REST API

Bearer-token API for starting scans and reading status. Available on Business and Agency plans.

Setup

Create an API key in Dashboard → Integrations. The full key is shown once — store it in your secrets manager.

Create an API key
Export it in your shell or CI secrets as WPAQ_API_KEY
Send Authorization: Bearer on every request below

Authentication

Every request needs your API key in the Authorization header.

Shell

export WPAQ_API_KEY="wpaq_..."

curl -sS -X POST "https://wpaq.com/api/v1/scans" \
  -H "Authorization: Bearer $WPAQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

Start a scan

Submit a public URL. The response includes a scan id to poll. Business and Agency plans run full scans with deeper browser checks.

POST/api/v1/scans

Required body field: url. On Business and Agency you may also send crawl_mode and url_list to control how pages are discovered.

JSON body

{
  "url": "https://example.com",
  "crawl_mode": "bfs",
  "url_list": ["https://example.com/page-a"]
}

crawl_mode: bfs (default), sitemap_only, or url_list
Limits: Pages per scan and monthly scan count follow your plan.

Poll scan status

Repeat until status is completed or failed.

GET/api/v1/scans/{scan_id}

Poll

SCAN_ID="paste-from-create-response"

curl -sS "https://wpaq.com/api/v1/scans/$SCAN_ID" \
  -H "Authorization: Bearer $WPAQ_API_KEY"

When status is completed or completed_with_warnings, open https://wpaq.com/scan/{id} in the browser or fetch findings through the authenticated web API.

GitHub Action

Gate pull requests or deploys on a live WPAQ scan without writing your own poll loop.

Store your API key as the repository secret WPAQ_API_KEY, then call the composite Action from the public wpaq-public repo. Optional min-score fails the job when the overall score is too low.

Workflow step

- uses: KushalAzza/wpaq-public/actions/scan@v1
  with:
    api-key: ${{ secrets.WPAQ_API_KEY }}
    url: https://example.com
    min-score: "70"

Full example: wpaq-public examples/github-actions/wpaq-scan.yml. Requires curl and jq on the runner (included on ubuntu-latest). Action source: KushalAzza/wpaq-public/actions/scan.

Errors & limits

401

Missing or invalid API key.

403

Plan does not include API access.

429

Quota exhausted or queue busy — retry later.