API

GET /api/check

Returns the complete report as JSON. One query parameter:

curl "https://nattvakt.com/api/check?domain=example.com"

domain - the domain to scan (with or without https:// or www.; both are stripped). Invalid input returns HTTP 400; a non-existent domain returns { "nxdomain": true }.

Response shape (trimmed):

{
  "domain": "example.com",
  "grade": "B",
  "pct": 78,
  "pass": 7,
  "total": 9,
  "dns":     { "A": ["93.184.216.34"], "AAAA": [], "NS": ["a.iana-servers.net"], "MX": [] },
  "mail":    { "spf": { "status": "pass", "value": "v=spf1 -all" },
               "dmarc": { "status": "pass", "policy": "reject" },
               "dkim": [] },
  "dnssec":  { "status": "pass", "keys": 2 },
  "tls":     { "status": "pass", "issuer": "…", "expires": "2026-10-29", "daysLeft": 88 },
  "headers": { "reachable": true, "hsts": true, "csp": false, "httpsRedirect": true },
  "findings": [
    { "level": "warn", "text": "No Content-Security-Policy header.",
      "fix": "Add a Content-Security-Policy. Start in report-only mode, then enforce.",
      "guide": "http-security-headers-guide" }
  ]
}

The grade is A (≥88% of checks pass), B (≥70%), C (≥50%) or D. Every entry in findings carries a fix string and, where one exists, a guide slug you can link to at /guides/<slug>.

GET /api/stats

Aggregate usage statistics - totals, grade distribution, the most common gaps and a 14-day trend. Only aggregate counts; no domains or personal data.

curl "https://nattvakt.com/api/stats"

Images

Two SVG endpoints, edge-cached and safe to hotlink:

https://nattvakt.com/badge/<domain>.svg   # shields-style health badge
https://nattvakt.com/og/<domain>.svg      # 1200×630 social card

Fair use

The API is free and unauthenticated. Responses are cached briefly at Cloudflare's edge; please keep request rates reasonable so it stays free for everyone. No rate limit is enforced today - don't make us add one.