The grader, as an API.

One call, real data back.

Start an audit with your key. You get a job id back instantly, then poll it or let us POST the result to your webhook when it's done.

cURL

curl -X POST https://grader-api.luxeplatforms.com/v1/audit \
  -H "Authorization: Bearer lxg_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com"}'

# → { "status": "queued", "id": "42", "poll": "/v1/audit/42" }

JavaScript

const res = await fetch("https://grader-api.luxeplatforms.com/v1/audit", {
  method: "POST",
  headers: {
    Authorization: "Bearer lxg_live_your_key",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ url: "https://example.com" }),
});
const { id } = await res.json();

Python

import requests

r = requests.post(
    "https://grader-api.luxeplatforms.com/v1/audit",
    headers={"Authorization": "Bearer lxg_live_your_key"},
    json={"url": "https://example.com"},
)
job_id = r.json()["id"]

Base URL: https://grader-api.luxeplatforms.com · Auth: Authorization: Bearer <key> (server-side only, never ship a key to the browser)

Priced on throughput, not nickel-and-dimed.

The public grader UI stays free for humans. These limits are for programmatic API access. Overage steps down as you scale, so heavier use gets cheaper per audit.

Skip the polling.

Register a webhookon the audit request and we'll POST the completed report straight to you the moment it's done. Same payload as a finished poll.

POST https://you.com/hooks/grader
{
  "event": "audit.completed",
  "result": { "url": "...", "grade": "B", "overall": 88, "categories": [ ... ], "shareId": "..." }
}

Every delivery is signed. Verify the X-Grader-Signature header (t=timestamp,v1=hmac) against your webhook signing secret from the dashboard so you know the call is really from us:

import crypto from "crypto";

const sig = req.headers["x-grader-signature"];        // "t=...,v1=..."
const { t, v1 } = Object.fromEntries(sig.split(",").map((p) => p.split("=")));
const expected = crypto
  .createHmac("sha256", WEBHOOK_SIGNING_SECRET)
  .update(t + "." + rawBody)
  .digest("hex");
const valid = crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));