One key for the REST API and MCP server

Quick start

Every request authenticates with an API key you create in the app. Point curl, your CI, or any HTTP client at https://app.relvato.com/api/v1.

# 1 — Confirm your key works and see the endpoints
curl https://app.relvato.com/api/v1 \
  -H "Authorization: Bearer rlv_your_key"

# 2 — List the sites Relvato monitors for you
curl https://app.relvato.com/api/v1/sites \
  -H "Authorization: Bearer rlv_your_key"

# 3 — Read recent runs (optionally scoped to one site)
curl "https://app.relvato.com/api/v1/runs?limit=10" \
  -H "Authorization: Bearer rlv_your_key"

# 4 — Trigger an on-demand scan of a site
curl -X POST https://app.relvato.com/api/v1/sites/SITE_ID/scan \
  -H "Authorization: Bearer rlv_your_key"

Authentication

Send your key on every request as Authorization: Bearer rlv_your_key (an x-api-key header works too). A missing, revoked, or unknown key returns 401.

Create and revoke keys under API access in the app. Keys start with rlv_, are shown once at creation, and act on your whole account — treat them like a password.

REST endpoints

Every endpoint is scoped to the account behind the key and returns JSON. Base URL https://app.relvato.com/api/v1.

Example: list sites

{
  "sites": [
    {
      "id": "st_1a2b3c",
      "name": "style4street",
      "url": "https://style4street.com",
      "connectionType": "wordpress"
    }
  ]
}

Example: recent runs

A run that failed but was later resolved (baseline accepted or ignored) reports status: "passed" with resolved: true.

{
  "runs": [
    {
      "id": "rn_9f8e7d",
      "siteId": "st_1a2b3c",
      "journey": "checkout",
      "status": "passed",
      "startedAt": "2026-08-31T09:15:00.000Z",
      "durationMs": 4210,
      "resolved": false
    }
  ]
}

Rate limits

Requests are limited per minute, per account, across REST and MCP combined. Your plan sets the ceiling:

Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. Over the limit returns 429 with a Retry-After header.

Status codes

MCP server (for AI agents)

Relvato is also a remote Model Context Protocol server, so an agent like Claude can list your sites, read runs, and trigger scans in a conversation. It uses the same key and the same rate limit as the REST API.

Endpoint https://app.relvato.com/api/mcp

Add it as a remote HTTP connector. In a client that reads an mcp.json, the entry looks like this:

{
  "mcpServers": {
    "relvato": {
      "type": "http",
      "url": "https://app.relvato.com/api/mcp",
      "headers": {
        "Authorization": "Bearer rlv_your_key"
      }
    }
  }
}

Frequently asked questions