# PageAudit — full API reference

> Generated from the catalog at https://pageaudit.online · build `ea632af9`
> 38 endpoints · 26 structures
> Short index: https://pageaudit.online/llms.txt · Spec: https://pageaudit.online/openapi.json · MCP: https://pageaudit.online/mcp

> Technical SEO auditor in one call: title, meta, canonical, OG, headings, JSON-LD,
> robots, alt, links, hreflang and redirects. No key to start.

## How to read

- Every endpoint lists path, auth, parameters, body, response structure, errors and a call that runs.
- `Pagina<Canal>` is a reference: the fields are under **Structures**, at the end, once.
- `(optional)` on a field means it may be absent; `(may be null)` means it comes with a null value.
- Slice what you need: `https://pageaudit.online/llms-full.txt?prefix=/api/` returns only that branch.

## Authentication

- `credito` — Prepaid credit token in `Authorization: Bearer cred_…` (or the `X-Credito` header). Not an account: it is a bearer of balance.
- `none` — Public, no credential.
- `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. A user session (`sess_…`) also works and takes precedence.
- `session` — User session: `Authorization: Bearer sess_…` (obtained by e-mail OTP).
- `token` — Operator token in `Authorization: Bearer …` (`METRICS_TOKEN`).

## Endpoints

## Discovery

### `GET /okf/:arquivo`

OKF bundle (Open Knowledge Format v0.1): markdown with frontmatter so an agent reads the whole product without parsing HTML.

- **URL:** `https://pageaudit.online/okf/:arquivo`
- **Auth:** `none` — Public, no credential.

**Path parameters**

- `arquivo` (string, required) — `index.md`, `sobre.md`, `api.md` or `faq.md`. e.g.: `index.md`.

**Response `200`**

`text/markdown`. Start at `/okf/index.md`, which lists the bundle.

**Errors**

- `404` — File outside the bundle.

**Example**

```sh
curl -s https://pageaudit.online/okf/index.md
```

### `GET /.well-known/:arquivo`

Machine discovery before the home page: `api-catalog` (RFC 9727, a linkset with the API and the MCP), `security.txt` (RFC 9116) and `mcp-registry-auth` (the official MCP registry key).

- **URL:** `https://pageaudit.online/.well-known/:arquivo`
- **Auth:** `none` — Public, no credential.

**Path parameters**

- `arquivo` (string, required) — `api-catalog`, `security.txt`, `mcp-registry-auth` or `apis.json`. e.g.: `api-catalog`.

**Response `200`**

`application/linkset+json` for the api-catalog; `text/plain` for the other two.

**Errors**

- `404` — Name outside the four published.

**Example**

```sh
curl -s https://pageaudit.online/.well-known/api-catalog
```

### `GET /apis.json`

APIs.json (apisjson.org, 0.19): the index APIs.io harvests — the API, the MCP, OpenAPI, guide and OKF bundle in one file. Also at `/.well-known/apis.json`.

- **URL:** `https://pageaudit.online/apis.json`
- **Auth:** `none` — Public, no credential.

**Response `200`**

`application/json` in the APIs.json 0.19 format: `apis[]` with `baseURL`, `humanURL` and `properties[]`.

**Example**

```sh
curl -s https://pageaudit.online/apis.json
```

### `GET /api/`

Self-describing index: the whole API surface, with quota and retention policy.

- **URL:** `https://pageaudit.online/api/`
- **Auth:** `none` — Public, no credential.

**Response `200`**

- `name` (string) — Product name.
- `description` (string) — What the product does, in one sentence.
- `build` (string) — Deployed commit.
- `base_url` (string) — Origin this API is serving from.
- `docs` (object) — Links to llms.txt, llms-full.txt, openapi.json, MCP and the UI.
- `conventions` (object) — Error format, CORS, x402 and the UI↔API parity rule.
- `auth` (object) — Each authentication mode and how to obtain it.
- `endpoints` (object[]) — Every endpoint with method, path, auth, absolute URL and what it returns.
- `data_retention` (object) — What is stored from each run and what is discarded.
- `quota` (object) — What is free, what costs and how to pay — before you spend a call.
- `mcp` (object) — Address and transport of the MCP server.
- `quickstart` (string[]) — The calls that take you from zero to the first report.

### `GET /api/health`

Liveness and the commit deployed right now — it is how the smoke waits for its own deploy.

- **URL:** `https://pageaudit.online/api/health`
- **Auth:** `none` — Public, no credential.

**Response `200`**

- `ok` (bool) — Always `true` when the Worker answers.
- `app` (string) — Product name.
- `build` (string) — Deployed commit; CI passes the short SHA on deploy.
- `ts` (string) — Time of the response (UTC, ISO-8601).

### `POST /mcp`

MCP server over HTTP (Streamable HTTP, JSON-RPC 2.0) — plugs into the client with nothing to install.

The tools are the operations of this same catalog; the MCP has no backend of its own. `GET /mcp` returns the server card.

- **URL:** `https://pageaudit.online/mcp`
- **Auth:** `none` — Public, no credential.
- Credentials go in the usual headers (X-Guest-Token, Authorization, X-PAYMENT) and are forwarded to the API.
- An exhausted quota comes back as a 402 with accepts[] inside the tool result — pay and repeat.

**Response `200`**

JSON-RPC 2.0 response (`initialize`, `tools/list` or `tools/call`).

**Example**

```sh
curl -s -XPOST https://pageaudit.online/mcp -H 'content-type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

## Audit

### `POST /api/audit`

Audits a URL and returns the full report in one call, without a token or a tab.

This is the product for agents. Past the IP's daily allowance the response is **402 with `accepts[]`** — pay and repeat the same call. It also carries `sitekey` and `code`, which are the path for a human with a browser; an agent ignores those two. The free alternative: sign up and confirm the e-mail to get the trial.

- **URL:** `https://pageaudit.online/api/audit`
- **Auth:** `none` — Public, no credential.

**Body** (`application/json`)

- `url` (string, required) — The page to audit, `http` or `https`.
- `guest_token` (string) — Guest `pa_…` so the audit is tied to it and shows up in the tabs.
- `cf_turnstile_response` (string) — Turnstile response; it is the human path, agents use x402.

**Body example**

