LinkGlow API

Last updated: August 21, 2026

Base URL and discovery

Production base URL: https://linkglow.io. Start at GET /api/v1 for a JSON index, or fetch https://linkglow.io/openapi.json for the full OpenAPI 3.1 document. Every public operation has a unique operationId, a description, typed parameters, and response schemas so function-calling clients can import the spec directly.

Reachable operations

These endpoints do not require an account cookie. CORS is enabled on the v1 GET routes so a browser-based tool can read product facts. The demo analyzer is a POST and is IP rate-limited.

  • GET /api/v1 (listPublicApi) — catalog of public operations and docs URLs.
  • GET /api/v1/health (getHealth) — { status: "ok" }. No customer data.
  • GET /api/v1/product (getProduct) — when to use LinkGlow, when not to, and how to call it.
  • GET /openapi.json (getOpenApiSpec) — this specification as JSON.
  • POST /api/demo/analyze (analyzePublicDemo) — render a public URL or pasted HTML, classify captured links, return a sanitized snapshot. Does not save an audit.

POST /api/demo/analyze

URL mode: { "url": "https://example.com/page" }. LinkGlow fetches the page through the same render path used by the landing demo. Paste mode: { "html": "<!doctype html>…", "domain": "example.com" } classifies pasted markup against a simulated host and does not spend a URL-render credit.

Limits: 10 requests per IP per minute. A separate monthly budget applies to URL-mode renders. Unauthenticated BotID may reject automated URL-mode traffic with BOT_DETECTED. Use paste mode or GET /api/v1/product when you only need product facts.

JSON errors

Unknown /api/* paths return HTTP 404 with a JSON body, never an HTML app shell. Account APIs return the same JSON shape on 401/403. Every error includes success: false, error (human message), errorCode (stable machine code), hint (what to do next), and docs (URL of this page).

  • NOT_FOUND — path is not a public operation. Read /openapi.json.
  • UNAUTHORIZED — account API without a session. Sign in or use GET /api/v1.
  • FORBIDDEN / INVALID_ORIGIN — mutation rejected (CSRF origin or role).
  • METHOD_NOT_ALLOWED — wrong HTTP method. Demo analyze is POST only.
  • INVALID_REQUEST / INVALID_URL — JSON body missing or URL not a public http(s) URL.
  • RATE_LIMITED — wait for X-RateLimit-Reset and retry.
  • BOT_DETECTED — URL-mode demo rejected automated traffic. Use paste mode or an account audit.

Auth-gated product APIs

Saved audits, schedules, placements, domain groups, exports, and teams are session-authenticated from the web app. They are intentionally absent from the public OpenAPI file. There is no public API key in the launch product. Email support if you need a documented account API; do not invent Authorization headers against /api/audits.