Documentation · for humans and robots

Santos API documentation

Everything you need to call the Santos Website Intelligence API: seven machine-payable capabilities on Base mainnet, free daily demos, a remote MCP server, and stable machine-readable contracts. No account and no traditional API key — payment happens inside the HTTP request via x402.

First call in 30 seconds

Every paid capability has a free demo sharing one daily quota (1 request per day per IP), returning the exact same response shape as the paid tier — inspect the format before integrating payment.

# Free demo — no payment, no account (1/day per IP)
curl 'https://api.santosautomation.com/api/audit/demo?url=https%3A%2F%2Fexample.com'

# Paid tier — any x402 v2 client automates payment:
npm install @x402/fetch @x402/evm viem
import { wrapFetchWithPayment } from "@x402/fetch";
import { ExactEvmScheme } from "@x402/evm";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.PRIVATE_KEY); // holds USDC on Base
const fetchWithPay = wrapFetchWithPayment(fetch, [new ExactEvmScheme(account)]);

const res = await fetchWithPay(
  "https://api.santosautomation.com/api/audit?url=https%3A%2F%2Fexample.com"
);
const report = await res.json(); // paid, settled, done

Paying with x402

An unpaid request returns HTTP 402 with full machine-readable terms — before any payment moves. Sign an EIP-3009 transferWithAuthorization for the quoted amount and retry. Payment settles only after a successful response: failed audits, unreachable targets, timeouts, and non-conforming extractions cost nothing.

# The three-step flow (automated by any x402 v2 client)
GET /api/audit?url=example.com
← 402 · PAYMENT-REQUIRED header (base64 JSON: amount, asset, payTo, network)
→ retry with PAYMENT-SIGNATURE header (signed EIP-3009 authorization)
← 200 · result + PAYMENT-RESPONSE header (base64 on-chain receipt)
TermValue
Protocolx402 v2 (v1 X-PAYMENT clients are not supported)
Networkeip155:8453 — Base mainnet
AssetUSDC · 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913
Pay to0x3F8173bbb64ffAcA8793C9c46518Ba2369277E8B
Schemeexact — the 402 quotes the exact atomic USDC amount
Human optionNo wallet? A one-time $5 Agent Readiness Report by card (Stripe), emailed as a private link

The 402 also carries an x402 Bazaar discovery extension with input/output JSON Schemas, so catalogs can index each resource automatically.

Seven capabilities, one payment model

All prices are USDC per successful call. Every capability audits or processes one public page per call — no crawling, no login-protected content, private networks blocked.

CapabilityEndpointPriceMode
Safe FetchGET /v1/fetch$0.002Synchronous
Content ExtractionPOST /v1/extract$0.005Synchronous
Screenshot & PDF RenderGET /v1/screenshot$0.01Synchronous
Quick Intelligence AuditGET /api/audit$0.015Synchronous
Agent Readiness AuditGET /api/agent-readiness$0.075Synchronous
Structured ExtractionPOST /v1/extract/structured$0.08Synchronous
Deep Website Intelligence AuditPOST /v1/audits$0.225Asynchronous job

Safe Fetch

GET /v1/fetch

$0.002 USDC · Synchronous · settles on a successful fetch

One URL in, raw text body out through a hardened SSRF-guarded fetcher — final URL after redirects, HTTP status, selected headers, byte count, and timing included. Text formats only: HTML, JSON, XML, feeds, plain text, JavaScript, SVG. A POST variant accepts a JSON {"url"} body.

url
required — public HTTP/HTTPS URL, max 2048 chars
curl 'https://api.santosautomation.com/v1/fetch?url=https%3A%2F%2Fexample.com%2Ffeed.xml'

Free demo: GET /v1/fetch/demo — same response shape, 1/day per IP (quota shared across all demos).

