to start a scan, crawl or batch.
-
3
Receive the result
Get a signed webhook when it finishes, then fetch the full results.
What you can do with the website audit API
The MakeItFlow website audit API gives you programmatic access to the same audits available in the dashboard. Using a bearer token, you can queue a scan for any URL and read the results as structured data, including the overall grade, category scores and prioritised fixes. On the Pro plan you can also start and read whole-site crawls, and on Agency you can create batches of up to 100 URLs. Typical uses include running an audit after each deployment, pulling scores into a client dashboard, adding a website health check to an onboarding flow or keeping an internal spreadsheet of client site grades up to date.
A site audit API request in practice
Every request goes to the /api/v1 base path with your token in an Authorization: Bearer header. To audit a page, send POST /api/v1/scans with a JSON body such as {"url": "example.com", "strategy": "mobile"}. The API answers straight away with 202 Accepted and a scan whose status is "queued", plus links to the scan resource, the online report and the PDF. A scan usually takes 20 to 40 seconds; then GET /api/v1/scans/{id} returns the overall score, grade, category scores and fixes. Submitting the same target again inside the cooldown window returns the existing report instead of re-running it, unless you send "force": true. Crawls and batches follow the same pattern at /api/v1/crawls and /api/v1/batches, and GET /api/v1/me shows your plan and daily scan allowance. The full reference, with curl examples, error codes and rate limits (120 requests per minute overall, 20 per minute for creating scans and batches), is in the API documentation.
Using webhooks with the website audit API
Audits take time to complete, so rather than polling the API repeatedly, you can register a webhook endpoint. When a scan finishes, we send a scan.completed event; if it fails, a scan.failed event; and when a bulk batch finishes, a batch.completed event. Each webhook is signed with an HMAC signature using a shared secret, so your endpoint can verify the request genuinely came from MakeItFlow before processing it. Always verify the signature and reject requests that do not match. Once verified, your system can fetch the full result through the API and store it, alert your team or trigger the next step in your workflow.
Why it matters
Automate reporting
Pull audit results into dashboards, CRMs or client portals without manual exports.
No polling required
Webhooks notify your system as soon as a scan or batch completes.
Verifiable events
HMAC signatures let you confirm each webhook is genuine before acting on it.
Who it is for
Developers
Add audits to deployment pipelines, internal tools or monitoring scripts.
Agencies
Feed audit data into client dashboards and reporting systems.
SaaS and hosting platforms
Offer website health checks inside your own product.
The API is available on the Pro and Agency plans. Crawls are available on Pro and above, and batches on Agency. See pricing for details.
Create a token in your account and send it as a bearer token in the Authorization header of each request.
POST /api/v1/scans with a JSON body containing the url (and optionally the strategy, mobile or desktop). The response returns the scan id and a link to poll until the status is completed or failed.
scan.completed, scan.failed and batch.completed. Each is signed with an HMAC signature you can verify.
API scans use the same allowance as scans started from the dashboard.
Free website audit
See how your site scores, free
Speed, SEO, DNS, email (SPF/DKIM/DMARC) and security in one scan, with a prioritised fix list.