```json
{
  "url": "https://example.com/",
  "guest_token": "pa_… (optional, ties the audit)"
}
```

**Response `200`**

Structure: `Audit`.

- `id` (string, may be null) — ID of the stored audit; `null` when the database was unavailable.
- `score` (int) — Score from 0 to 100, computed from the findings below.
- `issues` (Achado[]) — Everything found, from most to least severe. → see `Achado` under **Structures**.
- `summary` (ResumoPagina) — What the page declares: title, meta, canonical, OG, headings, links… → see `ResumoPagina` under **Structures**.
- `counts` (ContagemAchados) — How many findings of each severity. → see `ContagemAchados` under **Structures**.
- `headers` (object) — Every header of the target's response. `Set-Cookie` is removed on purpose: it is a third party's credential.
- `htmlTruncated` (bool) — `true` when the page passed 2 MB and was read only that far.
- `jsonLd` (object[]) — The raw JSON-LD blocks, as they were on the page.
- `jsonLdStored` (int) — How many blocks survived the size cap — compare with `summary.jsonLdBlocks`.
- `truncated` (string[]) — What was cut and why: `jsonld_size`, `jsonld_nodes_over_50`, `result_size`. Empty means nothing cut.
- `fixes` (Correcao[]) — The ready fix of each finding, without a model — paste, fill in or decide. The consolidated one is at `_links.patch`. → see `Correcao` under **Structures**.
- `quota` (CotaAudit) — How much is still free and what it costs past that. → see `CotaAudit` under **Structures**.
- `_links` (LinksAudit) — This audit, the patch, the share and the API index. → see `LinksAudit` under **Structures**.

**Errors**

- `400` — Body is not JSON, or `url` missing/not http.
- `402` — Quota exceeded. The response carries `accepts[]` (x402, USDC on Base): pay and repeat the same call with `X-PAYMENT`.
- `403` — Wrong Turnstile answer. A wrong captcha is not an invitation to pay.
- `429` — Past `MAX_AUDITS_PER_HOUR` on the same IP. Wait an hour.

**Example**

```sh
curl -s -XPOST https://pageaudit.online/api/audit -H 'content-type: application/json' -d '{"url":"https://example.com/"}'
```

### `GET /api/audits/:id`

Re-reads an audit already made, in full, without re-auditing the page.

Re-reading costs nothing and does not count against the allowance — the page's HTML is not kept, but the report is.

- **URL:** `https://pageaudit.online/api/audits/:id`
- **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. A user session (`sess_…`) also works and takes precedence.

**Path parameters**

- `id` (string, required) — Audit ID, from `Audit.id`.

**Response `200`**

Structure: `AuditGravado`.

- `audit_id` (string) — ID of the audit.
- `url` (string) — Final audited URL, after following the redirects.
- `score` (int) — Score from 0 to 100.
- `summary` (ResumoPagina, may be null) — What the page declared at the time of the run. → see `ResumoPagina` under **Structures**.
- `counts` (ContagemAchados) — How many findings of each severity. → see `ContagemAchados` under **Structures**.
- `issues` (Achado[]) — Everything found in that run. → see `Achado` under **Structures**.
- `fixes` (Correcao[]) — The ready fix of each finding; an audit stored before this existed gets the computation on read. → see `Correcao` under **Structures**.
- `jsonLd` (object[]) — The raw JSON-LD blocks stored.
- `headers` (object) — Headers of the target's response, as they were in the run.
- `truncated` (string[]) — What was cut by size when storing.
- `share_slug` (string, may be null) — Public slug, if this audit was shared.
- `created_at` (string) — When the run happened (UTC).

**Errors**

- `401` — No credential, or an invalid one. See this endpoint's auth.
- `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose).

**Example**

```sh
curl -s https://pageaudit.online/api/audits/AUDIT_ID -H "X-Guest-Token: $PA"
```

### `GET /api/audits/:id/patch`

The consolidated patch of an audit: the <head> block ready to paste, the files to create at the root and the templates for what only the owner can fill in — no model, only facts from the page itself.

Each finding becomes a fix in one of three classes: `deterministico` (comes whole from what the page declares: final URL, title, description, OG), `molde` (a tag with a marked placeholder, like `{{TITULO}}`, and the suggested source) or `sem_patch` (a decision or infrastructure, with the instruction). Nothing is invented by a model.

- **URL:** `https://pageaudit.online/api/audits/:id/patch`
- **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. A user session (`sess_…`) also works and takes precedence.

**Path parameters**

- `id` (string, required) — Audit ID, from `Audit.id`.

**Response `200`**

Structure: `Patch`.

- `url` (string, may be null) — Final audited URL.
- `audit` (string, may be null) — Absolute link of the source audit.
- `head` (string) — The deterministic tags, one per line, in <head> order (charset first). Empty when there are none.
- `arquivos` (ArquivoPatch[]) — Files to create at the host root. → see `ArquivoPatch` under **Structures**.
- `moldes` (MoldePatch[]) — What only the owner can fill in. → see `MoldePatch` under **Structures**.
- `sem_patch` (SemPatch[]) — What is a decision or infrastructure. → see `SemPatch` under **Structures**.
- `resumo` (ResumoPatch) — Count per class. → see `ResumoPatch` under **Structures**.
- `como_aplicar` (string) — One-sentence instruction.
- `_links` (object) — `api_index`.

**Errors**

- `401` — No credential, or an invalid one. See this endpoint's auth.
- `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose).

**Example**

```sh
curl -s https://pageaudit.online/api/audits/AUDIT_ID/patch -H "X-Guest-Token: $PA"
```

## Micro-tools

### `GET /api/tools`

The micro-tools: one landing per check, all driven by the same engine as the audit.

- **URL:** `https://pageaudit.online/api/tools`
- **Auth:** `none` — Public, no credential.

**Response `200`**

- `tools` (Ferramenta[]) — Every published tool. → see `Ferramenta` under **Structures**.
- `_links` (object) — The hub in HTML and the API index.

### `GET /api/tools/:slug`

Metadata and copy of one micro-tool.

- **URL:** `https://pageaudit.online/api/tools/:slug`
- **Auth:** `none` — Public, no credential.

**Path parameters**

- `slug` (string, required) — Tool slug, e.g. `title-tag-checker`.

**Response `200`**

Structure: `Ferramenta`.

- `slug` (string) — Identifier in the URL, e.g. `title-tag-checker`.
- `title` (string) — Page title, used in `<title>`.
- `h1` (string) — The landing's H1.
- `description` (string) — Meta description of the landing.
- `lead` (string) — Opening paragraph.
- `category` (string) — Grouping of the tool in the hub.
- `icon` (string) — Name of the icon used in the card.
- `checks` (string[]) — Finding codes this tool highlights — they are the `Achado.code`s.
- `serp` (object) — How the result looks in the search preview.
- `sections` (object[]) — Content blocks of the landing.
- `_links` (object) — This tool in JSON and in HTML.

**Errors**

- `404` — Unknown slug.

**Example**