Content Extraction

POST /v1/extract

$0.005 USDC · Synchronous · settles on a successful extraction

One public page in, clean readability-isolated Markdown out — plus title, description, canonical URL, outbound links, and word count. Built for RAG ingestion, research agents, and summarization pipelines. A GET ?url= variant is paywalled identically. No crawling, no JavaScript rendering.

url
required — public HTTP/HTTPS page
curl -X POST https://api.santosautomation.com/v1/extract \
  -H 'Content-Type: application/json' \
  -d '{"url": "https://example.com/article"}'

Free demo: GET /v1/extract/demo — same response shape, 1/day per IP (quota shared across all demos).

Screenshot & PDF Render

GET /v1/screenshot

$0.01 USDC · Synchronous · settles only when render bytes are returned

A real isolated Chromium browser renders the page — JavaScript executed, so SPAs, client-rendered charts, and post-load layout are captured — and returns PNG, JPEG, or PDF bytes directly with an X-Render-Job header. Every render is a fresh anonymous visitor: no cookies, no login-protected content. A cold worker wakes on demand and may 504 the first try — retry once; timeouts are never charged.

url
required — public HTTP/HTTPS page
format
png (default) · jpeg · pdf
device
desktop 1366×900 (default) · mobile 390×844 @3x with touch
full_page
true captures the whole page height (ignored for pdf)
curl 'https://api.santosautomation.com/v1/screenshot?url=https%3A%2F%2Fexample.com&format=png&device=desktop' \
  --output page.png

Quick Intelligence Audit

GET /api/audit

$0.015 USDC · Synchronous · settles on a successful audit

Fast fetch-and-parse audit of a single public page: 0–100 scores for performance, SEO, accessibility markup, and security headers, an additive website_intelligence_score across Discoverable / Understandable / Callable / Trustworthy, every individual check with pass/fail detail, and a flat issues list of plain-English fixes safe to show a user or another agent.

url
required — public HTTP/HTTPS page
curl 'https://api.santosautomation.com/api/audit?url=https%3A%2F%2Fexample.com'

Free demo: GET /api/audit/demo — same response shape, 1/day per IP (quota shared across all demos).

Agent Readiness Audit

GET /api/agent-readiness

$0.075 USDC · Synchronous · settles on a successful audit

Bounded passive assessment of whether AI agents can discover, understand, select, invoke, and — when applicable — transact with a public service. Classifies the target first so ordinary websites are not penalized for lacking OpenAPI, MCP, or machine commerce. At most eight extra public requests; never authenticates, submits forms, invokes target tools, or sends a payment to the audited site. Humans can alternatively buy a one-time $5 report by card.

url
required — public HTTP/HTTPS page
depth
quick (default and currently the only depth)
curl 'https://api.santosautomation.com/api/agent-readiness?url=https%3A%2F%2Fexample.com&depth=quick'

Structured Extraction

POST /v1/extract/structured

$0.08 USDC · Synchronous · settles only when the output validates against your schema

Send a page URL and your own JSON Schema; an LLM extracts matching fields from the page content and the result is re-validated against your schema before you are charged — non-conforming output returns 422 and costs nothing. Your schema must be a self-contained object (no $ref) under 4000 characters. Page content is truncated to 8000 characters before extraction; model output is capped at 1024 tokens. POST only.

url
required — public HTTP/HTTPS page
schema
required — self-contained JSON Schema object describing the fields to extract
curl -X POST https://api.santosautomation.com/v1/extract/structured \
  -H 'Content-Type: application/json' \
  -d '{
    "url": "https://example.com/pricing",
    "schema": {
      "type": "object",
      "properties": {
        "product": { "type": "string" },
        "price_usd": { "type": "number" }
      },
      "required": ["product"]
    }
  }'

Free demo: POST /v1/extract/structured/demo — same response shape, 1/day per IP (quota shared across all demos).

