10 WORKFLOW BUNDLES · ONE BEARER TOKEN · 104 ENDPOINTS · MCP READY

Workflows, not endpoints.
Pick a bundle. Ship.

Ten curated bundles compose Ollagraph's API into the workflows autonomous AI agents and engineers actually run. Same token. Flat 1 credit base. One MCP server.

Request access Open Interactive Studio

CURATED TOOLKITS

10 Purpose-Built API Workflows

Click any bundle to inspect its full endpoint signature, autonomous agent recipe, and code samples in the Studio below.

10 endpoints for auditing how AI engines fetch, parse, and cite your content, plus llm-ready chunking.

Built for: For AI-discovery teams, agencies, and content engineers measuring AEO posture across pages and competitors.

Sample endpoints

POST /v1/aeo/page-audit

POST /v1/aeo/competitor-diff

POST /v1/aeo/citation-readiness

+8 more

~4 credits / run

Deep Dive →

13 endpoints for technical SEO: meta, schema, redirects, broken links, mixed content, plus crawlability.

Built for: For SEO consultants and in-house technical SEO leads.

Sample endpoints

POST /v1/seo/meta-audit

POST /v1/seo/schema-validate

POST /v1/seo/readability

+10 more

~3 credits / run

Deep Dive →

6 endpoints for DNS lookups, propagation checks, certificate-transparency search, and subdomain enumeration.

Built for: For DevOps doing migrations, security researchers, and domain investigators.

Sample endpoints

POST /v1/dns/lookup

POST /v1/dns/intelligence

POST /v1/intel/dns-propagation

+3 more

~2 credits / run

Deep Dive →

4 endpoints for email deliverability: verification, SPF / DKIM / DMARC posture, contact extraction, format parsing.

Built for: For outbound sales, ESP integrators, fraud and onboarding teams.

Sample endpoints

POST /v1/verify/email

POST /v1/intel/email-auth

POST /v1/extract/contacts

+1 more

~1 credits / run

Deep Dive →

24 endpoints for WHOIS, ASN, GeoIP, SSL, DNSSEC, CAA, WAF detection, Wayback history, security.txt, social tags, caller-request inspection, and more.

Built for: For security teams, sign-up enrichment pipelines, fraud detection, compliance, SRE audits, OSINT investigations.

Sample endpoints

POST /v1/intel/whois

POST /v1/intel/ssl

POST /v1/intel/asn

+21 more

~6 credits / run

Deep Dive →

13 endpoints for single, batch, async, smart, and llm-ready scraping, plus extraction, crawl, and captcha solve.

Built for: For AI agents, data engineers, and RAG pipelines fetching the live web.

Sample endpoints

POST /v1/scrape

POST /v1/scrape/batch

POST /v1/scrape/async

+10 more

~3 credits / run

Deep Dive →

9 endpoints: convert PDF, DOCX, XLSX, PPTX, CSV, HTML, and image OCR to markdown; extract PDFs to structured JSON; and transcribe audio/video to text.

Built for: For RAG ingest, knowledge-base pipelines, and document-processing SaaS.

Sample endpoints

POST /v1/convert/pdf-to-markdown

POST /v1/convert/docx-to-markdown

POST /v1/convert/xlsx-to-markdown

+5 more

~4 credits / run

Deep Dive →

10 endpoints composing AEO + SEO + Intelligence into a full domain health check.

Built for: For agencies running monthly client audits combining uptime, security, SEO, and AEO.

Sample endpoints

POST /v1/aeo/page-audit

POST /v1/intel/uptime

POST /v1/intel/headers

+7 more

~3 credits / run

Deep Dive →

7 endpoints for threat intelligence and malware scanning — URL, file-hash, and indicator reputation plus in-memory YARA file scanning.

Built for: For security teams, SOC analysts, and AI agents triaging URLs, files, and indicators against free, abuse-resistant threat data.