```sh
curl -s https://pageaudit.online/api/tools/title-tag-checker
```

### `GET /tools`

HTML hub of the micro-tools, indexable. For JSON use `GET /api/tools`.

- **URL:** `https://pageaudit.online/tools`
- **Auth:** `none` — Public, no credential.

**Response `200`**

`text/html` — the hub page, rendered on the server.

### `GET /tools/:slug`

HTML landing of one check, indexable. An unknown slug returns a real 404.

The 404 is real, not a 200 with an empty shell: mass soft-404s burn the whole domain in the index.

- **URL:** `https://pageaudit.online/tools/:slug`
- **Auth:** `none` — Public, no credential.

**Path parameters**

- `slug` (string, required) — Tool slug, e.g. `title-tag-checker`.

**Response `200`**

`text/html` — the tool's landing.

**Errors**

- `404` — Unknown slug — a real 404, not an empty shell.

## Share

### `POST /api/audits/:id/share`

Publishes the audit under a non-enumerable slug. Calling again returns the same slug.

- **URL:** `https://pageaudit.online/api/audits/:id/share`
- **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. A user session (`sess_…`) also works and takes precedence.

**Path parameters**

- `id` (string, required) — ID of the audit to publish.

**Response `200`**

Structure: `Compartilhamento`.

- `ok` (bool) — Always `true`.
- `shared` (bool) — Whether the audit is published at the end of the call.
- `slug` (string) — Public, non-enumerable slug.
- `path` (string) — Path of the report's HTML page.
- `badge` (string) — Path of the score badge SVG.
- `_links` (object) — Report, JSON and badge, as absolute URLs.

**Errors**

- `401` — No credential, or an invalid one. See this endpoint's auth.
- `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose).

**Example**

```sh
curl -s -XPOST https://pageaudit.online/api/audits/AUDIT_ID/share -H "X-Guest-Token: $PA"
```

### `DELETE /api/audits/:id/share`

Revokes the share; the slug stops serving the report.

The badge keeps answering 200 with the grey `n/a` SVG — same box, so the layout of whoever pasted it in a README does not break.

- **URL:** `https://pageaudit.online/api/audits/:id/share`
- **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. A user session (`sess_…`) also works and takes precedence.

**Path parameters**

- `id` (string, required) — ID of the audit to unpublish.

**Response `200`**

- `ok` (bool) — Always `true`.
- `shared` (bool) — Always `false` at the end of this call.

**Errors**

- `401` — No credential, or an invalid one. See this endpoint's auth.
- `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose).

**Example**

```sh
curl -s -XDELETE https://pageaudit.online/api/audits/AUDIT_ID/share -H "X-Guest-Token: $PA"
```

### `GET /api/shared/:slug`

Shared report as JSON, without credentials — the machine twin of `/r/:slug`.

- **URL:** `https://pageaudit.online/api/shared/:slug`
- **Auth:** `none` — Public, no credential.

**Path parameters**

- `slug` (string, required) — Public slug of the share.

**Response `200`**

Structure: `AuditGravado`.

- `audit_id` (string) — ID of the audit.
- `url` (string) — Final audited URL, after following the redirects.
- `score` (int) — Score from 0 to 100.
- `summary` (ResumoPagina, may be null) — What the page declared at the time of the run. → see `ResumoPagina` under **Structures**.
- `counts` (ContagemAchados) — How many findings of each severity. → see `ContagemAchados` under **Structures**.
- `issues` (Achado[]) — Everything found in that run. → see `Achado` under **Structures**.
- `fixes` (Correcao[]) — The ready fix of each finding; an audit stored before this existed gets the computation on read. → see `Correcao` under **Structures**.
- `jsonLd` (object[]) — The raw JSON-LD blocks stored.
- `headers` (object) — Headers of the target's response, as they were in the run.
- `truncated` (string[]) — What was cut by size when storing.
- `share_slug` (string, may be null) — Public slug, if this audit was shared.
- `created_at` (string) — When the run happened (UTC).

**Errors**

- `404` — Unknown slug, or share revoked.

**Example**

```sh
curl -s https://pageaudit.online/api/shared/SLUG
```

### `GET /r/:slug`

HTML page of the shared report, with `noindex`.

`noindex` on purpose: a third party's report is not our content to index. The JSON twin is `/api/shared/:slug`.

- **URL:** `https://pageaudit.online/r/:slug`
- **Auth:** `none` — Public, no credential.

**Path parameters**

- `slug` (string, required) — Public slug of the share.

**Response `200`**

`text/html` — the rendered report, with `noindex`.

**Errors**

- `404` — Unknown or revoked slug.

### `GET /api/badge/:slug`

Metadata of the score badge, including the markdown ready for the README.

- **URL:** `https://pageaudit.online/api/badge/:slug`
- **Auth:** `none` — Public, no credential.

**Path parameters**

- `slug` (string, required) — Public slug of the share.

**Response `200`**

Structure: `Badge`.

- `slug` (string) — Slug of the shared report.
- `score` (int, may be null) — Score shown in the badge.
- `label` (string) — Text on the left of the badge.
- `available` (bool) — `false` when the share was revoked — the SVG turns grey `n/a`.
- `markdown` (string) — The markdown line ready to paste in the README.
- `_links` (object) — The SVG and the report.

**Errors**

- `404` — Unknown slug. Revoked is different: it returns 200 with `available: false`.

**Example**

```sh
curl -s https://pageaudit.online/api/badge/SLUG
```

### `GET /badge/:slug.svg`

SVG score badge, to paste in the README of the audited project.

A revoked share returns **200** with the grey `n/a` SVG — the same box, so the README of whoever pasted it does not end up with a broken image.

- **URL:** `https://pageaudit.online/badge/:slug.svg`
- **Auth:** `none` — Public, no credential.

**Path parameters**

- `slug` (string, required) — Public slug, with the `.svg` extension in the path.

**Response `200`**

`image/svg+xml` — the badge, coloured by the score or grey `n/a` if revoked.

**Errors**

- `404` — Malformed slug.

## Identity

### `POST /api/guest`

Creates a guest `pa_…` — it is what gives access to the tab workspace without an account.

Keep the token: it is the identity of the tabs and of the audits tied to them.

- **URL:** `https://pageaudit.online/api/guest`
- **Auth:** `none` — Public, no credential.

**Response `200`**

- `token` (string) — The guest, prefix `pa_`. Send it in `X-Guest-Token`, as Bearer or in `?guest_token=`.

**Example**

```sh
curl -s -XPOST https://pageaudit.online/api/guest
```

## Tabs

### `GET /api/tabs`

The owner's whole workspace, with the active tab's result already rehydrated.

One call draws the whole screen: tabs, the focused tab, its last report, remaining allowance and prices.

- **URL:** `https://pageaudit.online/api/tabs`
- **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. A user session (`sess_…`) also works and takes precedence.

**Response `200`**

Structure: `Workspace`.

- `tabs` (Aba[]) — Every tab of the owner. → see `Aba` under **Structures**.
- `active_id` (string, may be null) — Which tab is in focus.
- `active_result` (AuditGravado, may be null) — The last result of the active tab, so a second call is not needed. → see `AuditGravado` under **Structures**.
- `limit` (int) — How many tabs fit before paying.
- `owner` (string) — Identifier of this workspace's owner.
- `gate` (Gate) — How much of the IP's free allowance remains. → see `Gate` under **Structures**.
- `billing` (object) — Prices and usage, the same `GET /api/billing` returns.

**Errors**

- `401` — No credential, or an invalid one. See this endpoint's auth.

**Example**

