Citaim API
Every check on this site, from one authenticated endpoint. JSON in, JSON out — wire the audits into your own dashboards, CI, or agent workflows.
1. Get a key
Keys are created in your Citaim account and inherit its API plan: a free account gets 100 requests/day per key and 2 keys; Dev and Scale raise both. Sign-in is a one-click email link or a passkey — no password.
Send it on every request as Authorization: Bearer <key> (or x-api-key). Keys are stored hashed and can’t be recovered — save yours somewhere safe; revoke and re-issue from the account any time.
2. Run a check
POST https://citaim.com/api/v1/run
curl -X POST https://citaim.com/api/v1/run \
-H "Authorization: Bearer cs_live_xxx" \
-H "Content-Type: application/json" \
-d '{"tool":"email-deliverability","url":"example.com"}'Response: { "tool": "...", "target": "...", "result": { /* the check report */ } }. Rate-limit headers (x-ratelimit-limit, x-ratelimit-remaining) are returned on every call.
Tools
Pass one of these as tool:
| tool | what it checks | input |
|---|---|---|
| domain-audit | Full domain audit | domain |
| dns | DNS & email records | domain |
| ssl | SSL / TLS | domain |
| http-headers | HTTP & security headers | url |
| whois | WHOIS / RDAP | domain |
| email-deliverability | Email deliverability | domain |
| ai-readiness | AI readiness | url |
| llms-txt | llms.txt | origin |
| performance | Speed / TTFB | url |
| core-web-vitals | Core Web Vitals | url |
| security | Security surface | url |
| subdomains | Subdomain finder (CT) | domain |
| link-preview | Link / Open Graph preview | url |
| hsts | HSTS & preload status | domain |
| dnssec | DNSSEC chain of trust | domain |
| agent-readiness | Agent readiness (agent-web signals) | domain |
Limits & errors
- Daily quota per key by account plan: free 100/day (2 keys), Dev 500/day (5 keys), Scale 4,000/day (10 keys); plus a burst cap of 60 requests/minute per IP.
429with an upgrade note when exceeded. 401— missing/invalid/revoked key.400— bad body or a target that isn’t allowed (e.g. a private address).502— the target didn’t respond.- All checks are SSRF-safe and read only public data from the target you pass.
MCP server (for AI agents)
Citaim is also a Model Context Protocol server, so an AI assistant can run these checks itself. Point an MCP-capable client at https://citaim.com/api/mcp (Streamable HTTP, JSON-RPC 2.0). Every tool from the table above is exposed and takes a url.
Anonymous use is limited to 30 messages per minute per IP. Send your API key as Authorization: Bearer <key> and the MCP server uses your plan’s daily quota instead — the calls then show under that key in Account → API.
# tools/list
curl -X POST https://citaim.com/api/mcp \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'