Sample endpoints

POST /v1/intel/url-reputation

POST /v1/intel/hash-reputation

POST /v1/intel/threat

+4 more

~2 credits / run

Deep Dive →

8 offline utilities AI agents call on every turn — token counting, RAG chunking, JSON repair & validation, fuzzy matching, language detection, date parsing, and diffing. No model to host, no extra vendor.

Built for: For AI agent builders and RAG pipelines that want fast, deterministic text and JSON utilities behind the same Bearer token — instead of bundling six libraries into every agent.

Sample endpoints

POST /v1/tokens/count

POST /v1/text/chunk

POST /v1/json/repair

+5 more

~2 credits / run

Deep Dive →

INTERACTIVE WORKFLOW STUDIO

Inspect Active Bundle & Endpoints

Live operations, execution recipe chains, and plug-and-play code snippets for autonomous agents. Select any bundle to switch context immediately.

OLLAGRAPH STUDIO // AEO BUNDLE

Open full deep dive

AEO Bundle

AI & Search

10 endpoints for auditing how AI engines fetch, parse, and cite your content, plus llm-ready chunking.

👤 For AI-discovery teams, agencies, and content engineers measuring AEO posture across pages and competitors.

11 Operations

~4 cr Est. Run Band

1 Token All Endpoints

Showing 11 operations · Flat 1-3 cr / call

Method	Endpoint Path	Summary	Credits
POST	/v1/aeo/page-audit	Orchestrator over 8-9 component AEO probes for a single URL.	3 cr
POST	/v1/aeo/competitor-diff	Diff a domain's AEO posture against named competitors.	3 cr
POST	/v1/aeo/citation-readiness	Likelihood that AI engines cite this page.	1 cr
POST	/v1/aeo/schema-coverage	Coverage of JSON-LD schema types vs intent.	1 cr
POST	/v1/aeo/llm-fetch-simulator	Simulate fetch from GPTBot, ClaudeBot, and PerplexityBot.	1 cr
POST	/v1/aeo/llms-txt-audit	Audit an existing llms.txt for completeness and link rot.	1 cr
POST	/v1/aeo/ai-bot-allowlist	Report robots.txt posture for 14 named AI crawlers.	1 cr
POST	/v1/aeo/freshness-signal	lastmod and visible dateline coverage.	1 cr
POST	/v1/aeo/heading-hierarchy-score	h1..h6 nesting quality score.	1 cr
POST	/v1/aeo/snippet-format-detect	Detect list, table, definition, and FAQ snippet formats.	1 cr
POST	/v1/scrape/llm-ready	Fetch and token-chunk a page for downstream AEO scoring or RAG ingest.	1 cr

STEP 01

Run /v1/aeo/page-audit against the target URL to get an aggregate score plus component breakdowns.

STEP 02

For any sub-score below threshold, call the corresponding component endpoint (e.g. /v1/aeo/schema-coverage, /v1/aeo/heading-hierarchy-score) to see the underlying findings.

STEP 03

Apply fixes, then re-run /v1/aeo/llm-fetch-simulator with the GPTBot and PerplexityBot user-agents to confirm the rendered page reaches the bot intact.

STEP 04

Track over time by storing the page-audit JSON keyed by URL + run timestamp.

curl -X POST https://api.ollagraph.com/v1/aeo/page-audit \
  -H "Authorization: Bearer $OLLAGRAPH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/pricing"}'

import httpx, os

r = httpx.post(
    "https://api.ollagraph.com/v1/aeo/page-audit",
    headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
    json={"url": "https://example.com/pricing"},
    timeout=60.0,
)
print(r.json())

const res = await fetch("https://api.ollagraph.com/v1/aeo/page-audit", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ url: "https://example.com/pricing" }),
});
console.log(await res.json());

Does page-audit count as one call or many? ↓

One call, 3 credits. The orchestrator runs ~9 probes server-side but you only pay once and only refund once on error.

Which AI bots does llm-fetch-simulator emulate? ↓

GPTBot, ChatGPT-User, ClaudeBot, anthropic-ai, PerplexityBot, Google-Extended, and Amazonbot, with each user-agent string verbatim from their published docs.