```sh
curl -s https://pageaudit.online/api/tabs -H "X-Guest-Token: $PA"
```

### `POST /api/tabs`

Opens a tab for the URL, or focuses the one that already exists for it.

Past the free tab allowance it answers 402 with `accepts[]`: pay and repeat.

- **URL:** `https://pageaudit.online/api/tabs`
- **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. A user session (`sess_…`) also works and takes precedence.

**Body** (`application/json`)

- `url` (string, required) — The URL the tab will follow.
- `alias` (string) — Label to recognise the tab in the list.

**Body example**

```json
{
  "url": "https://example.com/",
  "alias": "optional label"
}
```

**Response `200`**

- `ok` (bool) — Always `true`.
- `tab` (Aba) — The opened tab (or the one that already existed for that URL). → see `Aba` under **Structures**.

**Errors**

- `400` — `url` missing or not http.
- `401` — No credential, or an invalid one. See this endpoint's auth.
- `402` — Quota exceeded. The response carries `accepts[]` (x402, USDC on Base): pay and repeat the same call with `X-PAYMENT`.

**Example**

```sh
curl -s -XPOST https://pageaudit.online/api/tabs -H "X-Guest-Token: $PA" -H 'content-type: application/json' -d '{"url":"https://example.com/"}'
```

### `GET /api/tabs/:id`

One tab with the full report of its last run.

- **URL:** `https://pageaudit.online/api/tabs/:id`
- **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. A user session (`sess_…`) also works and takes precedence.

**Path parameters**

- `id` (string, required) — Tab ID, from `Aba.id`.

**Response `200`**

- `tab` (Aba) — The requested tab. → see `Aba` under **Structures**.
- `result` (AuditGravado, may be null) — The report of the last run; `null` if the tab never ran. → see `AuditGravado` under **Structures**.

**Errors**

- `401` — No credential, or an invalid one. See this endpoint's auth.
- `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose).

**Example**

```sh
curl -s https://pageaudit.online/api/tabs/TAB_ID -H "X-Guest-Token: $PA"
```

### `PATCH /api/tabs/:id`

Renames the tab or puts it in focus.

- **URL:** `https://pageaudit.online/api/tabs/:id`
- **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. A user session (`sess_…`) also works and takes precedence.

**Path parameters**

- `id` (string, required) — ID of the tab to change.

**Body** (`application/json`)

- `alias` (string) — New label of the tab.
- `active` (bool) — `true` focuses this tab (and unfocuses the other).

**Body example**

```json
{
  "alias": "new label",
  "active": true
}
```

**Response `200`**

- `ok` (bool) — Always `true`.
- `tab` (Aba) — The tab with the change applied. → see `Aba` under **Structures**.

**Errors**

- `400` — No changeable field in the body.
- `401` — No credential, or an invalid one. See this endpoint's auth.
- `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose).

**Example**

```sh
curl -s -XPATCH https://pageaudit.online/api/tabs/TAB_ID -H "X-Guest-Token: $PA" -H 'content-type: application/json' -d '{"active":true}'
```

### `DELETE /api/tabs/:id`

Closes the tab. Its audit history keeps existing.

- **URL:** `https://pageaudit.online/api/tabs/:id`
- **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. A user session (`sess_…`) also works and takes precedence.

**Path parameters**

- `id` (string, required) — ID of the tab to close.

**Response `200`**

Structure: `Ok`.

- `ok` (bool) — Always `true` — failure comes as a 4xx/5xx status, not as `ok:false`.

**Errors**

- `401` — No credential, or an invalid one. See this endpoint's auth.
- `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose).

**Example**

```sh
curl -s -XDELETE https://pageaudit.online/api/tabs/TAB_ID -H "X-Guest-Token: $PA"
```

### `POST /api/tabs/:id/run`

Re-audits the tab's URL and stores a new report.

Consumes the same daily allowance as `POST /api/audit` — past it, 402 with `accepts[]`.

- **URL:** `https://pageaudit.online/api/tabs/:id/run`
- **Auth:** `guest` — Guest token (`POST /api/guest`) in `X-Guest-Token: pa_…`, `Authorization: Bearer pa_…` or `?guest_token=pa_…`. A user session (`sess_…`) also works and takes precedence.

**Path parameters**

- `id` (string, required) — ID of the tab to re-audit.

**Response `200`**

- `ok` (bool) — Always `true`.
- `tab` (Aba) — The tab with the new run's score. → see `Aba` under **Structures**.
- `gate` (Gate) — How much of the allowance is left after this run. → see `Gate` under **Structures**.
- `result` (AuditGravado) — The report just stored. → see `AuditGravado` under **Structures**.

**Errors**

- `401` — No credential, or an invalid one. See this endpoint's auth.
- `402` — Quota exceeded. The response carries `accepts[]` (x402, USDC on Base): pay and repeat the same call with `X-PAYMENT`.
- `404` — The resource does not exist (or is not yours — the API does not tell the two apart on purpose).

**Example**

```sh
curl -s -XPOST https://pageaudit.online/api/tabs/TAB_ID/run -H "X-Guest-Token: $PA"
```

### `GET /api/gate`

How many free audits remain for this IP and whether Turnstile is about to be required.

Check before spending a call: it is the number IN FORCE, not the allowance in the documentation.

- **URL:** `https://pageaudit.online/api/gate`
- **Auth:** `none` — Public, no credential.

**Response `200`**

Structure: `Gate`.

- `ip` (string) — IP seen by the edge, already masked.
- `now` (int) — Time of the query, in epoch.
- `configured` (bool) — Whether Turnstile is configured in this environment.
- `free_allowance` (int) — Free audits per day.
- `free_remaining` (int) — How many remain today for this IP.
- `verified_until` (int, may be null) — Until when the verification already done is valid.
- `needs_verification` (bool) — `true` when the next call will ask for Turnstile (human) or 402 (agent).
- `sitekey` (string, may be null) — Turnstile sitekey, for the browser to build the challenge.

## Billing

### `GET /api/billing`

Tab allowance, prices, full x402 configuration and the state of the trial.

- **URL:** `https://pageaudit.online/api/billing`
- **Auth:** `none` — Public, no credential.

**Response `200`**

Structure: `Billing`.

- `provider` (string) — Always `x402` — the only billing protocol accepted.
- `mode` (string) — Seller mode: `live` charges for real, `dev` lets calls through unpaid.
- `network` (string) — USDC network: `base` in production, `base-sepolia` in staging.
- `chain_id` (int) — EVM chain ID of the network above, so the wallet signs on the right chain.
- `pay_to` (string, may be null) — Address that receives the payment.
- `homolog` (bool) — Staging seam on: the loop can be closed without spending USDC.
- `dev` (bool) — Development mode: the 402 is simulated.
- `dev_gate` (string, may be null) — How dev mode is unlocked, when it exists.
- `facilitator` (string) — URL of the facilitator that verifies and settles the payment.
- `asset` (string) — Accepted currency — always `USDC`.
- `asset_address` (string) — USDC contract on the network above.
- `faucet` (string, may be null) — Test-USDC faucet; only on base-sepolia.
- `wallets` (object) — Links to wallets that speak x402 (metamask, coinbase, base_app).
- `product` (string) — Name of the product charging.
- `free_max_tabs` (int) — Free tabs per owner.
- `prices` (Precos) — What each paid action costs, in USD. → see `Precos` under **Structures**.
- `usage` (Uso) — How much of the free allowance has been used. → see `Uso` under **Structures**.
- `trial` (Trial) — The account's trial, when there is a session. → see `Trial` under **Structures**.

**Example**

