Accessibility Scan API

Generate a key in Settings. It draws from the same credit balance as scans you run in the dashboard. Send it as a bearer token on every request:

Authorization: Bearer ask_live_xxxxxxxxxxxxxxxxxxxx

The key is shown once, at generation time, and cannot be retrieved again; only its hash is stored. Generating a new key revokes the old one.

Starts a scan and returns immediately with a scan id. Scanning a real page takes 15-30 seconds, so this doesn’t block. Consumes 1 credit.

curl -X POST https://accessisight.com/api/v1/scans \
  -H "Authorization: Bearer ask_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com",
    "tags": ["wcag2aa"],
    "captureScreenshot": true,
    "webhookUrl": "https://your-app.com/webhooks/accessisight"
  }'

Response: 202 Accepted

{
  "scanId": "a1b2c3d4-...",
  "status": "scanning",
  "creditsRemaining": 42
}

Fetch a scan’s current status and results. Poll this until status is completed or failed, or use a webhook instead.

curl https://accessisight.com/api/v1/scans/a1b2c3d4-... \
  -H "Authorization: Bearer ask_live_xxxxxxxxxxxxxxxxxxxx"

Returns the full scan record: status, violations, heuristics, summary, screenshot, and more. Only visible to the key that created it; a scan created via the dashboard is not accessible through the API and vice versa.

Pass webhookUrl when creating a scan to get a POST when it finishes, instead of polling:

{
  "event": "scan.completed",
  "scanId": "a1b2c3d4-...",
  "url": "https://example.com",
  "status": "completed",
  "summary": { "critical": 2, "serious": 5, "moderate": 8, "minor": 3, "total": 18 },
  "timestamp": "2026-08-14T10:32:00.000Z"
}

On a scan failure, you receive event: "scan.failed" with an error field instead of summary.

Verifying a webhook came from us

Every webhook request carries an X-AccessiSight-Signature header in the same t=<unix timestamp>,v1=<hex hmac> shape Stripe uses: HMAC-SHA256 of {timestamp}.{raw request body}, signed with a per-account secret. Find your webhook secret under Settings → API Access, next to your API key. Unlike your API key, it isn’t shown only once, so you can re-view it any time.

const crypto = require("crypto");

function isValidSignature(rawBody, header, secret) {
  const [tPart, v1Part] = header.split(",");
  const timestamp = tPart.split("=")[1];
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${rawBody}`)
    .digest("hex");
  return v1Part === `v1=${expected}`;
}

Verify against the raw request body bytes, before any JSON parsing: re-serializing first can change whitespace/key order and make a genuine signature look invalid. A webhook sent before you’d generated an API key (or if signing failed for any reason) omits this header entirely rather than sending a bad one, so treat a missing header as unsigned, not as a spoofed request.

A separate, open, standalone tool (@accessisight/component-a11y-lint) that lints your React component source code for accessibility issues (missing alt text, unlabeled icon buttons, non-keyboard-operable custom clickables) before a page even renders. A runtime scan only catches what actually rendered during that scan; this catches defects hiding in rarely-used variants, error states, or unopened modals.

npx ts-node --project node_modules/@accessisight/component-a11y-lint/tsconfig.json \
  node_modules/@accessisight/component-a11y-lint/src/cli.ts src/components

Built on the TypeScript compiler API with our own proprietary rule set, with no third-party accessibility rules engine. Exits non-zero on any error-severity finding, so it works as a CI gate.

Uses Storybook? Since this is static-source analysis, a .stories.tsx file is just another .tsx file with JSX in it, so no Storybook runtime is required. Pass --only-stories to lint just your story files as a dedicated CI gate:

npx component-a11y-lint src --only-stories