Stable API · version 1

MVAS/DCB compliance intelligence, built into your workflow.

Run evidence-backed landing-page and funnel checks, manage monitoring, consume the public rules catalog, and receive signed change events. The API never mutates live ad campaigns.

request

curl -X POST https://mvasdaddy.com/api/v1/scans \
  -H "x-api-key: $MVASDADDY_API_KEY" \
  -H "content-type: application/json" \
  -d '{"url":"https://offer.example/sa","geo":"SA","carrier":"zain","platforms":["google_ads"]}'

Authentication

All endpoints except Rules require an API key in the x-api-key header. Generate or rotate it from Account settings. Store keys server-side and never ship them in browser code.

Get your API key

Scans

POST

/api/v1/scans

Queue a landing-page scan

GET

/api/v1/jobs/:id

Poll any asynchronous v1 job

GET

/api/v1/scans

List saved scans

GET

/api/v1/scans/:id

Get scan evidence and recommendations

Funnels

POST

/api/v1/funnels

Queue a consent-safe funnel crawl

GET

/api/v1/funnels/:id

Get job status and results

Batch

POST

/api/v1/batch

Queue up to the plan URL limit

GET

/api/v1/batch/:id

Get progress and result summary

Monitors

GET

/api/v1/monitors

List policy monitors

POST

/api/v1/monitors

Create a monitor

GET

/api/v1/monitors/:id

Get monitor and alerts

PUT

/api/v1/monitors/:id

Update cadence, alerts, or status

DELETE

/api/v1/monitors/:id

Soft-delete a monitor

POST

/api/v1/monitors/:id/scan

Trigger an approved scan

Alerts

GET

/api/v1/alerts

List alerts; use ?unread=true

POST

/api/v1/alerts/:id/read

Mark an alert read

Public rules

No API key required. Limited to 20 requests per minute per client IP.

GET

/api/v1/rules

Filter by q, platform, carrier, geo, severity, billing_model, category

GET

/api/v1/rules/:id

Get one public rule

Reports

GET

/api/v1/reports/:id

Get report evidence as JSON

GET

/api/v1/reports/:id/pdf

Get print-ready HTML for browser PDF export

Webhooks

Pro and Agency accounts can register up to 10 HTTPS endpoints for scan.completed, alert.triggered, and monitor.status_changed. Deliveries retry three times with exponential backoff.

POST

/api/v1/webhooks

GET

/api/v1/webhooks

List endpoints without signing values

POST

/api/v1/webhooks/test

Send a signed test using { id }

Verify the signature

expected = HMAC_SHA256(raw_request_body, signingKey)
header   = "sha256=" + expected
compare header to X-MVASDaddy-Signature using constant-time comparison

Rate limits

Plan	API calls/day	Rule API
Free	20	20/minute/IP
Pro	500
Agency	5,000

Quota failures use HTTP 402 with plan_limit_exceeded. Burst controls can additionally return 429.

Error contract

Example

{"success":false,"error":"validation_error","message":"Human-readable detail"}

400	Invalid input
401	Missing or invalid API key
402	Plan or usage limit
403	Insufficient workspace role
404	Resource not found
429	Rate limited
500	Safe internal failure

Changelog

v1 · July 2026

Initial stable namespace: asynchronous scans, funnels, batches, team-aware monitors, alerts, public rules, reports, metered authentication, and signed webhooks.