Scout · Endpoints

Checks

Raw verification primitives — visibility/occlusion, security headers/TLS, axe a11y, and tech stack facts. Scout returns measurements and nodes, not letter grades.

Visibility

POST/v1/checks/visibilityAPI key

Measure whether a selector is visible / occluded (elementsFromPoint samples). Optional expect for attribute/href. 3 credits.

Name	Type	Required	Description
`url`	`string`	required	Page to open.
`selector`	`string`	required	CSS selector to measure.
`dismiss_cookie_banner`	`boolean`	optional	Best-effort known CMP accept before measuring.
`scroll_into_view`	`boolean`	optional	Scroll target into view before sampling (default true).
`ignore_selectors`	`string[]`	optional	Overlays to ignore when detecting coverage.
`expect`	`object`	optional	Optional attribute name/value or href_contains pass/fail.
`wait_for_selector / settle_ms`	`…`	optional	Wait helpers before measuring.

Verify a badge is visible and not covered

Opens the page, optionally dismisses a known cookie banner, then samples whether the selector is on-screen and not occluded.

RequestBody

json

{
  "url": "https://example.com",
  "selector": "a[href*='macro']",
  "dismiss_cookie_banner": true,
  "scroll_into_view": true,
  "expect": { "href_contains": "macrocontent" }
}

Response200 OK

json

{
  "status": "success",
  "check_status": "verified",
  "overall_pass": true,
  "exists": true,
  "visible": true,
  "in_viewport": true,
  "not_covered": true,
  "overlap_detected_by": null,
  "attribute_match": null,
  "href_match": true,
  "error": null,
  "cookie_banner_detected": true,
  "cookie_banner_dismissed": true,
  "cookie_banner_vendor": "onetrust",
  "url": "https://example.com",
  "timestamp": "2026-07-21T15:00:00.000Z",
  "meta": {
    "response_time_ms": 842,
    "final_url": "https://example.com/"
  }
}

Field names: visible and not_covered (not is_visible / occluded). check_status: verified | missing | hidden | wrong_token | unreachable.

curl

curl -X POST https://scout.macrocontent.dev/v1/checks/visibility \
  -H "Authorization: Bearer sk_scout_…" \
  -H "Content-Type: application/json" \
  -d @visibility.json

Security

POST/v1/checks/securityAPI key

TLS fields, response headers, mixed content, CMP signals. 5 credits.

Collect security facts

Return TLS and header measurements for the URL — not a letter grade.

RequestBody

json

{
  "url": "https://example.com",
  "dismiss_cookie_banner": true
}

Response200 OK (truncated)

json

{
  "status": "success",
  "url": "https://example.com",
  "final_url": "https://example.com/",
  "http_status": 200,
  "response_headers": { "content-type": "text/html; charset=utf-8", "…": "…" },
  "data": {
    "security": {
      "tls": {
        "protocol": "TLSv1.3",
        "authorized": true,
        "fingerprint_sha256": "…",
        "subject": "CN=example.com",
        "issuer": "…",
        "valid_from": "…",
        "valid_to": "…",
        "days_remaining": 120,
        "error": null
      },
      "security_headers": {
        "strict-transport-security": "max-age=…",
        "content-security-policy": null,
        "x-frame-options": "SAMEORIGIN"
      },
      "mixed_content": [],
      "cmp_signals": [{ "id": "onetrust", "evidence": "…" }]
    }
  },
  "cookie_banner_detected": true,
  "cookie_banner_dismissed": true,
  "response_time_ms": 1102,
  "timestamp": "…"
}

Accessibility

POST/v1/checks/a11yAPI key

axe-core violations plus contrast/tab/ARIA raw nodes — not a score. 5 credits.

Run axe on a page

Return axe violations and related raw nodes for the URL.

RequestBody

json

{
  "url": "https://example.com",
  "dismiss_cookie_banner": true
}

Response200 OK (truncated)

json

{
  "status": "success",
  "url": "https://example.com",
  "final_url": "https://example.com/",
  "http_status": 200,
  "data": {
    "a11y": {
      "axe": {
        "violations": [
          {
            "id": "color-contrast",
            "impact": "serious",
            "description": "…",
            "help": "…",
            "helpUrl": "https://dequeuniversity.com/…",
            "nodes": [{ "html": "<p class=\"muted\">…</p>", "target": [".muted"], "failureSummary": "…" }]
          }
        ],
        "passes_count": 12,
        "incomplete_count": 1,
        "inapplicable_count": 40
      },
      "axe_error": null,
      "contrast_samples": [],
      "tab_order": [{ "tag": "a", "role": null, "name": "Home", "tabIndex": 0 }],
      "aria": {
        "landmarks": [{ "role": "main", "label": null }],
        "images_missing_alt": 0,
        "buttons_without_name": 0
      }
    }
  },
  "response_time_ms": 2100,
  "timestamp": "…"
}

Tech

POST/v1/checks/techAPI key

CMS / framework / analytics fingerprints as facts. 3 credits.

Fingerprint tech stack

Detect CMS / analytics markers as facts — no ranking.

RequestBody

json

{
  "url": "https://example.com",
  "dismiss_cookie_banner": true
}

Response200 OK

json

{
  "status": "success",
  "url": "https://example.com",
  "final_url": "https://example.com/",
  "http_status": 200,
  "data": {
    "tech": {
      "cms": [],
      "frameworks": [{ "id": "vue", "evidence": "…" }],
      "analytics": [{ "id": "gtag", "evidence": "googletagmanager" }],
      "generators": []
    }
  },
  "response_time_ms": 900,
  "timestamp": "…"
}