REST API

Bearer-token API for starting scans and reading status. Available on Pro and Agency plans.

Setup

Create an API key in Dashboard → Integrations. The full key is shown once — store it in your secrets manager.

Create an API key
Export it in your shell or CI secrets as WPAQ_API_KEY
Send Authorization: Bearer on every request below

Authentication

Every request needs your API key in the Authorization header.

Shell

export WPAQ_API_KEY="wpaq_..."

curl -sS -X POST "https://wpaq.com/api/v1/scans" \
  -H "Authorization: Bearer $WPAQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

Start a scan

Submit a public URL. The response includes a scan id to poll.

POST/api/v1/scans

Required body field: url. Pro and Agency plans may also send crawl_mode and url_list.

JSON body

{
  "url": "https://example.com",
  "crawl_mode": "bfs",
  "url_list": ["https://example.com/page-a"]
}

crawl_mode: bfs (default), sitemap_only, or url_list
Limits: Pages per scan and monthly scan count follow your plan.

Poll scan status

Repeat until status is completed or failed.

GET/api/v1/scans/{scan_id}

Poll

SCAN_ID="paste-from-create-response"

curl -sS "https://wpaq.com/api/v1/scans/$SCAN_ID" \
  -H "Authorization: Bearer $WPAQ_API_KEY"

When status is completed or completed_with_warnings, open https://wpaq.com/scan/{id} in the browser or fetch findings through the authenticated web API.

Errors & limits

401

Missing or invalid API key.

403

Plan does not include API access.

429

Quota exhausted or queue busy — retry later.