```sh
curl -s https://pageaudit.online/api/billing -H "X-Guest-Token: $PA"
```

### `POST /api/contact`

Talks to support: a human solves Turnstile, an agent pays $0.10 in x402.

Without a captcha in the body the request is treated as an agent: 402 until paid. The first agent message is free; after that the backoff is 60s doubling up to a 1-hour cap, announced in `Retry-After`.

- **URL:** `https://pageaudit.online/api/contact`
- **Auth:** `none` — Public, no credential.

**Body** (`application/json`)

- `name` (string, required) — What to call the person writing.
- `email` (string, required) — Where to reply.
- `message` (string, required) — What you want to say.
- `form_ts` (int) — When the form was opened; it is the anti-robot of the human path.
- `cf_turnstile_response` (string) — Turnstile response; present only on the human path.

**Body example**

```json
{
  "name": "…",
  "email": "a@example.com",
  "message": "…",
  "form_ts": 0,
  "cf_turnstile_response": "(human)"
}
```

**Response `200`**

- `ok` (bool) — Always `true` when the message was accepted.
- `path` (string) — Which path it came through: human with captcha or paid agent.

**Errors**

- `400` — Required field missing.
- `402` — Quota exceeded. The response carries `accepts[]` (x402, USDC on Base): pay and repeat the same call with `X-PAYMENT`.
- `429` — Agent backoff: wait for `Retry-After`.

**Example**

```sh
curl -s -XPOST https://pageaudit.online/api/contact -H "X-PAYMENT: $PAYMENT" -H 'content-type: application/json' -d '{"name":"Agent","email":"a@example.com","message":"Hello"}'
```

### `POST /api/visit`

Ping from the interface that increments the day's visits. Agents need not call it.

Smoke does not count: `X-MM-Smoke`, User-Agent `mm-smoke` or `smoke: true` in the body come in as `counted: false`.

- **URL:** `https://pageaudit.online/api/visit`
- **Auth:** `none` — Public, no credential.

**Body** (`application/json`)

- `p` (string) — Path of the visited page.
- `smoke` (bool) — `true` marks the call as a test and it does not enter the count.

**Body example**

```json
{
  "p": "/"
}
```

**Response `200`**

- `ok` (bool) — Always `true`.
- `counted` (bool) — Whether the visit entered the day's count.
- `reason` (string, optional) — Why it did not count, when `counted` is `false`.

**Example**

```sh
curl -s -XPOST https://pageaudit.online/api/visit -H 'content-type: application/json' -d '{"p":"/","smoke":true}'
```

### `GET /api/metrics`

Metrics of the last 7 days and the most frequent findings across audits. With the operator token, includes payments.

Without credentials it returns visits, usage and accounts. With `METRICS_TOKEN` as Bearer it adds `payments` — and only on Base mainnet, because staging numbers on a finance panel mislead.

- **URL:** `https://pageaudit.online/api/metrics`
- **Auth:** `none` — Public, no credential.

**Headers**

- `Authorization` (string) — `Bearer <METRICS_TOKEN>` to include the finance block.

**Response `200`**

Structure: `Metricas`.

- `app` (string) — Product name.
- `today` (string) — Reference day (UTC, YYYY-MM-DD).
- `today_visits` (int) — Visits counted today.
- `today_contacts` (int, optional) — Contact messages received today. Only with `METRICS_TOKEN`: contact does not leave without a token.
- `days` (object[]) — One record per day of the window, with the counts of each metric.
- `usage` (object) — Usage per product resource — here, audits and tabs.
- `accounts` (object) — Total guests and accounts.
- `financeiro` (object, optional) — Aggregate of the day: `hoje_usd`, `hoje_count`, `rede`. Only with `METRICS_TOKEN`: money does not leave without a token; the full series is `payments`.
- `payments` (object, optional) — Finance summary; only with METRICS_TOKEN.
- `achados` (object, may be null) — Which findings appear across stored audits: `audits` (total) and `por_codigo[]` with `code`, `n`, `audits` and `fracao_audits`. Aggregate, no URL and no owner; 1 h cache. `null` if the database did not answer.

**Example**

```sh
curl -s https://pageaudit.online/api/metrics -H "Authorization: Bearer $METRICS_TOKEN"
```

## Account

### `GET /api/me`

The session's account, its last 50 audits and the state of the trial.

- **URL:** `https://pageaudit.online/api/me`
- **Auth:** `session` — User session: `Authorization: Bearer sess_…` (obtained by e-mail OTP).

**Response `200`**

- `user` (Conta) — The person who owns the session. → see `Conta` under **Structures**.
- `audits` (AuditGravado[]) — The account's 50 most recent audits. → see `AuditGravado` under **Structures**.
- `trial` (Trial) — The account's trial: how many days, whether active and when it ends. → see `Trial` under **Structures**.

**Errors**

- `401` — No credential, or an invalid one. See this endpoint's auth.

**Example**

```sh
curl -s https://pageaudit.online/api/me -H "Authorization: Bearer $SESS"
```

### `POST /api/auth/start`

Sends the 6-digit code by e-mail to create the account or sign in to it.

- **URL:** `https://pageaudit.online/api/auth/start`
- **Auth:** `none` — Public, no credential.

**Body** (`application/json`)

- `email` (string, required) — E-mail that will receive the code.

**Body example**

```json
{
  "email": "you@example.com"
}
```

**Response `200`**

Structure: `Ok`.

- `ok` (bool) — Always `true` — failure comes as a 4xx/5xx status, not as `ok:false`.

**Errors**

- `400` — E-mail missing or malformed.
- `429` — Too many requests for the same e-mail.

**Example**