Can I run AEO checks on a page behind login? ↓

No. AEO endpoints fetch as the named bot would, which means anonymously. Gate-removed preview URLs are the workaround.

SEO Bundle

AI & Search

13 endpoints for technical SEO: meta, schema, redirects, broken links, mixed content, plus crawlability.

👤 For SEO consultants and in-house technical SEO leads.

13 Operations

~3 cr Est. Run Band

1 Token All Endpoints

Showing 13 operations · Flat 1-3 cr / call

Method	Endpoint Path	Summary	Credits
POST	/v1/seo/meta-audit	Title, description, canonical, og, and twitter card audit.	1 cr
POST	/v1/seo/schema-validate	JSON-LD schema.org validation.	1 cr
POST	/v1/seo/readability	Six readability formulas (Flesch, FK grade, Gunning, ARI, SMOG, Coleman-Liau).	1 cr
POST	/v1/seo/redirect-chain-map	Walk 301/302/308 chains and tag each hop.	1 cr
POST	/v1/seo/broken-links-audit	Crawl and report 4xx/5xx links on a page.	1 cr
POST	/v1/seo/anchor-text-audit	Anchor-text distribution and over-optimisation flags.	1 cr
POST	/v1/seo/mixed-content	https-on-http resource detection.	1 cr
POST	/v1/seo/snippet-candidates	Featured-snippet-eligible passages from the page.	1 cr
POST	/v1/seo/keyword-extract	Keyword surfacing with TF and density bands.	1 cr
POST	/v1/intel/sitemap	sitemap.xml parse with per-URL summary.	1 cr
POST	/v1/intel/robots	robots.txt parse and rule evaluation.	1 cr
POST	/v1/intel/redirects	Follow and tag a redirect chain from a starting URL.	1 cr
POST	/v1/scrape/smart	Fetch with auto-escalation through the render cascade.	1 cr

STEP 01

Pull the sitemap with /v1/intel/sitemap to get a URL inventory plus lastmod.

STEP 02

For each URL, call /v1/seo/meta-audit and /v1/seo/schema-validate in parallel to score on-page tags.

STEP 03

Run /v1/seo/broken-links-audit and /v1/seo/redirect-chain-map on high-traffic pages to catch dangling links and redirect loops.

STEP 04

Roll the per-URL JSON into a single client-facing report and store deltas between runs.

curl -X POST https://api.ollagraph.com/v1/seo/meta-audit \
  -H "Authorization: Bearer $OLLAGRAPH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/blog/seo-checklist"}'

import httpx, os

r = httpx.post(
    "https://api.ollagraph.com/v1/seo/meta-audit",
    headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
    json={"url": "https://example.com/blog/seo-checklist"},
    timeout=30.0,
)
print(r.json())

const res = await fetch("https://api.ollagraph.com/v1/seo/meta-audit", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ url: "https://example.com/blog/seo-checklist" }),
});
console.log(await res.json());

Does broken-links-audit follow off-site links? ↓

Yes, but only HEAD-checks them. It will not crawl beyond the seed page.

What schema.org version does schema-validate target? ↓

Latest schema.org core plus pending. We do not enforce Google's rich-results subset — use the report's `google_eligibility` flag.

Why does meta-audit sometimes report missing og tags on pages that render them client-side? ↓

Server-rendered HTML is what counts for crawlers. If your og tags are injected by JS, escalate to /v1/scrape/smart so we get the rendered DOM, then re-run meta-audit on that HTML.

DNS Bundle

Domains & Infra

6 endpoints for DNS lookups, propagation checks, certificate-transparency search, and subdomain enumeration.

👤 For DevOps doing migrations, security researchers, and domain investigators.

