Integrate an InfraCheck analysis

Quick start

1. Request beta access from TechAtelier.
2. Create a key in your private developer area.
3. Store it in a server-side secrets manager.
4. Call the endpoint with the Bearer header.

curl -X POST https://infra.techatelier.fr/api/v1/scans \
  -H "Authorization: Bearer $TECHATELIER_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: scan-example-com-001" \
  -d '{"domain":"example.com","webhook_url":"https://example.com/webhooks/techatelier"}'

Endpoints

The JSON body accepts one required field, domain, containing a domain name or URL.

{"domain":"https://example.com"}

Response and status

A 202 Accepted response confirms that the scan was queued. Poll status_url until the status is completed or failed.

{
  "request_id": "req_0123456789abcdef",
  "data": {
    "id": "scan_0123456789abcdef0123456789abcdef",
    "status": "queued",
    "domain": "example.com",
    "created_at": "2026-09-13T20:00:00+00:00",
    "status_url": "/api/v1/scans/scan_0123456789abcdef0123456789abcdef"
  }
}

When the status is completed, data.result contains the complete v1 analysis contract. A failed scan exposes a safe error code and message.

Paginated history

GET /api/v1/scans returns only scans created with the same API key. Use limit (1 to 100), the optional status filter and pass next_cursor as the cursor parameter for the next page.

List and detail requests do not consume the monthly scan allowance.

Signed webhooks

Add the optional webhook_url field when creating a scan. TechAtelier stores a scan.completed or scan.failed event in a durable queue. The first delivery is immediate, followed by up to four retries after 1, 5, 15 and 60 minutes.

{
  "domain": "example.com",
  "webhook_url": "https://example.com/webhooks/techatelier"
}

A scan detail response exposes webhook.attempt_count, webhook.attempted_at, webhook.delivered_at, webhook.last_status_code and webhook.last_error to diagnose the latest delivery. The webhook.deliveries array keeps the ten most recent automatic or manual deliveries, their status and next attempt.

curl -X POST https://infra.techatelier.fr/api/v1/scans/{scan_id}/webhook \
  -H "Authorization: Bearer $TECHATELIER_API_KEY"

This retry reuses the existing result: it does not rerun the scan or consume the allowance. It is available only for a finished scan that has a configured webhook.

Verify X-TechAtelier-Signature by computing HMAC-SHA256(timestamp + "." + raw_body, SHA256(API_key)). The header contains v1=<hex signature> and the timestamp is provided in X-TechAtelier-Timestamp. Reject stale timestamps and use a constant-time comparison.

Retry without creating duplicates

Send a unique Idempotency-Key header for each new scan. If a connection failure requires the exact same request to be retried, reuse that value: the API returns the existing scan with Idempotent-Replayed: true and does not consume the allowance again. Reusing a key with a different domain or webhook returns 409 idempotency_conflict.

Plans and rate limits

API Free includes 100 scans per month. API Starter raises the allowance to 1,000 scans for €19 per month, while API Pro includes 5,000 scans for €49 per month. Higher volumes are available with custom pricing. Paid plans are enabled on request during the rollout phase.

Only a newly created scan is counted; invalid requests, reads, webhook retries and idempotent replays do not consume the allowance. Compare API plans.

Errors

{"error":{"code":"invalid_domain","message":"The domain is invalid.","request_id":"req_0123456789abcdef"}}

Versioning

The major version is part of the URL. TechAtelier may add optional response fields to v1. Removing a field or making an incompatible change requires a new major version.

API access

API Free is being opened progressively to approved accounts. Each partner can create up to five active keys, monitor usage and revoke them immediately in the developer area. To enable Starter, Pro or discuss a higher volume, email contact@techatelier.fr.

v1 documentation updated on 15 September 2026.