```sh
curl -s -XPOST https://pageaudit.online/api/auth/start -H 'content-type: application/json' -d '{"email":"you@example.com"}'
```

### `POST /api/auth/verify`

Exchanges the code for a session — and confirming the e-mail grants the trial on the spot.

It is the alternative to paying: confirming the e-mail is worth a period of full access, without going through the 402.

- **URL:** `https://pageaudit.online/api/auth/verify`
- **Auth:** `none` — Public, no credential.

**Body** (`application/json`)

- `email` (string, required) — The same e-mail as in `/api/auth/start`.
- `code` (string, required) — The 6 digits that arrived by e-mail.

**Body example**

```json
{
  "email": "you@example.com",
  "code": "123456"
}
```

**Response `200`**

- `ok` (bool) — Always `true` when the code matched.
- `token` (string) — Session `sess_…` to use in `Authorization: Bearer`.
- `user` (Conta) — The person who just signed in. → see `Conta` under **Structures**.
- `trial` (Trial) — The trial, with `granted: true` when this call is the one that granted it. → see `Trial` under **Structures**.

**Errors**

- `400` — Wrong or expired code.
- `429` — Too many attempts.

**Example**

```sh
curl -s -XPOST https://pageaudit.online/api/auth/verify -H 'content-type: application/json' -d '{"email":"you@example.com","code":"123456"}'
```

### `POST /api/auth/claim`

Moves the guest's audits and tabs to the signed-in account.

- **URL:** `https://pageaudit.online/api/auth/claim`
- **Auth:** `session` — User session: `Authorization: Bearer sess_…` (obtained by e-mail OTP).

**Body** (`application/json`)

- `guest_token` (string, required) — Guest `pa_…` whose content moves to the account.

**Body example**

```json
{
  "guest_token": "pa_…"
}
```

**Response `200`**

- `ok` (bool) — Always `true`.
- `claimed` (int) — How many records changed owner.

**Errors**

- `400` — `guest_token` missing.
- `401` — No credential, or an invalid one. See this endpoint's auth.

**Example**

```sh
curl -s -XPOST https://pageaudit.online/api/auth/claim -H "Authorization: Bearer $SESS" -H 'content-type: application/json' -d '{"guest_token":"pa_…"}'
```

### `POST /api/auth/logout`

Invalidates the current session.

- **URL:** `https://pageaudit.online/api/auth/logout`
- **Auth:** `session` — User session: `Authorization: Bearer sess_…` (obtained by e-mail OTP).

**Response `200`**

Structure: `Ok`.

- `ok` (bool) — Always `true` — failure comes as a 4xx/5xx status, not as `ok:false`.

**Errors**

- `401` — No credential, or an invalid one. See this endpoint's auth.

**Example**

```sh
curl -s -XPOST https://pageaudit.online/api/auth/logout -H "Authorization: Bearer $SESS"
```

## Credit

### `POST /api/credito`

Top up prepaid credit: pay once with x402 and get the token that debits on any API of the house.

- **URL:** `https://pageaudit.online/api/credito`
- **Auth:** `none` — Public, no credential.

**Query**

- `usd` (int, required) — Package: 1, 5, 10 ou 25 dollars.

**Response `200`**

- `token` (string) — Bearer token for the balance (`cred_…`). Shown ONCE — it cannot be recovered.
- `saldo_usd` (string) — Credited balance.
- `guarde` (string) — Warning that the token is the bearer of the credit.
- `usar` (string) — How to present the token on paid routes.
- `saldo_em` (string) — Where to check balance and statement.

**Errors**

- `400` — Package outside the list (1, 5, 10 ou 25).
- `402` — Unpaid — the body carries the x402 `accepts[]`.

**Example**

```sh
curl -s -XPOST 'https://pageaudit.online/api/credito?usd=10'
```

### `GET /api/credito`

Credit balance and statement — the latest movements, without returning the token.

- **URL:** `https://pageaudit.online/api/credito`
- **Auth:** `credito` — Prepaid credit token in `Authorization: Bearer cred_…` (or the `X-Credito` header). Not an account: it is a bearer of balance.

**Response `200`**

- `saldo_micros` (int) — Balance in micro-dollars (1e-6 USD).
- `saldo_usd` (string) — Formatted balance.
- `criado_em` (string) — When the credit was opened.
- `movimentos` (object[]) — Recent credits and debits, with product and resource.

**Errors**

- `401` — No token, or unknown token.

**Example**