6 Operations

~2 cr Est. Run Band

1 Token All Endpoints

Showing 6 operations · Flat 1-3 cr / call

Method	Endpoint Path	Summary	Credits
POST	/v1/dns/lookup	A, AAAA, MX, TXT, NS, and CNAME per record type.	1 cr
POST	/v1/dns/intelligence	Resolver-diverse summary of a domain's DNS posture.	1 cr
POST	/v1/intel/dns-propagation	Propagation status across geographically distributed resolvers.	1 cr
POST	/v1/intel/cert-transparency-history	crt.sh-backed certificate transparency timeline.	1 cr
POST	/v1/intel/subdomain-enumerate	Subdomain discovery via certificate transparency logs.	1 cr
POST	/v1/intel/whois	WHOIS / RDAP registry record.	1 cr

STEP 01

Before the cutover, snapshot the current state with /v1/dns/intelligence to capture all record types in one payload.

STEP 02

Push the DNS change at the registrar.

STEP 03

Poll /v1/intel/dns-propagation every 30 seconds until target resolvers in your priority regions return the new value.

STEP 04

After propagation, call /v1/intel/cert-transparency-history to confirm the new certificate was logged and trusted CAs picked it up.

curl -X POST https://api.ollagraph.com/v1/dns/intelligence \
  -H "Authorization: Bearer $OLLAGRAPH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.com"}'

import httpx, os

r = httpx.post(
    "https://api.ollagraph.com/v1/dns/intelligence",
    headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
    json={"domain": "example.com"},
    timeout=30.0,
)
print(r.json())

const res = await fetch("https://api.ollagraph.com/v1/dns/intelligence", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ domain: "example.com" }),
});
console.log(await res.json());

Which resolvers does dns-propagation hit? ↓

Cloudflare 1.1.1.1, Google 8.8.8.8 / 8.8.4.4, Quad9 9.9.9.9, OpenDNS, plus regional resolvers in EU, APAC, and SA. Result includes per-resolver answers so you can detect splits.

How fresh is cert-transparency-history? ↓

Bound by crt.sh's own ingest lag — typically minutes to a couple of hours after CA log submission. We do not cache.

Does subdomain-enumerate brute-force or only use CT logs? ↓

CT logs only. That misses wildcard certs but avoids generating any traffic at the target. If you need active enumeration, run it yourself and feed candidates into /v1/dns/lookup.

Email Bundle

Domains & Infra

4 endpoints for email deliverability: verification, SPF / DKIM / DMARC posture, contact extraction, format parsing.

👤 For outbound sales, ESP integrators, fraud and onboarding teams.

4 Operations

~1 cr Est. Run Band

1 Token All Endpoints

Showing 4 operations · Flat 1-3 cr / call

Method	Endpoint Path	Summary	Credits
POST	/v1/verify/email	Syntactic, MX, and disposable-domain detection.	1 cr
POST	/v1/intel/email-auth	SPF, DKIM, and DMARC posture for a domain.	1 cr
POST	/v1/extract/contacts	Pull emails, phones, and socials from a page.	1 cr
POST	/v1/parse/email	Parse an address into local-part, domain, plus-tag, and display-name.	1 cr

STEP 01

Parse each address with /v1/parse/email to normalize and strip plus-tags before deduplication.

STEP 02

Call /v1/verify/email on the deduped list to drop syntactic failures, MX-less domains, and disposable providers.

STEP 03

For surviving addresses, call /v1/intel/email-auth on the domain to flag any sending domains with no DMARC alignment — those are higher bounce risk.

curl -X POST https://api.ollagraph.com/v1/verify/email \
  -H "Authorization: Bearer $OLLAGRAPH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]"}'

import httpx, os

r = httpx.post(
    "https://api.ollagraph.com/v1/verify/email",
    headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
    json={"email": "[email protected]"},
    timeout=15.0,
)
print(r.json())

const res = await fetch("https://api.ollagraph.com/v1/verify/email", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ email: "[email protected]" }),
});
console.log(await res.json());

Do you do SMTP RCPT-TO probing? ↓

No. We stop at syntactic checks, MX resolution, and disposable-domain matching. SMTP probes get IPs blacklisted and producers false-negatives on greylisting servers.

Will you flag @ollagraph.com or @qcrawl.com as nonexistent? ↓

No — both are catch-all domains in our knowledge base. They always validate as deliverable at the MX level.

