Getting Started

The Sitechecker Public REST API gives you programmatic access to your projects and to the data behind them — Site Audit findings, page-level details, the saved segments you group pages by, the change history Site Monitoring records over time, Google Search Console and Google Analytics 4 performance, tracked keyword rankings, and how the site shows up in Google AI Overview and AI chat assistants.

Every endpoint is a GET over HTTPS, returns JSON, and is authenticated with a Bearer API key.

The API is in beta

Access is currently open to Premium accounts, and the limits are still being tuned against real traffic — see Access & Limits. SEO Tests are planned for a later stage of the rollout.

Some sections need a connected data source

GSC Insights and the GA4 half of Search Conversion need Google Search Console and Google Analytics 4 connected to the project; AI Traffic reads GA4 as well. Without the connection those endpoints answer 409 rather than returning empty rows — see Errors below.

Quickstart

1. Create an API key in Account Settings → API keys and copy it.

   API KeysStep-by-step, with screenshots of the creation and revoke flow.

2. Put the key in your environment rather than in the command itself, so it stays out of your shell history and out of version control.

   export SITECHECKER_API_KEY="sk_live_..."

3. Call the projects endpoint. It needs no parameters, which makes it the quickest way to confirm the key works.

   curl https://sitechecker.pro/api/v1/projects \
     -H "Authorization: Bearer $SITECHECKER_API_KEY"

4. Take the project_id from the response. Every other endpoint is scoped to a project and takes it as a parameter.

Base URL

All endpoints live under a single versioned prefix:

https://sitechecker.pro/api/v1

This is the host this copy of the docs is built against, and the API reference alongside it defaults to the same one — so the examples below can be run as they are.

Authentication

Send your API key as a Bearer token in the Authorization header of every request. There is no other auth scheme — no session cookie, no key in the query string.

cURL

curl https://sitechecker.pro/api/v1/projects \
  -H "Authorization: Bearer $SITECHECKER_API_KEY"

JavaScript

const response = await fetch('https://sitechecker.pro/api/v1/projects', {
  headers: { Authorization: `Bearer ${process.env.SITECHECKER_API_KEY}` },
});

const { data, meta } = await response.json();

Python

import os
import requests

response = requests.get(
    'https://sitechecker.pro/api/v1/projects',
    headers={'Authorization': f"Bearer {os.environ['SITECHECKER_API_KEY']}"},
)

payload = response.json()

PHP

$ch = curl_init('https://sitechecker.pro/api/v1/projects');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . getenv('SITECHECKER_API_KEY')],
]);

$payload = json_decode(curl_exec($ch), true);

Keep the key server-side

An API key carries the access of the account that created it. Never ship it in front-end code or in a mobile app, where anyone can read it — proxy the call through your own backend instead.

Your first response

List endpoints answer with the same envelope: the rows under data, the counts under meta.

GET /api/v1/projects

{
  "data": [
    {
      "project_id": 12345,
      "project_name": "example.com",
      "url": "https://example.com",
      "domain_scope": {
        "protocols": ["https"],
        "scope_type": "subdomains",
        "path": "/"
      },
      "site_audit_enabled": true,
      "last_crawl_date": "2026-05-12T08:30:00Z",
      "last_crawl_status": "finished",
      "website_score": 78,
      "crawled_pages": 298
    }
  ],
  "meta": {
    "total": 137,
    "limit": 50,
    "offset": 0
  }
}

project_id is the value the rest of the API is keyed on — hold on to it.

Request scope

project_id selects the project; three further parameters narrow a request inside it. Which of them an endpoint accepts is on its reference page.

Parameter	Selects
project_id	The project. Every endpoint below /projects takes it.
segment_id	One saved segment, where the endpoint supports segments. Rank Tracker and AI Visibility group their data differently and do not take it.
crawl_id	One crawl, on the Site Monitoring endpoints.
url	One page — or, on list endpoints, the pages matching it.
date_from, date_to	The reporting period, on the endpoints that report over time.
scope	Which AI Traffic dataset to read. Each scope accepts a different set of filters.

Site Monitoring data is organised by crawl: a summary endpoint returns one point per crawl over the date range you ask for, each carrying the crawl_id that the matching list and details endpoints then take. Treat that value as opaque — copy it from the summary response rather than deriving or guessing it.

Each of GSC Insights, GA4 Insights, Rank Tracker and AI Visibility publishes a filter-values endpoint that lists the values the project actually has data for. Read it before building a filtered request: an unsupported filter, dimension or scope is rejected rather than quietly ignored.

A few reports set their own period rules instead of taking date_from / date_to — GSC Last Found Pages uses a fixed 7, 30, 60 or 90-day lookback, and Rank Tracker SERP Opportunities is a monthly snapshot. The reference page for each says so.

