AccessPreflightAPI documentation
Open console
Scan workflows

Scan a URL or supplied HTML

URL scans render a public page in an isolated Chromium worker and run supported web checks. Supplied HTML scans analyze content you provide and disable external network access by default.

Public URL scan

Use a fully qualified http or https URL. The worker validates redirects and subresources against the safe-egress policy. Private, loopback, link-local, metadata, credential-bearing, and otherwise unsafe destinations are rejected.

{
  "project_id": "prj_REPLACE_ME",
  "environment": "test",
  "asset": {
    "type": "url",
    "url": "https://example.com/products",
    "viewport": "desktop",
    "wait": {
      "strategy": "dom_ready",
      "timeout_ms": 15000
    }
  },
  "profiles": ["wcag-2.2-aa-web@1.2.0"]
}

The response records the normalized submitted URL in the tenant-scoped scan. A website can redirect or change between runs, so preserve the scan timestamp and engine versions when comparing evidence.

Choose a wait strategy deliberately

Strategy Use when Trade-off
dom_ready Server-rendered pages and most conventional sites Fastest; late client content may not be present
network_idle The application loads important content after DOM ready Slower; analytics and long polling can delay readiness
selector One stable element proves the tested state is ready Most precise; brittle selectors can time out

A wait strategy is not an authentication journey. Stage 1 scans one unauthenticated page state; it does not log in, crawl the site, complete a checkout, or prove an entire service is accessible.

Desktop and mobile are separate observations

Use desktop for a 1440 × 900 viewport and mobile for a 390 × 844 viewport. Responsive content can differ materially, so scan both when the release depends on both layouts.

Raw HTML up to 1 MiB

For a small self-contained fragment or document, put html directly in the scan request.

{
  "project_id": "prj_REPLACE_ME",
  "environment": "test",
  "asset": {
    "type": "html",
    "html": "<!doctype html><html lang=\"en\"><title>Example</title><main><h1>Example</h1></main></html>"
  },
  "profiles": ["wcag-2.2-aa-web@1.2.0"]
}

External network access is disabled for supplied HTML. A missing remote image or stylesheet reduces relevant coverage; it does not automatically become an accessibility failure.

HTML bundles

For larger HTML or a static bundle, use the server-mediated upload flow with application/zip or text/html, wait until the upload is ready, then create an HTML scan with the upload ID.

{
  "asset": {
    "type": "html",
    "upload_id": "upl_REPLACE_ME"
  }
}

The intake service validates media type, archive expansion, package integrity, and safety limits before the scan can start.

Diagnose a URL failure

When a URL scan is terminal but not completed, inspect failure.code and failure.phase in the scan object. Common classes are safe-egress rejection, DNS/fetch failure, navigation timeout, unsupported content, and engine failure. Do not blindly retry deterministic policy rejections. See scan lifecycle for retry guidance.

Search documentation