Why does email-auth sometimes return DMARC `policy=none`? ↓

That is the published policy at the domain. We report what the DNS says; we do not infer intent.

Domain Intelligence Bundle

Domains & Infra

24 endpoints for WHOIS, ASN, GeoIP, SSL, DNSSEC, CAA, WAF detection, Wayback history, security.txt, social tags, caller-request inspection, and more.

👤 For security teams, sign-up enrichment pipelines, fraud detection, compliance, SRE audits, OSINT investigations.

24 Operations

~6 cr Est. Run Band

1 Token All Endpoints

Showing 24 operations · Flat 1-3 cr / call

Method	Endpoint Path	Summary	Credits
POST	/v1/intel/whois	WHOIS / RDAP registry record.	1 cr
POST	/v1/intel/ssl	TLS certificate, chain, issuer, and validity.	1 cr
POST	/v1/intel/asn	ASN, announcing organisation, and prefix coverage.	1 cr
POST	/v1/intel/geoip	Country, city, and coordinates from an IP.	1 cr
POST	/v1/intel/geoip/bulk	Batched geoip lookup.	1 cr
POST	/v1/intel/ip-reputation	Tor, cloud, datacenter, and CDN flagging.	1 cr
GET	/v1/intel/whoami	What the internet sees about the caller: IP, geoIP, ASN, reputation, parsed User-Agent, curated header echo. One call replaces five.	1 cr
POST	/v1/intel/http-versions	Detect HTTP/1.1, HTTP/2 (TLS ALPN), and HTTP/3 (Alt-Svc) support, plus TLS version, cipher, and HSTS posture.	1 cr
POST	/v1/intel/dnssec	DNSSEC posture: DNSKEY + DS + AD-flag observations. Honest three-bit verdict, not a single 'valid' bit.	1 cr
POST	/v1/intel/nameservers	Authoritative NS records + each resolved to A/AAAA + /16 diversification flag.	1 cr
POST	/v1/intel/caa	Which CAs may issue certs for the domain. Parses issue/issuewild/iodef and detects deny-all.	1 cr
POST	/v1/intel/reverse-dns	PTR lookup via dns.reversename. IP -> hostname for log enrichment.	1 cr
POST	/v1/dns/over-https	Forward query through Cloudflare 1.1.1.1 or Google 8.8.8.8 via DoH (RFC 8484).	1 cr
POST	/v1/intel/security-txt	Fetch + parse RFC 9116 security.txt (or legacy /security.txt). Flags rfc9116_minimum_compliant.	1 cr
POST	/v1/intel/social-tags	Open Graph + Twitter Card + canonical + title + icons + lang + theme color in one fetch.	1 cr
POST	/v1/intel/cookies	Set-Cookie response headers parsed per RFC 6265. Header-only by design.	1 cr
POST	/v1/intel/waf	WAF/CDN detection from headers + body fingerprints. Cloudflare, Akamai, Fastly, AWS WAF, Imperva, Sucuri, F5, ModSecurity, etc.	1 cr
POST	/v1/intel/sri-audit	External scripts + stylesheets audit with Subresource Integrity coverage. Supply-chain hygiene.	1 cr
POST	/v1/intel/wayback	First + most-recent Wayback Machine snapshots via the Availability API.	1 cr
POST	/v1/intel/blacklist	DNSBL aggregate across known lists.	1 cr
POST	/v1/intel/cert-transparency-history	crt.sh-backed certificate transparency timeline.	1 cr
POST	/v1/intel/headers	HTTP response headers snapshot.	1 cr
POST	/v1/intel/page	HTML summary, meta, and canonical hints.	1 cr
POST	/v1/enrich/company	Company-from-domain enrichment.	1 cr

STEP 01

On signup, take the email domain and call /v1/enrich/company to attach firmographics.

STEP 02

Take the request IP and call /v1/intel/ip-reputation plus /v1/intel/geoip — flag Tor, datacenter IPs, and country mismatches against the billing address.

STEP 03

If the domain is unknown, run /v1/intel/whois and /v1/intel/cert-transparency-history to check age and CA history. A week-old domain with one DV cert is a fraud signal.