Pagination

List endpoints page with limit and offset, and report the full size of the result set in meta.total, so you can tell how many pages are left before fetching them.

Parameter	Default	Range	Purpose
limit	50	1–100	How many rows to return in one response.
offset	0	from 0	How many rows to skip.

# Rows 101-150 of the result set.
curl "https://sitechecker.pro/api/v1/projects?limit=50&offset=100" \
  -H "Authorization: Bearer $SITECHECKER_API_KEY"

Errors

Failures share one envelope. Branch on error.code — it is the stable machine-readable value; error.message is written for humans and may be reworded.

{
  "error": {
    "code": "INVALID_API_KEY",
    "message": "Invalid or missing API key."
  }
}

Status	error.code	What went wrong
401	INVALID_API_KEY	The key is missing, malformed, or not a key we know.
401	REVOKED_API_KEY	The key was revoked. Issue a new one — this key will not start working again.
403	MISSING_PUBLIC_API_ACCESS	The account has no active API entitlement.
403	ACCESS_DENIED	The requested project belongs to another account.
404	PROJECT_NOT_FOUND, SEGMENT_NOT_FOUND, CRAWL_NOT_FOUND, KEYWORD_NOT_FOUND, OPPORTUNITY_NOT_FOUND, SNAPSHOT_UNAVAILABLE, NOT_FOUND	The resource does not exist, or the key cannot reach it. NOT_FOUND is the generic one — a well-formed id that matches nothing, such as a change that has since been pruned.
409	CRAWL_IN_PROGRESS	The crawl is still running, so there is no audit data to return yet.
409	GSC_NOT_CONNECTED	The project has no Google Search Console connection.
409	GA4_NOT_CONNECTED	The project has no Google Analytics 4 connection.
409	SITE_AUDIT_DATA_UNAVAILABLE	The endpoint joins crawled page content the project does not have yet.
409	AI_OVERVIEW_DATA_UNAVAILABLE	Google AI Overview data has not been collected for this project yet.
422	VALIDATION_ERROR, INVALID_DATE_RANGE, INVALID_FILTER, INVALID_EVENT_TYPE	A parameter is missing, invalid, or a value this endpoint does not accept — error.message names it. A change_id or content_update_id that is malformed, or that belongs to another page, reads as INVALID_FILTER.
422	UNSUPPORTED_FILTER, UNSUPPORTED_DIMENSION, UNSUPPORTED_METRIC, UNSUPPORTED_SCOPE, SEGMENT_FILTER_UNSUPPORTED	The parameter is valid in general, but not for this endpoint or this scope.
429	RATE_LIMIT_EXCEEDED	Too many requests. Wait for the interval in the Retry-After header.
500	INTERNAL_ERROR	Something failed on our side. Safe to retry.
502	UPSTREAM_ERROR	A service the endpoint depends on — SERP data, GA4, Site Audit — is temporarily unavailable.

Retry on 429, not on 422

429, 500, and 502 are worth retrying — back off, and honour Retry-After when it is present. 409 clears once the thing it is waiting on arrives: minutes for CRAWL_IN_PROGRESS, the next sync for AI_OVERVIEW_DATA_UNAVAILABLE, and a change in the project settings for the two *_NOT_CONNECTED codes. 401, 403, 404, and 422 will keep failing until the key or the request changes, so retrying them only burns rate limit.

An unsupported parameter is an error, not a no-op

Every endpoint rejects a query parameter it does not accept, and the newer sections reject a filter, dimension or scope value they do not support — so a request either means what you wrote or fails, rather than quietly returning unfiltered data. When in doubt, read the filter-values endpoint of the section first.

Next steps

Access & LimitsBeta availability, rate limits, pagination caps, and the date ranges endpoints accept.

ChangelogReleases, new endpoints, changed parameters and response fields, and breaking changes.

API referenceEvery endpoint, generated from the OpenAPI spec, with a playground for trying calls.

ProjectsList the projects a key can reach and the project_id every other endpoint needs.

Site AuditCrawl-based issues, the crawled page list, and per-URL page details.

Site MonitoringWhat changed between crawls — content updates, audit-issue changes, and page history.

GSC InsightsSearch Console performance — pages, keywords, rankings, cannibalization, and keyword gap.

GA4 InsightsGoogle Analytics 4 behaviour metrics for the site and for individual pages.

Rank TrackerTracked keyword positions, ranking pages, groups, competitors, and SERP snapshots.

AI VisibilityGoogle AI Overview, AI referral traffic, and brand visibility across AI chat assistants.

AccountAPI access status, plan, active key usage, and how many projects the key can reach.