Reference · REST API v1

Rootquill REST API.

Base URL: https://api.rootquill.com. Auth: Authorization: Bearer rq_live_.... JSON in, JSON out.

Auth

POST/auth/signup

Create an account. Body: {email, password, plan}. Returns {apiKey, account}.

POST/auth/login

Exchange email + password for a session API key.

GET/auth/me

Who am I? Returns the account for the Bearer token.

POST/auth/logout

Revokes the Bearer token used for this request.

POST/auth/password

Change password. Body: {currentPassword, newPassword}.

GET/auth/keys

List your API keys (masked). Marks the one used for this request as current.

POST/auth/keys

Issue a new API key. Body: {label}. Returns the full key — shown once.

DELETE/auth/keys/:key

Revoke an API key.

Sites

GET/v1/sites

List your sites with open / fixed issue counts.

POST/v1/sites

Add a site. Body: {url, label}. 402 if plan limit reached (owners bypass).

PATCH/v1/sites/:id

Update the site's label.

DELETE/v1/sites/:id

Remove a site (keeps historical issues).

Scanner

POST/v1/scan

Scan a URL. Body: {url, siteId?}. Returns new + existing issues. 422 if the target URL can't be fetched.

// response
{
  "siteId": "...",
  "scannedUrl": "https://example.com",
  "newIssues": 4,
  "existingIssues": 0,
  "issues": [{ "kind": "missing-canonical", "severity": "med", ... }]
}

Issues

GET/v1/issues?status=open&siteId=...

List issues, severity-ranked, impact-ranked within severity.

GET/v1/issues/:id

Fetch a single issue.

Fixes

GET/v1/fixes/:issueId/plan?ai=1

Return a step-by-step fix plan + patch. Pass ai=1 to use the AI backend for a tailored plan.

POST/v1/fixes/:issueId/mark

Mark an issue. Body: {status: "fixed" | "skipped" | "in-progress"}.

Analytics

GET/v1/analytics

Totals + per-site breakdown. Numbers computed from your real issue data, plus Cloudflare Analytics (page views, uniques, bandwidth, threats) if the site maps to a zone on your Cloudflare account.

Announcements

GET/v1/announcements

Active announcements targeted at your account.

POST/v1/announcements

Owner-only. Post a new announcement.

Support

GET/v1/support

Your tickets.

POST/v1/support

Open a ticket. Body: {subject, body, priority}.

Admin (owner-only)

GET/v1/admin/metrics

Platform-wide totals: accounts, MRR, sites, issues, tickets, Stripe webhook events.

GET/v1/admin/accounts?q=&status=&plan=&role=

Search / filter accounts.

GET/v1/admin/accounts/:id

Full dossier: sites, issues, keys, tickets.

PATCH/v1/admin/accounts/:id

Update role / status / plan.

POST/v1/admin/accounts/:id/kick

Revoke every API key for an account (without banning).

DELETE/v1/admin/accounts/:id

Hard-delete an account (cascades sites, issues, keys).

GET/v1/admin/tickets

Every open support ticket across the platform.

GET/v1/admin/activity

Recent activity feed: signups, bans, payments.

Webhooks

POST/stripe/webhook

Stripe webhook receiver. Verifies signature with STRIPE_WEBHOOK_SECRET. Not authed — don't call directly.

Errors