STEP 04

Compose into a single risk score and decide allow / step-up / block.

curl -X POST https://api.ollagraph.com/v1/intel/ip-reputation \
  -H "Authorization: Bearer $OLLAGRAPH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip":"185.220.101.1"}'

import httpx, os

r = httpx.post(
    "https://api.ollagraph.com/v1/intel/ip-reputation",
    headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
    json={"ip": "185.220.101.1"},
    timeout=15.0,
)
print(r.json())

const res = await fetch("https://api.ollagraph.com/v1/intel/ip-reputation", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ ip: "185.220.101.1" }),
});
console.log(await res.json());

What sources feed ip-reputation? ↓

Tor exit-node lists (live), public datacenter/cloud ASN ranges (refreshed daily), and CDN-owned prefixes. We do not subscribe to commercial threat feeds.

How big can a geoip/bulk batch be? ↓

Up to 1000 IPs per call. We charge one credit per call, not per IP.

Does enrich/company give me employee counts and funding? ↓

Domain, industry, country, and size band only. We do not resell funding-round data.

Scraping Bundle

Data & Scraping

13 endpoints for single, batch, async, smart, and llm-ready scraping, plus extraction, crawl, and captcha solve.

👤 For AI agents, data engineers, and RAG pipelines fetching the live web.

13 Operations

~3 cr Est. Run Band

1 Token All Endpoints

Showing 13 operations · Flat 1-3 cr / call

Method	Endpoint Path	Summary	Credits
POST	/v1/scrape	Single-page fetch.	1 cr
POST	/v1/scrape/batch	Batch of URLs, synchronous return.	1 cr
POST	/v1/scrape/async	Single fetch, returns job_id.	1 cr
POST	/v1/scrape/batch/async	Batched fetch, returns job_id.	1 cr
POST	/v1/scrape/smart	Auto-escalate through the render cascade.	1 cr
POST	/v1/scrape/llm-ready	Fetch and token-chunk for RAG ingest.	1 cr
POST	/v1/extract/clean	Boilerplate strip and reading-text extraction.	1 cr
POST	/v1/extract/structured	Schema-driven extract via JSON schema input.	1 cr
POST	/v1/extract/tables	Table rows from HTML.	1 cr
POST	/v1/extract/contacts	Emails, phones, and socials extraction.	1 cr
POST	/v1/crawl	Recursive crawl with depth and budget caps.	1 cr
POST	/v1/captcha/solve	reCAPTCHA v2 / v3 solve.	1 cr
POST	/v1/captcha/auto	Automatic captcha solve flow for sites behind a challenge.	1 cr

STEP 01

Call /v1/crawl with the seed URL, max_depth=2, and a same-host filter to discover candidate pages.

STEP 02

For each discovered URL, call /v1/scrape/llm-ready to fetch and token-chunk in one step.

STEP 03

Embed the chunks and write to your vector store. We do not persist any scraped content — your store is the only record.

STEP 04

On pages that come back bot-blocked, retry through /v1/scrape/smart, which auto-escalates to the render backend and then to residential proxy if needed.

curl -X POST https://api.ollagraph.com/v1/scrape/smart \
  -H "Authorization: Bearer $OLLAGRAPH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/article","render_js":true}'

import httpx, os

r = httpx.post(
    "https://api.ollagraph.com/v1/scrape/smart",
    headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
    json={"url": "https://example.com/article", "render_js": True},
    timeout=60.0,
)
print(r.json())

const res = await fetch("https://api.ollagraph.com/v1/scrape/smart", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ url: "https://example.com/article", render_js: true }),
});
console.log(await res.json());

What's the difference between /scrape and /scrape/smart? ↓

/scrape is a direct fetch. /scrape/smart auto-escalates: direct first, then internal render backend, then a residential proxy on 401/403/429. Same response shape from all tiers.

How do I get residential proxy? ↓

Pass `use_residential_proxy: true` on /scrape or /scrape/smart. It adds a +3 credit surcharge on top of the base 1 credit per call.

