TABTAKT.EU API

Automated WCAG 2.1 AA pre-scan, result retrieval, paid reports and fixes (EAA, BFSG, LBI).

Backend of tabtakt.eu. A scan is started by registering a page URL and e-mail address, confirmed through an e-mail link, then run with the Dual Accessibility Engine (DAE) and Lighthouse. State-changing endpoints are bound to the tabtakt.eu web front end: they check the Origin header and, for registration, a Cloudflare Turnstile token. Scan access uses an id plus a per-scan access token k that is only delivered to the verified e-mail owner. The public GET /api/health endpoint needs no credentials.

Machine-readable descriptions

OpenAPI 3.1: /openapi.json
API catalog (RFC 9727): /.well-known/api-catalog, also announced on every page with Link: </.well-known/api-catalog>; rel="api-catalog"
Health: GET /api/health (application/health+json, HTTP 503 when the database is unavailable)

Endpoints

All endpoints, request schemas and response codes (version 1.0.0)
Endpoint	Purpose	Request body	Responses
`GET /api/health`	Service health (database round trip)	-	`200` `503`
`POST /api/register`	Register a free scan and send the confirmation e-mail Requires an Origin header equal to the site origin (browser same-origin call) and Content-Type: application/json; body at most 16 KiB. One free scan per e-mail address; rate limited per IP and per address.	`RegisterRequest`	`200` `400` `403` `409` `429` `500`
`POST /api/verify`	Confirm the e-mail address with the token from the e-mail link Requires an Origin header equal to the site origin (browser same-origin call) and Content-Type: application/json; body at most 16 KiB.	`VerifyRequest`	`200` `403` `404` `409` `410`
`POST /api/scan`	Start (or restart) the scan of a verified registration Requires an Origin header equal to the site origin (browser same-origin call) and Content-Type: application/json; body at most 16 KiB.	`ScanCredentialsRequest`	`200` `403` `404` `429`
`POST /api/result`	Poll the scan result Requires an Origin header equal to the site origin (browser same-origin call) and Content-Type: application/json; body at most 16 KiB.	`ScanCredentialsRequest`	`200` `403` `404`
`POST /api/checkout`	Create a Stripe Checkout session for a paid product Requires an Origin header equal to the site origin (browser same-origin call) and Content-Type: application/json; body at most 16 KiB. Prices: report 74.95 EUR, fix 490.00 EUR (final prices, no VAT under § 19 UStG).	`CheckoutRequest`	`200` `400` `403` `404` `409` `429` `500`
`GET /api/report`	Open a paid report (HTML, printable)	-	`200` `404`

Typical flow

POST /api/register with page URL, e-mail address, language, consent and Turnstile token.
The user opens the e-mail link; the front end calls POST /api/verify and receives id and k.
POST /api/scan starts the scan; POST /api/result is polled until status is done or failed.
Optional: POST /api/checkout returns a Stripe Checkout URL; the paid report opens via GET /api/report.

Access and limits

State-changing endpoints accept only same-origin browser calls from tabtakt.eu (Origin check) and are rate limited.
Errors are JSON objects with a single error code; the full list is in the Error schema.
Stripe webhooks and the scanner callback are signature-verified server-to-server endpoints and are not part of the public API.
Automated testing covers only part of the WCAG success criteria; results are not a certificate of conformity.

Related catalog: nestler.dev API catalog (same publisher).