Developer

Tool API

JSON API for WebPata tools — Pro plans with API access. Create keys in your account, then call /api/v1.

Authentication

Keys look like wp_live_…. Send either header:

Authorization: Bearer wp_live_…
X-Api-Key: wp_live_…

Full secrets are shown once when you create a key. Upload tools (PDF merge, image compress) are not available via API.

Endpoints

  • GET /api/v1/tools — list enabled tools
  • POST /api/v1/tools/<tool_key> — run a tool (JSON body)
  • GET /api/v1/usage — your recent calls
  • GET /api/v1/openapi.json — OpenAPI schema

Example

curl -s -X POST "https://www.webpata.com/api/v1/tools/meta_preview" \
  -H "Authorization: Bearer wp_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'
Manage API keysPro pricingAll tools

Website tools API for developers and agencies

WebPata’s Tool API lets you run the same checks you use in the browser from scripts, CI jobs, and client dashboards. Instead of opening each tool by hand, you send a JSON request with an API key and get structured results back— meta tags, security headers, broken links, SEO scores, hash helpers, and more.

Access is included on plans with API enabled (Pro by default). Create keys under your account, keep secrets out of git, and rotate keys if a laptop or deploy token is compromised. File-upload tools such as PDF merge and image compress stay browser-only; everything else that works as JSON is available through /api/v1.

Why use an API instead of the web UI

  • Automate weekly site health checks across many domains
  • Hook SEO or accessibility scans into pull-request pipelines
  • Build internal tooling without reimplementing crawlers and parsers
  • Log usage per key so you can see which integrations burn quota

Authentication and safety

Keys start with wp_live_. Send them as Authorization: Bearer … or X-Api-Key. The full secret is shown once at creation; WebPata stores only a hash. Prefer short-lived automation keys named after the job (for example “nightly crawl” or “client-portal”) and revoke unused keys from Account → API keys. Outbound URL tools still use the same public-URL and SSRF guards as the interactive tools.

Typical request flow

  1. List enabled tools with GET /api/v1/tools
  2. Call POST /api/v1/tools/<tool_key> with a JSON body (often {"url":"https://…"})
  3. Inspect GET /api/v1/usage or the account usage table when debugging rate limits
  4. Download the live schema from OpenAPI JSON for codegen clients

Daily limits apply per key and tool. When a limit is hit you receive HTTP 429 with a clear error message. Keep request bodies under the documented size cap and avoid pasting secrets into payloads that may appear in usage summaries.

What you can automate

  • SEO audit, Site Report, performance, and accessibility scans
  • Meta preview, schema validation, tag detection, canonical/hreflang checks
  • Security headers, redirect chains, crawl health, keyword density, screenshots
  • Developer helpers: JSON tools, regex, minify/beautify, hash/encode, word count, diff

Browse interactive versions of the same features on the tools hub, then wire Pro automation when your process needs repeatable runs. Compare plan limits on pricing.

Frequently asked questions

Is the Tool API free?

No. API keys require an active plan with API access enabled. Pro includes it by default; admins can toggle the flag per plan.

Can I upload PDFs or images through the API?

Not in v1. Merge/compress PDF and image resize tools remain web-only so we can keep upload handling and quotas simple.

Where do I create and revoke keys?

Sign in, open Account → API keys, create a named key, copy the secret once, and revoke anytime.

How do I explore the full contract?

Use /api/v1/openapi.json for machines and this page for a human overview. Disabled tools are omitted from the live list and OpenAPI paths.