Site audit API

POST /v1/site-audit asks for one public page and returns a report: a score from 0 to 100, Lighthouse category scores and top issues, DNS (A, AAAA, MX, NS), SPF, DMARC and DKIM selectors, TLS, security headers, discovered subdomains and timings. Verza does not fetch or render the page. A separate render worker does, and verza returns that report with its usual endpoint name and disclaimer.

The price is $0.50, settled in USDC on Base, and only after the worker returns 200. An empty body or {} is a 402 when the worker can run, so a directory probe sees the payment challenge. A private or loopback host, a bad scheme, or any other invalid body is HTTP 400 after payment is verified, and that call is not settled. If the worker is not configured, busy or unreachable, the response is HTTP 503 with Retry-After and no 402, so you are not asked to pay for a job that cannot run. A URL the worker rejects is HTTP 400 and is not settled. A timeout is HTTP 504 and is not settled. A job usually takes 20 to 60 seconds. Allow about 75 seconds for the call.

Endpoints

Example

POST /v1/site-audit
Content-Type: application/json

{"url":"https://example.com"}

Price: $0.50 USDC on Base (eip155:8453), scheme exact.
The payTo address is the one in /.well-known/x402.json.

Worker accepting, unpaid:
HTTP 402
payment-required: the x402 challenge (amount 500000, which is $0.50 of USDC)

Worker busy, unreachable, or not configured:
HTTP 503
Retry-After: 30
{"error":"busy","retry_after":30}
When the worker is not configured the body is {"error":"audit temporarily unavailable"}.
No 402 is issued.

Worker rejects the URL (passed through, not settled):
HTTP 400
{"error":"url blocked"}

Completed audit:
HTTP 200
{
  "endpoint": "site-audit",
  "url": "https://example.com",
  "final_url": "https://example.com/",
  "fetched_at": "2026-10-22T12:00:00Z",
  "score": 91,
  "score_method": "lighthouse-weighted",
  "lighthouse": {
    "performance": 0.9,
    "accessibility": 0.95,
    "best_practices": 0.92,
    "seo": 0.88,
    "top_issues": [{"id": "lcp", "title": "Largest Contentful Paint", "score": 0.7}]
  },
  "dns": {"a": ["93.184.216.34"], "aaaa": [], "mx": [], "ns": ["ns.example.com"]},
  "email_security": {"spf": "v=spf1 -all", "dmarc": "v=DMARC1; p=reject", "dkim_selectors_found": ["default"]},
  "tls": {"issuer": "Example CA", "valid_to": "2027-01-01T00:00:00Z", "days_left": 70},
  "security_headers": {"present": ["strict-transport-security"], "missing": ["content-security-policy"]},
  "subdomains": ["www.example.com"],
  "timings_ms": {"total": 21000},
  "disclaimer": "..."
}

How you pay

API key. The free tier issues a key at /signup: send it as Authorization: Bearer <key> and calls come off a monthly allowance, no crypto anywhere in that path. Every key comes with a sandbox twin (vz_test_) that never counts against quota and accepts only the documented test inputs, so you can wire up an integration before spending a single call.

Pay per call. Send no key at all and a paid endpoint replies HTTP 402 with the exact payment requirements; an x402 client pays USDC on Base (about two seconds to settle) and retries automatically. No account, no signup, which is what makes it work for autonomous agents.

Either way, invalid input is rejected with a free 400 before any payment is challenged, so you never pay (or spend quota) to learn you made a typo.

Questions

How do I request a site audit?

POST /v1/site-audit with {"url":"https://example.com"}. Only http and https are accepted. The response is the worker report plus endpoint and disclaimer. The price is $0.50.

What if the worker is busy or down?

The response is HTTP 503 with a Retry-After header. The body is {"error":"busy","retry_after":30} when the worker is full, and {"error":"audit temporarily unavailable"} when it is not configured or cannot be reached. Neither response is a 402, and a payment already presented is not settled.

Which URLs are rejected without a charge?

An empty POST or {} is a 402 when the worker is free, so a directory probe sees the payment challenge. After a valid payment, a missing url, a non-http scheme, credentials in the URL, and an obvious private or loopback host (localhost, 127.0.0.1, ::1, 10/8, 172.16/12, 192.168/16, link-local) are HTTP 400 and are not settled. A URL the worker itself rejects is also HTTP 400 and is not settled.

When is the payment taken?

The x402 exact scheme verifies the payment, runs the audit, and settles only if the worker returns HTTP 200. A worker 400, 503 or 504 is returned as that status and is not settled.

How long does it take?

About 20 to 60 seconds, with at most two audits running at once. Allow about 75 seconds. If the worker times out, the response is HTTP 504 {"error":"timeout"} and it is not settled.

Related

South African ID number validation API South African VAT number validation API NCA credit agreement lawfulness API South African KYB and onboarding API South African contact validation API CIPC registration number check Domain age and registry status API IP address screening API Business pre-screen API Risk score API Guides: how the interest rate caps work zaref: NCA maximum interest rates