One key for the REST API and MCP server

Quick start

Every request authenticates with an API key you create in the app. Point curl, your CI, or any HTTP client at https://app.relvato.com/api/v1.

# 1 — Confirm your key works and see the endpoints
curl https://app.relvato.com/api/v1 \
  -H "Authorization: Bearer rlv_your_key"

# 2 — List the sites Relvato monitors for you
curl https://app.relvato.com/api/v1/sites \
  -H "Authorization: Bearer rlv_your_key"

# 3 — Read recent runs (optionally scoped to one site)
curl "https://app.relvato.com/api/v1/runs?limit=10" \
  -H "Authorization: Bearer rlv_your_key"

# 4 — One run in detail, then the fix brief Relvato's AI would answer
curl https://app.relvato.com/api/v1/runs/RUN_ID \
  -H "Authorization: Bearer rlv_your_key"
curl https://app.relvato.com/api/v1/runs/RUN_ID/fix-prompt \
  -H "Authorization: Bearer rlv_your_key"

# 5 — Trigger an on-demand scan of a site (full-access key)
curl -X POST https://app.relvato.com/api/v1/sites/SITE_ID/scan \
  -H "Authorization: Bearer rlv_your_key"

Authentication

Send your key on every request as Authorization: Bearer rlv_your_key (an x-api-key header works too). A missing, revoked, or unknown key returns 401.

Create and revoke keys under API access in the app. Keys start with rlv_ and are shown once at creation. Each key is read-only (everything that reads: sites, health, performance, runs, monitors, updates, activity, fix briefs, alert settings) or full access (also add and configure sites and monitors, run them, review results and apply proposed fixes). Keys made before scopes existed have full access. Treat keys like a password.

REST endpoints

Every endpoint is scoped to the account behind the key and returns JSON. Base URL https://app.relvato.com/api/v1.

Example: list sites

{
  "sites": [
    {
      "id": "st_1a2b3c",
      "name": "style4street",
      "url": "https://style4street.com",
      "connectionType": "wordpress"
    }
  ]
}

Example: recent runs

A run that failed but was later resolved (baseline accepted or ignored) reports status: "passed" with resolved: true.

{
  "runs": [
    {
      "id": "rn_9f8e7d",
      "siteId": "st_1a2b3c",
      "checkId": "ck_4d5e6f",
      "journey": "checkout",
      "checkName": "Checkout",
      "status": "passed",
      "resolved": false,
      "trigger": "schedule",
      "startedAt": "2026-08-31T09:15:00.000Z",
      "durationMs": 4210,
      "error": null,
      "warning": null
    }
  ]
}

Example: one run in detail

Findings come in metrics.items. A large run is compacted rather than cut: long series become summaries, and what was left out is listed in metricsTrimmed — the headline and findings are always kept.

{
  "runId": "rn_9f8e7d",
  "runUrl": "https://app.relvato.com/runs/rn_9f8e7d",
  "check": { "key": "google-search", "name": "Google Search" },
  "status": "passed",
  "warning": "https://style4street.com/category/topuri/hanorace/ lost 57% of its Google impressions",
  "metrics": {
    "headline": { "tone": "warn", "text": "🔎 1 thing to review on Google Search (as of 2026-09-24)" },
    "items": [
      { "text": "https://style4street.com/category/topuri/hanorace/ lost 57% of its Google impressions — 98 in the 7 days to 2026-09-24, against 226 in an average week before", "tone": "warn" }
    ],
    "search": { "engine": "google", "tiles": [ … ], "dailies": [ { "label": "Impressions per day", "days": 84, "last7Total": 2196, "usualLast7Total": 2583 } ], … }
  },
  "metricsTrimmed": {
    "note": "Large parts were left out to keep this short — the run page has everything.",
    "omitted": ["search.dailies (the per-day values — summarized)", "search.tiles[].weekly (the 8 weekly bars)"]
  }
}

Example: a run's fix brief

For a run that found a problem, fix-prompt returns the brief Relvato's own AI answers: the site's stack, what changed just before, the error and findings, and for Google / Bing Search the evidence that rules causes out. Hand it to your own model, or read it yourself.