Deep Website Intelligence Audit

POST /v1/audits

$0.225 USDC · Asynchronous job · settles when the job is accepted (201) — a bounded compute reservation

A real Chromium browser runs Lighthouse mobile lab metrics, rendered axe-core accessibility checks with selectors, network and console evidence, screenshots, and passive security analysis. The 201 response returns job_id, a one-time access_token (save it — it is shown only once), status_url, and report_url. Poll status_url; fetch the versioned report when status is completed. Send an Idempotency-Key header — a retry with the same key and body returns the existing job without a second charge.

url
required — public HTTP/HTTPS page (JSON body)
devices
optional — ["mobile"] (default) and/or "desktop"
modules
optional — lighthouse · accessibility · browser-network · security-passive · agent-readiness · ai-summary
Idempotency-Key
header, strongly recommended — dedupes retries free of charge
curl -X POST https://api.santosautomation.com/v1/audits \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: my-unique-key-001' \
  -d '{"url": "https://example.com"}'

# then, with the returned access_token:
curl 'https://api.santosautomation.com/v1/audits/JOB_ID?token=ACCESS_TOKEN'          # status
curl 'https://api.santosautomation.com/v1/audits/JOB_ID/report?token=ACCESS_TOKEN'   # completed report

Remote MCP server

Agent-native discovery and invocation over Streamable HTTP at https://api.santosautomation.com/mcp — published in the MCP Registry as com.santosautomation/site-audit. Free tools share the daily demo quota; paid tools return the canonical x402 HTTP handoff.

ToolWhat it does
audit_website_previewFree Quick Audit preview (shares the 1/day demo quota)
audit_agent_readinessValidates the target and returns the paid x402 handoff terms
extract_page_markdownFree page-to-Markdown extraction (shared demo quota)
extract_structured_dataFree structured extraction against your JSON Schema (shared demo quota)
curl -X POST https://api.santosautomation.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Machine-readable surfaces

Agents should not need this page. Every contract on it is published in a machine-readable form at a stable URL — these are the canonical sources, updated before any human-facing copy.

Also discoverable via: x402 Bazaar and x402scan listings for every paid endpoint, JSON-LD WebAPI markup with USDC Offers on this site, WebMCP tools registered in the browser via navigator.modelContext, and explicit robots.txt Allow rules for every agent endpoint.

Stable errors, explicit bounds

Every error is JSON with a human-readable error message and a stable machine-readable code. Anything that is not a successful response is not charged.

CodeHTTPMeaning
PAYMENT_REQUIRED402No or invalid payment; full terms are in the PAYMENT-REQUIRED header
AUDIT_FAILED400Invalid or blocked target URL, or a general audit failure
URL_TOO_LONG414Target URL exceeds 2048 characters
UNSUPPORTED_CONTENT_TYPE415Target returned a non-text content type
RESPONSE_TOO_LARGE / TOO_MANY_REDIRECTS422Target exceeded the 5 MB cap (2 MB for Safe Fetch) or 5-redirect limit
INVALID_EXTRACTION_SCHEMA400Structured Extraction: caller schema is missing, oversized, non-object, or uncompilable
STRUCTURED_OUTPUT_INVALID422Structured Extraction: model output did not conform to your schema (not charged)
RATE_LIMITED429Free demo quota exhausted (1/day per IP, shared across all demos)
TARGET_UNREACHABLE502Target site could not be reached (not charged)
SERVICE_UNAVAILABLE503Deep/render tier temporarily has no worker available (not charged)
AUDIT_TIMEOUT504Bounded operation timed out (not charged — retry renders once)
  • Targets: public HTTP/HTTPS only, ports 80/443; localhost, private-network, link-local, and cloud-metadata addresses rejected — including via redirects
  • 15-second fetch timeout · 5 redirects max · 5 MB response cap (2 MB for Safe Fetch) · 2048-character URL cap
  • Free demos: 1 request per day per IP, shared across all demo endpoints
  • Platform rate limit: 240 requests/minute per IP across all API routes
  • Quick tiers do not execute JavaScript; Screenshot and Deep tiers use a real browser

The suite keeps growing

The API grew from one audit endpoint to seven capabilities, and we plan to add new features and capabilities as time allows. Everything ships under the same contract: read-only, one-shot, single-page, x402 pay-per-success — no subscriptions, no accounts, no endpoints that send messages or act on your behalf.

How to track new capabilities

New endpoints always land in openapi.json and llms.txt first, appear automatically in x402 discovery catalogs, and are announced on this page. Have a capability you wish existed? Email info@santosautomation.com — real integration needs move ideas up the list.