REST API overview

The public REST API is a read-only, versioned JSON surface for customer integrations: gate CI deploys on open critical issues, feed BI dashboards, or build portfolio views across sites. It reads from the same queries the dashboard uses, so API numbers always match what you see in the app.

Base URL

https://app.theaccessibility.company/api/v1

All endpoints are GET. Any other method returns 405 METHOD_NOT_ALLOWED.

Authentication

The API uses the same bearer tokens as the MCP server, created in Settings → Integrations → MCP tokens. Send the token in the Authorization header:

curl https://app.theaccessibility.company/api/v1/me \
  -H "Authorization: Bearer tac_mcp_..."

• Every endpoint requires the read scope.
• Site-locked tokens only see their site: /sites returns just that site, and requests for any other site (or an issue belonging to one) return 403 SITE_SCOPE_MISMATCH.
• Tokens are shown exactly once at creation. Revocation from Settings → Integrations is immediate.

Response envelopes

Detail endpoints return the resource under data:

{ "data": { "id": "…", "name": "…" } }

List endpoints add a pagination object:

{
  "data": [ … ],
  "pagination": { "limit": 25, "offset": 0, "total": 132 }
}

Errors use a single shape everywhere — see Errors & rate limits.

Pagination

List endpoints accept limit (1–100, default 25) and offset (≥ 0, default 0) query parameters. pagination.total is the total number of matching rows, so you can page with offset += limit until offset >= total.

Endpoints

Endpoint	Description
GET /me	Token introspection: account, scopes, site lock.
GET /sites	Sites with open / critical / serious issue counts.
GET /sites/:siteId	One site with its issue rollup.
GET /sites/:siteId/issues	Paginated, filterable issue list.
GET /issues/:issueKey	Full issue detail: representative finding + affected pages.
GET /sites/:siteId/scans	Scan history with violation / incomplete / pass counts.

Standards scoping

Issue counts and lists are scoped to each site’s configured primary standard (WCAG 2.1 AA by default) — the same yardstick the dashboard uses for its headline numbers.

Auditing

Every successful API request writes an audit event (api.<endpoint>) attributed to the token, and updates the token’s last-used timestamp visible in Settings → Integrations.