{
  "runId": "rn_9f8e7d",
  "runUrl": "https://app.relvato.com/runs/rn_9f8e7d",
  "hasIssue": true,
  "prompt": "# Help me understand a Google Search change on my WordPress site\n\nYou are a senior SEO specialist. … ## Evidence Relvato already has …"
}

Rate limits

Requests are limited per minute, per account, across REST and MCP combined. Your plan sets the ceiling:

Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. Over the limit returns 429 with a Retry-After header.

Status codes

MCP server (for AI agents)

Relvato is also a remote Model Context Protocol server with 58 tools, so an agent like Claude can do in a conversation what you'd do in the dashboard: add a site and walk you through connecting it, pick and configure its monitors (down to the pages the visual monitor checks), run them, explain the results and, when you agree, accept an intended change or hand you the link to apply the fix a run proposes in WordPress. Connect it by signing in to Relvato or with an API key; either way it shares the REST API's rate limit. Approving file-integrity, script and DNS changes, who receives alerts, secrets and deleting anything stay in the dashboard.

Listed in Claude's Connectors Directory ↗, in ChatGPT ↗ as a plugin, and in the GitHub MCP Registry ↗.

Sign in, no key needed. Add the endpoint as a connector in Claude (claude.ai, Desktop or Claude Code), ChatGPT or VS Code. The client opens Relvato's sign-in; you allow it to read your sites and results and to make changes: add sites and monitors, change schedules and run scans. Sign-in works in clients that support Client ID Metadata Documents; Cursor and Docker's MCP gateway don't yet, so they use an API key.

If you belong to an organization, you pick one of its workspaces on the sign-in screen; your personal workspace isn't offered there. To connect your personal workspace, use an API key.

Things you can ask an agent connected to Relvato:

• “Why did checkout fail on my shop last night, and how do I fix it?”
• “Set up monitoring for example.com and tell me what I need to do to connect it.”
• “Who gets alerted when a Security monitor finds a problem, and on which channels?”
• “Add my pricing and blog pages to the visual monitor, and run it.”
• “How fast is my shop for real visitors, and what's slowing it down?”

Endpoint https://app.relvato.com/api/mcp

In a client that reads an mcp.json, the endpoint is enough — the client asks you to sign in the first time:

{
  "mcpServers": {
    "relvato": {
      "type": "http",
      "url": "https://app.relvato.com/api/mcp"
    }
  }
}

To use an API key instead (a script, a client without sign-in, or your personal workspace while you're in an organization), add the header. A read-only key only gets the read tools:

{
  "mcpServers": {
    "relvato": {
      "type": "http",
      "url": "https://app.relvato.com/api/mcp",
      "headers": {
        "Authorization": "Bearer rlv_your_key"
      }
    }
  }
}

Claude Code plugin

In Claude Code, the Relvato plugin adds the server plus three skills for working from your site's repository. Install it from our marketplace, then run /mcp and sign in:

claude plugin marketplace add Relvato/relvato-mcp
claude plugin install relvato@relvato

• /relvato:setup adds the site this repository deploys, proves you own it (it can add the verification meta tag to your code), picks monitors and starts the first runs.
• /relvato:check-after-deploy runs the site's monitors after a deploy, says how long they'll take, and reports what passed and what broke.
• /relvato:fix-failure reads a failed run, finds the cause in your code, makes the smallest fix with your OK, and runs that monitor again.

Perplexity

On a Perplexity Pro, Max or Enterprise plan, add Relvato as a custom connector: Settings → Connectors → + Custom connector → Remote. Use the endpoint above as the MCP server URL and Streamable HTTP as the transport.

For Authentication, choose API key and paste a Relvato API key (create one under API access in the app; a read-only key only gets the read tools). Perplexity's OAuth option doesn't work with Relvato's sign-in yet: it needs the server to register Perplexity automatically, which Relvato doesn't offer.

Webhooks

The API answers when you ask. To be told the moment a monitor finds a problem, add a webhook: Relvato POSTs a signed JSON event to your URL for every alert (Pro and up). Set up a webhook →

Frequently asked questions