Accessly API & Webhooks

The CI/CD scan endpoint (/api/v1/scan) authenticates with a Bearer token. Your API key lives in Settings → API Access on your dashboard. Pass it on every request:

Authorization: Bearer <YOUR_API_KEY>

The badge endpoint and webhook receivers are public — no auth needed.

Configure a webhook URL in Settings → Webhooksand we'll POST a JSON payload to it every time a scan completes — both dashboard scans and CI/CD API scans.

Event: scan.completed

{
  "event":     "scan.completed",
  "url":       "https://your-site.com",
  "score":     87,
  "errors":    3,
  "warnings":  12,
  "passes":    104,
  "scannedAt": "2026-05-14T18:24:51.211Z",
  "scanId":    "e3f1a2c0-...",
  "reportUrl": "https://accessly.us/scan/e3f1a2c0-..."
}

Headers

• Content-Type: application/json
• User-Agent: Accessly-Webhooks/1.0
• X-Accessly-Event: scan.completed
• X-Accessly-Signature: sha256=<hmac> — only if signing is enabled

Verifying the signature (Node.js)

import { createHmac, timingSafeEqual } from 'node:crypto'

const body      = await req.text()
const signature = req.headers.get('x-accessly-signature') ?? ''
const expected  = 'sha256=' + createHmac('sha256', process.env.WEBHOOK_SIGNING_SECRET)
  .update(body)
  .digest('hex')

const a = Buffer.from(signature)
const b = Buffer.from(expected)
if (a.length !== b.length || !timingSafeEqual(a, b)) {
  return new Response('Invalid signature', { status: 401 })
}

const event = JSON.parse(body)
console.log(event)  // { event: 'scan.completed', ... }

Delivery semantics: fire-and-forget with a 5-second timeout. We retry on transient failures but don't guarantee at-least-once delivery — your handler should be idempotent on scanId.