```sh
curl -s https://pageaudit.online/api/credito -H 'Authorization: Bearer cred_…'
```

## Structures

### `Audit`

The report of one audit: score, findings and everything observed on the page.

- `id` (string, may be null) — ID of the stored audit; `null` when the database was unavailable.
- `score` (int) — Score from 0 to 100, computed from the findings below.
- `issues` (Achado[]) — Everything found, from most to least severe. → see `Achado` under **Structures**.
- `summary` (ResumoPagina) — What the page declares: title, meta, canonical, OG, headings, links… → see `ResumoPagina` under **Structures**.
- `counts` (ContagemAchados) — How many findings of each severity. → see `ContagemAchados` under **Structures**.
- `headers` (object) — Every header of the target's response. `Set-Cookie` is removed on purpose: it is a third party's credential.
- `htmlTruncated` (bool) — `true` when the page passed 2 MB and was read only that far.
- `jsonLd` (object[]) — The raw JSON-LD blocks, as they were on the page.
- `jsonLdStored` (int) — How many blocks survived the size cap — compare with `summary.jsonLdBlocks`.
- `truncated` (string[]) — What was cut and why: `jsonld_size`, `jsonld_nodes_over_50`, `result_size`. Empty means nothing cut.
- `fixes` (Correcao[]) — The ready fix of each finding, without a model — paste, fill in or decide. The consolidated one is at `_links.patch`. → see `Correcao` under **Structures**.
- `quota` (CotaAudit) — How much is still free and what it costs past that. → see `CotaAudit` under **Structures**.
- `_links` (LinksAudit) — This audit, the patch, the share and the API index. → see `LinksAudit` under **Structures**.

### `AuditGravado`

The same report re-read from the database. It has no `quota` and no `_links` (it is a read, not a run) and gains the date and the share slug.

- `audit_id` (string) — ID of the audit.
- `url` (string) — Final audited URL, after following the redirects.
- `score` (int) — Score from 0 to 100.
- `summary` (ResumoPagina, may be null) — What the page declared at the time of the run. → see `ResumoPagina` under **Structures**.
- `counts` (ContagemAchados) — How many findings of each severity. → see `ContagemAchados` under **Structures**.
- `issues` (Achado[]) — Everything found in that run. → see `Achado` under **Structures**.
- `fixes` (Correcao[]) — The ready fix of each finding; an audit stored before this existed gets the computation on read. → see `Correcao` under **Structures**.
- `jsonLd` (object[]) — The raw JSON-LD blocks stored.
- `headers` (object) — Headers of the target's response, as they were in the run.
- `truncated` (string[]) — What was cut by size when storing.
- `share_slug` (string, may be null) — Public slug, if this audit was shared.
- `created_at` (string) — When the run happened (UTC).

### `Patch`

The consolidated patch of an audit, ready for the agent that builds the site to apply.

- `url` (string, may be null) — Final audited URL.
- `audit` (string, may be null) — Absolute link of the source audit.
- `head` (string) — The deterministic tags, one per line, in <head> order (charset first). Empty when there are none.
- `arquivos` (ArquivoPatch[]) — Files to create at the host root. → see `ArquivoPatch` under **Structures**.
- `moldes` (MoldePatch[]) — What only the owner can fill in. → see `MoldePatch` under **Structures**.
- `sem_patch` (SemPatch[]) — What is a decision or infrastructure. → see `SemPatch` under **Structures**.
- `resumo` (ResumoPatch) — Count per class. → see `ResumoPatch` under **Structures**.
- `como_aplicar` (string) — One-sentence instruction.
- `_links` (object) — `api_index`.

### `Ferramenta`

A micro-tool: the landing of one isolated check, with the same engine as the full audit.

- `slug` (string) — Identifier in the URL, e.g. `title-tag-checker`.
- `title` (string) — Page title, used in `<title>`.
- `h1` (string) — The landing's H1.
- `description` (string) — Meta description of the landing.
- `lead` (string) — Opening paragraph.
- `category` (string) — Grouping of the tool in the hub.
- `icon` (string) — Name of the icon used in the card.
- `checks` (string[]) — Finding codes this tool highlights — they are the `Achado.code`s.
- `serp` (object) — How the result looks in the search preview.
- `sections` (object[]) — Content blocks of the landing.
- `_links` (object) — This tool in JSON and in HTML.

### `Compartilhamento`

The result of publishing an audit under a non-enumerable slug.

- `ok` (bool) — Always `true`.
- `shared` (bool) — Whether the audit is published at the end of the call.
- `slug` (string) — Public, non-enumerable slug.
- `path` (string) — Path of the report's HTML page.
- `badge` (string) — Path of the score badge SVG.
- `_links` (object) — Report, JSON and badge, as absolute URLs.

### `Badge`

The score badge metadata, to build the README markdown.

- `slug` (string) — Slug of the shared report.
- `score` (int, may be null) — Score shown in the badge.
- `label` (string) — Text on the left of the badge.
- `available` (bool) — `false` when the share was revoked — the SVG turns grey `n/a`.
- `markdown` (string) — The markdown line ready to paste in the README.
- `_links` (object) — The SVG and the report.

### `Workspace`

The owner's whole workspace, with the active tab's result already rehydrated — one call to draw the screen.

- `tabs` (Aba[]) — Every tab of the owner. → see `Aba` under **Structures**.
- `active_id` (string, may be null) — Which tab is in focus.
- `active_result` (AuditGravado, may be null) — The last result of the active tab, so a second call is not needed. → see `AuditGravado` under **Structures**.
- `limit` (int) — How many tabs fit before paying.
- `owner` (string) — Identifier of this workspace's owner.
- `gate` (Gate) — How much of the IP's free allowance remains. → see `Gate` under **Structures**.
- `billing` (object) — Prices and usage, the same `GET /api/billing` returns.

### `Aba`

A workspace tab: one followed URL, with the last result kept.

- `id` (string) — ID of the tab.
- `url` (string) — URL the tab follows.
- `alias` (string, may be null) — Label the person gave the tab.
- `active` (bool) — Whether it is the focused tab in the workspace.
- `audit_id` (string, may be null) — Audit of this tab's last run.
- `score` (int, may be null) — Score of the last run.
- `created_at` (string) — When the tab was opened (UTC).

### `Ok`

Write confirmation with no body of its own to return.

- `ok` (bool) — Always `true` — failure comes as a 4xx/5xx status, not as `ok:false`.

### `Gate`

How much of the daily allowance still exists for this IP, and whether Turnstile is already required.

- `ip` (string) — IP seen by the edge, already masked.
- `now` (int) — Time of the query, in epoch.
- `configured` (bool) — Whether Turnstile is configured in this environment.
- `free_allowance` (int) — Free audits per day.
- `free_remaining` (int) — How many remain today for this IP.
- `verified_until` (int, may be null) — Until when the verification already done is valid.
- `needs_verification` (bool) — `true` when the next call will ask for Turnstile (human) or 402 (agent).
- `sitekey` (string, may be null) — Turnstile sitekey, for the browser to build the challenge.

### `Billing`

Everything that decides whether the next call will cost: the x402 configuration, the prices, the usage and the trial.

- `provider` (string) — Always `x402` — the only billing protocol accepted.
- `mode` (string) — Seller mode: `live` charges for real, `dev` lets calls through unpaid.
- `network` (string) — USDC network: `base` in production, `base-sepolia` in staging.
- `chain_id` (int) — EVM chain ID of the network above, so the wallet signs on the right chain.
- `pay_to` (string, may be null) — Address that receives the payment.
- `homolog` (bool) — Staging seam on: the loop can be closed without spending USDC.
- `dev` (bool) — Development mode: the 402 is simulated.
- `dev_gate` (string, may be null) — How dev mode is unlocked, when it exists.
- `facilitator` (string) — URL of the facilitator that verifies and settles the payment.
- `asset` (string) — Accepted currency — always `USDC`.
- `asset_address` (string) — USDC contract on the network above.
- `faucet` (string, may be null) — Test-USDC faucet; only on base-sepolia.
