API reference

• Authentication
• Sites
• GitHub & fix PRs
• Portfolio data
• Reports & billing
• Account
• Rate limits

Authentication

Method	Path	Auth	Notes
POST	/api/auth/signup	none	Body: { agencyName, email, password }. Returns a session token.
POST	/api/auth/login	none	Body: { email, password }. Returns a session token.
POST	/api/auth/forgot-password	none	Body: { email }. Always returns the same generic response.
POST	/api/auth/reset-password	none	Body: { token, newPassword }. Token is single-use, expires in 1 hour.

Sites

Method	Path	Auth	Notes
GET	/api/sites	Bearer token	Lists every site for your agency, with open finding counts.
POST	/api/sites	Bearer token	Body: { url, label? }. Free tier capped at 2 sites. Rate-limited.
GET	/api/sites/:id	Bearer token	Single site detail.
POST	/api/sites/:id/scan	Bearer token	Triggers an on-demand passive scan. Rate-limited.
GET	/api/sites/:id/findings	Bearer token	Open findings by default; ?status=all for full history.
DELETE	/api/sites/:id	Bearer token	Removes the site and its history. On a paid plan the slot stays paid until renewal.
POST	/api/sites/:id/connector-key	Bearer token	Generates a new connection key for the connector module and returns { key, endpoint, token }. The previous key stops working.
POST	/api/sites/:id/sync-lock	Bearer token	Re-reads composer.lock from the connected GitHub repo now.
POST	/api/sites/import/preview	Bearer token	Body: { csv } or { rows: [{ url, label?, clientName?, clientEmails? }] }. Validates rows and flags duplicates without adding anything.
POST	/api/sites/import/discover	Bearer token	Body: { provider: "pantheon", machineToken } or { provider: "acquia", apiKey, apiSecret }. Lists the sites on that host; credentials are not stored.
POST	/api/sites/import	Bearer token	Body: { rows, scanAfter? }. Adds the sites, up to your plan limit.

GitHub & fix PRs

See the GitHub & fix PRs guide for the token permissions these need.

Method	Path	Auth	Notes
PUT	/api/fixpr/:siteId/github	Monitored + Connector	Body: { owner, repo, token, defaultBranch?, composerLockPath? }. defaultBranch defaults to main. The token is encrypted at rest. Reads composer.lock straight away.
POST	/api/fixpr/:siteId/findings/:findingId/create-fix-pr	Monitored + Connector	Opens a fix PR for one confirmed advisory finding. Returns { prUrl, prNumber }; 409 if one is already open.
GET	/api/fixpr/advisories/:advisoryId	Monitored + Connector	Every site in your account affected by one advisory, each with a state: ready, no_github, pr_open or no_fix.
POST	/api/fixpr/advisories/:advisoryId/bulk	Monitored + Connector	Body: { siteIds? }. Opens a fix PR on each ready site (all ready sites if omitted).

Advisories, benchmarks, trends, incidents, stats

Method	Path	Auth	Notes
GET	/api/advisories	Bearer token	Recent advisories from the ingested Drupal.org feed.
GET	/api/benchmarks/:siteId	Monitored + Connector	Cross-site percentile. Null until enough sites exist in the comparison set.
GET	/api/trends/:siteId	Bearer token	Daily open-finding snapshots.
GET	/api/incidents	Bearer token	Open findings grouped by advisory across your whole portfolio.
GET	/api/stats/mean-time-to-patch	Bearer token	Optional ?siteId= to scope to one site.

Reports & billing

Method	Path	Auth	Notes
GET	/api/reports/:siteId.pdf	Monitored + Connector	White-label PDF report, streamed directly.
GET	/api/billing/config	Bearer token	Paddle client token + price IDs, for opening checkout.
GET	/api/billing/overview	Bearer token	Current plan, trial, site count, next payment and any scheduled cancellation.
POST	/api/billing/trial	Owner	Starts the 14-day free trial (30 days if referred).
GET	/api/billing/invoices	Owner	Past payments.
GET	/api/billing/invoices/:txnId/pdf	Owner	A link to download one invoice as a PDF.
POST	/api/billing/payment-method	Owner	Starts a card update.
POST	/api/billing/portal	Owner	A link to the billing portal for billing details and tax ID.
POST	/api/billing/switch-annual	Owner	Moves a monthly subscription to yearly billing, charging the difference now.
POST	/api/billing/cancel	Owner	Body: { reason, feedback? }. Cancels at the end of the paid period.
POST	/api/billing/resume	Owner	Undoes a scheduled cancellation.
GET	/api/growth/referral	Bearer token	Your referral link and the free months earned.

Account

Method	Path	Auth	Notes
GET	/api/agencies/me/export	Bearer token	Full data export: every site, finding, scan and alert rule.
DELETE	/api/agencies/me	Owner	Body: { confirmName } (exact agency name). Cancels any subscription first, then permanently deletes all data.

Not for direct use

These exist for the connector module and Paddle specifically, and require a valid HMAC/webhook signature rather than a Bearer token:

POST	/api/connector/report/:siteId	HMAC signature	Used by the connector module. See the install guide.
POST	/api/billing/webhook	Paddle signature	Paddle subscription lifecycle events.
POST	/api/newsletter/subscribe	CORS-restricted	Used by the marketing site's footer signup. Not intended for other callers.

Rate limits

A general limit applies across the whole API (300 requests / 15 min by default). Site creation and scan triggers share a stricter limit (30 / hour by default). Both return 429 with standard RateLimit-* headers when exceeded.