RootCrak exposes a FastAPI backend used by the dashboard, marketing tools, agents, and integrations. This page is the human-readable entry point for machine-readable API docs.
OpenAPI specification
GET /api/openapi.json — full OpenAPI 3 document generated from the live FastAPI app.
Versioned alias: GET /api/v1/openapi.json
Health: GET /api/support/health · GET /api/v1/support/health
API versioning policy
- Stable prefix:
/api/v1/*— preferred for new integrations. - Legacy alias:
/api/*remains supported with the same handlers (additive; no silent breaks). - Breaking changes: introduced under a new major prefix (for example
/api/v2/*), not by changing v1 in place. - Deprecation: target ≥90 days notice via OpenAPI description + this page;
Deprecation/Sunsetheaders may appear on doomed operations.
Rate limits
Default public policy: 30 requests / 60 seconds / client IP (some endpoints are stricter). API responses include RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset. HTTP 429 includes Retry-After.
Markdown for agents
Send Accept: text/markdown on /, /about, /contact, /privacy, /developers, and /preflight to receive markdown. Responses set Vary: Accept.
When to use which surface
- Product docs (UI) — /docs explains scanners and dashboard workflows for humans.
- Preflight — /preflight.html and intel.rootcrak.com for paid agent intel (USDC / x402).
- llms.txt — /llms.txt orients AI agents on site structure and preferred links.
- OpenAPI — integrate or explore HTTP endpoints programmatically.
- Public verify pages —
/verify/<domain>HTML for completed public scores.
Notable endpoints
POST /api/v1/scan/drainer(alias/api/scan/drainer) — wallet-drainer pre-checkPOST /api/v1/pricing/contact— contact form submissionsGET /api/v1/platform-stats— high-level platform counters when enabledGET /api/v1/support/health— liveness for the support API process
Authenticated dashboard APIs require a signed-in Firebase user and appropriate plan limits. Do not send secrets in query strings. Agent install scripts under /agent/* are checksum-pinned; treat tokens as credentials.