- `wallets` (object) — Links to wallets that speak x402 (metamask, coinbase, base_app).
- `product` (string) — Name of the product charging.
- `free_max_tabs` (int) — Free tabs per owner.
- `prices` (Precos) — What each paid action costs, in USD. → see `Precos` under **Structures**.
- `usage` (Uso) — How much of the free allowance has been used. → see `Uso` under **Structures**.
- `trial` (Trial) — The account's trial, when there is a session. → see `Trial` under **Structures**.

### `Conta`

The person behind the session.

- `id` (string) — ID of the account.
- `email` (string) — E-mail confirmed by code.

### `Trial`

The paywall-free period that confirming the e-mail grants. It is the alternative to paying.

- `days` (int) — Trial length in days.
- `active` (bool) — Whether it is in force now.
- `days_left` (int, optional) — How many days remain.
- `ends_at` (string, may be null) — When it ends (UTC).
- `granted` (bool, optional) — `true` when THIS call granted the trial.

### `Metricas`

7-day panel. `payments` only shows with the operator token and only on Base mainnet.

- `app` (string) — Product name.
- `today` (string) — Reference day (UTC, YYYY-MM-DD).
- `today_visits` (int) — Visits counted today.
- `today_contacts` (int, optional) — Contact messages received today. Only with `METRICS_TOKEN`: contact does not leave without a token.
- `days` (object[]) — One record per day of the window, with the counts of each metric.
- `usage` (object) — Usage per product resource — here, audits and tabs.
- `accounts` (object) — Total guests and accounts.
- `financeiro` (object, optional) — Aggregate of the day: `hoje_usd`, `hoje_count`, `rede`. Only with `METRICS_TOKEN`: money does not leave without a token; the full series is `payments`.
- `payments` (object, optional) — Finance summary; only with METRICS_TOKEN.
- `achados` (object, may be null) — Which findings appear across stored audits: `audits` (total) and `por_codigo[]` with `code`, `n`, `audits` and `fracao_audits`. Aggregate, no URL and no owner; 1 h cache. `null` if the database did not answer.

### `Achado`

A problem (or a pass) found on the page.

- `severity` (string) — Severity of the finding.
- `code` (string) — Stable check code, e.g. `title_missing`. It is what you filter by.
- `message` (string) — The finding in one sentence, ready to show a person.

### `ResumoPagina`

Everything the page declares about itself. It is the most consulted object of the API.

- `finalUrl` (string) — URL after following every redirect.
- `status` (int) — Final HTTP status of the target.
- `contentType` (string, may be null) — Content-Type of the final response.
- `title` (string, may be null) — Content of `<title>`.
- `metaDescription` (string, may be null) — Content of `<meta name=description>`.
- `canonical` (string, may be null) — Canonical URL declared by the page.
- `robots` (string, may be null) — Content of `<meta name=robots>`.
- `viewport` (string, may be null) — Content of `<meta name=viewport>`.
- `charset` (string, may be null) — Declared encoding.
- `lang` (string, may be null) — Language declared in `<html lang>`.
- `favicon` (string, may be null) — URL of the favicon found.
- `faviconSource` (string, may be null) — How the favicon was found: declared or by the default path.
- `h1s` (string[]) — Every `<h1>` on the page, in order.
- `openGraph` (object) — The `og:*` tags found, key by key.
- `twitter` (object) — The `twitter:*` tags found.
- `jsonLdCount` (int) — How many JSON-LD nodes the page had.
- `jsonLdBlocks` (int) — How many `<script type=application/ld+json>` blocks existed.
- `jsonLdDropped` (bool) — `true` when nodes were dropped for passing the cap.
- `jsonLdTypes` (string[]) — The `@type`s found, e.g. `Organization`, `WebSite`.
- `images` (object) — Image count and how many have no `alt`.
- `links` (object) — Count of internal, external and text-less links.
- `words` (int) — Words in the visible content.
- `hreflang` (object[]) — The declared language alternates.
- `legacy` (object) — Old markup still present (e.g. `<font>`, layout tables).
- `redirects` (object[]) — The redirect chain followed to the final URL.
- `robotsTxt` (object) — What the origin's `robots.txt` says about this URL.
- `sitemap` (object) — Whether the URL appears in the sitemap the origin declares.

### `ContagemAchados`

How many findings of each severity — the summary that fits in a badge.

- `errors` (int) — Serious findings.
- `warnings` (int) — Findings that deserve attention.
- `info` (int) — Observations without severity.

### `Correcao`

The ready fix of one finding. `classe` says whether it is to paste, to fill in or to decide.

- `code` (string) — The same `code` as the finding (`Achado.code`).
- `severity` (string) — Severity of the source finding.
- `classe` (string) — `deterministico` comes whole from the page; `molde` has a `{{…}}` placeholder; `sem_patch` is an instruction.
- `alvo` (string) — Where to apply: `head`, `corpo`, `img`, `arquivo` or `pagina` (instruction).
- `snippet` (string, may be null) — The ready tag (or with a placeholder). `null` for files and for `sem_patch`.
- `arquivo` (object, may be null) — `path` and `conteudo` when the fix is a file at the host root.
- `fonte` (string, may be null) — Where the value came from, or what the page already had (for the template or to check the cut).
- `nota` (string, may be null) — How to apply, or what to decide.

### `CotaAudit`

How much is still free and what it costs past that.

- `free_per_day` (int) — Free audits per IP per day.
- `price_usd` (number) — Price of an audit beyond the allowance, in USD.

### `LinksAudit`

Addresses of the audit just created. Without a stored `id`, only `api_index` comes.

- `self` (string, optional) — This audit, to re-read without re-auditing.
- `patch` (string, may be null) — `GET /api/audits/:id/patch` — the consolidated patch of this audit.
- `share` (string, optional) — Where to publish this audit under a public slug.
- `api_index` (string) — Self-describing API index.

### `ArquivoPatch`

A file to create at the host root.

- `code` (string) — Finding that originated it (`robots_txt_missing`, `sitemap_missing`).
- `path` (string) — Absolute path on the host, e.g. `/robots.txt`.
- `conteudo` (string) — Full content of the file.

### `MoldePatch`

A tag with a marked placeholder: content missing that only the owner knows.

- `code` (string) — Source finding.
- `alvo` (string) — `head`, `corpo` or `img`.
- `snippet` (string) — The tag with `{{PLACEHOLDER}}`.
- `fonte` (string, may be null) — Suggestion taken from the page itself (H1, og:description…), if any.
- `nota` (string) — What to fill in and the limit.

### `SemPatch`

Finding without an automatic fix: it is a decision or infrastructure.

- `code` (string) — Source finding.
- `nota` (string) — What to check or decide.

### `ResumoPatch`

How many fixes of each class.

- `deterministicos` (int) — Ready to paste (head + files).
- `moldes` (int) — With a placeholder.
- `sem_patch` (int) — Instruction only.
- `total` (int) — Findings considered.

### `Precos`

Prices in force, in dollars. Read them here, not from the documentation.

- `extra_tab_usd` (number) — Cost of a tab beyond the allowance.
- `contact_agent_usd` (number) — Cost of an agent contact.

### `Uso`

How much of the free allowance the owner has used.

- `tabs` (int) — Tabs open now.
- `free_slots_left` (int) — Free tabs still available.


## Quota

- Free: audit (`POST /api/audit`) — 10 per IP per day.
- Free: audit — rate ceiling — 300 per IP per hour.
- Free: workspace tabs — 20 per owner.
- Paid: audit beyond the daily allowance — **$0.02** USDC via x402.
- Paid: tab beyond the allowance — **$0.05** USDC via x402.
- Paid: agent contact — **$0.10** USDC via x402.

- Trial: sign up and CONFIRM the e-mail → **90 days** of full access, free. Loop: POST /api/auth/start {"email":"you@example.com"} → code arrives by e-mail → POST /api/auth/verify {"email":"...","code":"123456"} → 90 days without paywall

Past the allowance → **402** with `accepts[]` (x402, USDC on Base). Pay and repeat the same call with `X-PAYMENT`. A human in a browser solves Turnstile and does not pay. Free alternative: sign up and confirm the e-mail (trial below).

Numbers in force: https://pageaudit.online/api/billing