Do you store the HTML I scrape? ↓

No. We never persist scraped content — only the URL, status, and credit-event metadata for your usage log.

Conversion Bundle

Data & Scraping

9 endpoints: convert PDF, DOCX, XLSX, PPTX, CSV, HTML, and image OCR to markdown; extract PDFs to structured JSON; and transcribe audio/video to text.

👤 For RAG ingest, knowledge-base pipelines, and document-processing SaaS.

8 Operations

~4 cr Est. Run Band

1 Token All Endpoints

Showing 8 operations · Flat 1-3 cr / call

Method	Endpoint Path	Summary	Credits
POST	/v1/convert/pdf-to-markdown	PDF to markdown.	1 cr
POST	/v1/convert/docx-to-markdown	Word .docx to markdown.	1 cr
POST	/v1/convert/xlsx-to-markdown	Excel .xlsx to markdown.	1 cr
POST	/v1/convert/pptx-to-markdown	PowerPoint .pptx to markdown.	1 cr
POST	/v1/convert/csv-to-markdown	CSV to markdown table.	1 cr
POST	/v1/convert/html-to-markdown	HTML to markdown (clean).	1 cr
POST	/v1/extract/document	PDF to structured JSON (Docling): text blocks, tables with cells, reading order, page layout.	3 cr
POST	/v1/transcribe	Audio/video to text + timestamped segments, auto-detected language (faster-whisper).	5 cr

STEP 01

Inspect the file's MIME type and route to the corresponding /v1/convert/* endpoint.

STEP 02

Post-process the returned markdown into chunks of your preferred size, embed, and write to your store.

curl -X POST https://api.ollagraph.com/v1/convert/pdf-to-markdown \
  -H "Authorization: Bearer $OLLAGRAPH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/whitepaper.pdf"}'

import httpx, os

r = httpx.post(
    "https://api.ollagraph.com/v1/convert/pdf-to-markdown",
    headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
    json={"url": "https://example.com/whitepaper.pdf"},
    timeout=120.0,
)
print(r.json())

const res = await fetch("https://api.ollagraph.com/v1/convert/pdf-to-markdown", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ url: "https://example.com/whitepaper.pdf" }),
});
console.log(await res.json());

Can I send the file body inline or only a URL? ↓

Both. Pass `url` for us to fetch, or `file_b64` for an inline base64 body. Inline is capped at 25 MB; URL fetches at 100 MB.

Does pdf-to-markdown preserve tables? ↓

Yes, as markdown table syntax when the layout is recoverable. Complex multi-column layouts with merged cells degrade to plain text rows.

Site Audit Bundle

Security & Audits

10 endpoints composing AEO + SEO + Intelligence into a full domain health check.

👤 For agencies running monthly client audits combining uptime, security, SEO, and AEO.

10 Operations

~3 cr Est. Run Band

1 Token All Endpoints

Showing 10 operations · Flat 1-3 cr / call

Method	Endpoint Path	Summary	Credits
POST	/v1/aeo/page-audit	Orchestrator AEO audit for the page.	3 cr
POST	/v1/intel/uptime	Uptime probe with TTFB.	1 cr
POST	/v1/intel/headers	HTTP response headers snapshot.	1 cr
POST	/v1/seo/broken-links-audit	Broken link crawl.	1 cr
POST	/v1/seo/redirect-chain-map	Redirect chain walk.	1 cr
POST	/v1/seo/mixed-content	Mixed-content detection.	1 cr
POST	/v1/intel/ssl	TLS certificate inspection.	1 cr
POST	/v1/intel/robots	robots.txt parse.	1 cr
POST	/v1/intel/sitemap	sitemap.xml parse.	1 cr
POST	/v1/seo/schema-validate	JSON-LD validation.	1 cr

STEP 01

Start with /v1/intel/uptime and /v1/intel/ssl on the apex to score availability and certificate health.

STEP 02

Pull /v1/intel/sitemap and /v1/intel/robots to confirm crawlability, then sample 5-10 top pages from the sitemap.

