API Documentation

The Schema Markup Generator exposes two public JSON endpoints. Both are protected by Turnstile (Cloudflare challenge) on the public web form, or by a free self-serve API key for direct callers. No signup required to use the form; sign up for a free API key for higher rate limits.

Endpoints

POST /api/scan

Start a scan or fetch a cached result for a URL.

Submits a URL for analysis. Returns 200 if a fresh result is cached (within 24 hours), or 202 if the scan is starting in the background. Requires either a valid Turnstile token (from the web form), a free API key, or an internal authentication token.

POST /api/scan Request Body

{
  "url": "https://example.com",
  "turnstileToken": "...",  // if from web form
  "forceRescan": false       // optional
}

Responses

curl Example

curl -X POST https://schema.unomage.com/api/scan \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d '{"url":"https://example.com"}'

Replace YOUR_TOKEN with your self-serve API key (starts with usk_) from your account, or omit the Authorization header and include a valid turnstileToken if calling from a browser context. Omit both token fields entirely to use anonymous (Turnstile-protected) rate limits.

GET /api/report/:domain.json

Fetch the full report for a domain.

Returns the complete scan record for a domain. If the domain has never been scanned, returns 404. Cached results (within 24 hours) do not count against rate limits.

Responses

curl https://schema.unomage.com/api/report/example.com.json

Rate Limits

• 8 fresh scans per IP per hour (anonymous / Turnstile)
• 3 fresh scans per target domain per hour
• 60 fresh scans per hour per self-serve API key

Cached results (within 24 hours) are served instantly and do not count against any of these limits.

Authentication

Three methods to authenticate a request to POST /api/scan: (1) Turnstile token from the web form (browser only), (2) free self-serve API key (Bearer usk_...), or (3) internal authentication token (Bearer ...). GET /api/report/:domain.json needs no authentication.

Self-serve API key (free)

Don't have an API key? Sign up for a free account at /account/signup to generate your own with a higher rate limit.

Authorization: Bearer usk_your_key_here

For AI agents using MCP, skip all authentication and call POST /mcp instead (no token required).