Terms

API terms

What a CrawlCheck API key may be used for, what it may not, and what we keep. Plain terms, version 1, effective 2026-09-23. They apply to every keyed request: /api/v1/*, /api/scan/licensed, /api/batch, /api/depth, /api/graph, /api/receipt.

1. What you may do

• Commercial use is allowed. Scan client sites, prospects, competitors; show results inside your own product; charge your customers for what you build on it.
• Keep and store results. Reports, findings, receipts and graph objects you fetch are yours to retain and display.
• Automate freely within your quota. Batches, deep crawls and polling are what the API is for.

2. What you may not do

• No reselling the API itself — wrapping the endpoints and selling access to them as-is, or sharing one key across separate organisations.
• No bulk export of the dataset through the API. Bulk files are sold separately under a dataset licence (/datasets). The corpus, the directory, the crawler catalogue and the cohort figures are published for reading and citing, not for reconstruction as a competing dataset.
• No representing a CrawlCheck reading as your own measurement. The observer, the identities sent and the seal are part of what the number means.
• No scanning to harm. A scan is a read of public surfaces; using it to probe for weaknesses to exploit, or to flood a site, ends the key.

3. Attribution

When a grade, score, finding or figure from CrawlCheck is shown to an end user, name the source: Measured by CrawlCheck, with the report link where there is one. Internal use needs no attribution.

4. Quotas and limits

Per calendar month (UTC): Developer 2,000 scans · Growth 20,000 · Watch 500 · Agency 5,000 · Network 20,000. One scan = one keyed scan, one deep crawl, or one domain in a batch (charged when the batch is accepted). A separate burst limit of 60 scans per ten minutes per key protects the service. Quotas reset on the first of the month; unused scans do not carry over. Without a key the API allows 20 scans per address per day for personal use.

5. What we keep, and for how long

• A stored report at /r/<id> is kept indefinitely (90 days in the fast store, then from the archive), with its sealed manifest and the bytes each identity received, so a proof can always be re-verified. Unlisted reports stay out of the registry and indexes; private reports open only for the licence holder or the owner.
• The verified owner of a domain can delete everything kept about it at /manage/data; a signed deletion record states what was removed, and the daily seal keeps only a hash.
• The daily measurement series for a domain (grade, sections, findings) is kept indefinitely; it is what change receipts and the finding lifecycle are computed from.
• Usage counters are kept for two months. We record which key ran which scan; we do not record what you do with the result.
• A site owner may opt out of the dataset at /policy; opting out deletes that domain’s dataset records and stops future storage.

6. What a measurement is

A report is what our observer received from a site at a stated moment, under stated identities, scored under a stated rule version. It is not a guarantee of how any search engine or answer engine treats the site. Refused scans carry no grade by design. A finding that accuses a site of something can be checked against the evidence bytes on the report; if the bytes do not support it, tell us and we correct the record rather than the bytes.

7. Keys, billing, changes

• A key is bound to the buyer. Rotate it from /manage at any time; a leaked key should be rotated, not reported.
• Plans bill monthly through Stripe and cancel from /manage (Manage billing) or by email; a cancelled key stops at the end of the paid period.
• Prices are frozen to 2026-10-18. Quota and endpoint changes are announced on /docs/api at least 30 days ahead; a change that reduces what a key can do never applies mid-period.
• Questions: hello@crawlcheck.io.