MIST Developer API

API access is plan-configured. Workspace owners/admins create scoped keys in Advanced workspace; keys expire after 90 days and can be revoked immediately. Never commit keys.

Manage workspace access

REST v1

Endpoint: https://misttechnology.net/api/public/v1. Send Authorization: Bearer with your workspace key. Reads are bounded to 100 scans or 5,000 findings and scoped to the key’s workspace.

GET ?resource=scans — scans:read
GET ?resource=findings&scan_id=UUID — findings:read
GET ?resource=compare&scan_id=UUID&baseline_id=UUID — findings:read. Requires fully completed scans of the same site and configured crawl context.
POST — scans:write. Send site_id and baseline_id. Requires ownership verification, a complete equivalent baseline and current plan allowance; returns 202 with a queued scan ID, not completed results. Shopify scans require the dedicated adapter.
401 invalid/revoked/expired key; 403 unavailable plan; 429 rate limit (Retry-After: 60); 409 incomplete/incompatible comparison. Configured minute window defaults to 30 requests.

CI / pull requests

MIST_API_KEY=your-secret node ci/mist.mjs --scan-id CURRENT_UUID --baseline-id BASELINE_UUID

CLI exits 1 for new critical automated violations; exits 2 for unavailable or incomplete evidence. No missing page is treated as fixed. The included GitHub workflow queues scans on same-repository PRs and updates a summary comment from trusted default-branch automation. Configure MIST_SITE_ID and MIST_BASELINE_SCAN_ID repository variables and the MIST_API_KEY secret. Deploy the PR preview to the verified registered site first; fork PRs are skipped. Offline workers and incomplete coverage fail, never pass.

Chrome extension

Manifest V3 source lives in extension/. Load it unpacked in Chrome → Extensions → Developer mode → Load unpacked. The extension performs local axe checks, highlights matching elements and displays WCAG tags, plus current-page outlines. Workspace-linked storage, AI suggestions and secure extension sign-in remain unfinished.

Outgoing events

scan.completed, issue.critical and regression.detected create deduplicated blocked delivery records for saved integrations. Network delivery, signatures, retries and Slack/Teams/Jira/Linear adapters are not enabled or fully implemented.

Preview implementation only. Changes have not been published. Automated checks are not certification.