STEP 03

For each sampled page run /v1/aeo/page-audit, /v1/seo/schema-validate, /v1/seo/broken-links-audit, /v1/seo/redirect-chain-map, and /v1/seo/mixed-content.

STEP 04

Aggregate into a single client-facing report, score against last month's run, and call out regressions.

curl -X POST https://api.ollagraph.com/v1/intel/uptime \
  -H "Authorization: Bearer $OLLAGRAPH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

import httpx, os

r = httpx.post(
    "https://api.ollagraph.com/v1/intel/uptime",
    headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
    json={"url": "https://example.com"},
    timeout=30.0,
)
print(r.json())

const res = await fetch("https://api.ollagraph.com/v1/intel/uptime", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ url: "https://example.com" }),
});
console.log(await res.json());

How many credits does a full site-audit run cost? ↓

Per page sampled: 3 (page-audit) + 8 x 1 = 11 credits, plus 2 credits for the domain-level uptime and SSL probes. A 10-page audit lands around 112 credits.

Can I run site-audit endpoints in parallel? ↓

Yes. All 10 are independent and idempotent. Your rate limit applies as the only constraint.

Do you store a history for diffing month-over-month? ↓

No — we do not persist response bodies. Save the JSON yourself, keyed by domain + run date, and diff client-side.

Security Bundle

Security & Audits

7 endpoints for threat intelligence and malware scanning — URL, file-hash, and indicator reputation plus in-memory YARA file scanning.

👤 For security teams, SOC analysts, and AI agents triaging URLs, files, and indicators against free, abuse-resistant threat data.

7 Operations

~2 cr Est. Run Band

1 Token All Endpoints

Showing 7 operations · Flat 1-3 cr / call

Method	Endpoint Path	Summary	Credits
POST	/v1/intel/url-reputation	Is a URL (or its host) a known phishing/malware URL? Matched against a free feed; we never fetch the URL.	1 cr
POST	/v1/intel/hash-reputation	Look a SHA-256/SHA-1/MD5 up against a known-malware corpus. Only the hash is sent — never a file.	1 cr
POST	/v1/intel/threat	One indicator (IP, domain, URL, or hash) returns a combined threat verdict across the free sources.	1 cr
POST	/v1/scan/file	Scan an uploaded file with YARA, in-memory and never stored; built-in rules plus your own.	2 cr
POST	/v1/intel/blacklist	Check an IP or domain against major DNSBL blocklists.	1 cr
POST	/v1/intel/ip-reputation	Classify an IP — datacenter, cloud range, or Tor exit.	1 cr
POST	/v1/intel/ssl	Inspect a host live TLS certificate — issuer, SANs, expiry.	1 cr

STEP 01

Send the indicator (IP, domain, URL, or file hash) to /v1/intel/threat for a one-call combined verdict across the free threat sources.

STEP 02

For a URL specifically, call /v1/intel/url-reputation to see the phishing/malware feed match and host-level context.

STEP 03

For a file in hand, hash it and call /v1/intel/hash-reputation; if it is unknown, upload the bytes to /v1/scan/file for an in-memory YARA scan.

STEP 04

Enrich an IP with /v1/intel/ip-reputation (datacenter/Tor) and /v1/intel/blacklist (DNSBL) before allow/deny decisions.

curl -X POST https://api.ollagraph.com/v1/intel/threat \
  -H "Authorization: Bearer $OLLAGRAPH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"indicator":"185.39.181.103"}'

import httpx, os

r = httpx.post(
    "https://api.ollagraph.com/v1/intel/threat",
    headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
    json={"indicator": "185.39.181.103"},
    timeout=30.0,
)
print(r.json())

const res = await fetch("https://api.ollagraph.com/v1/intel/threat", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ indicator: "185.39.181.103" }),
});
console.log(await res.json());

Where does the threat data come from? ↓

Free, reputable open threat feeds, refreshed on a schedule — no paid intel subscriptions, consistent with our free-data-only model, so there are no surprise per-lookup vendor costs.

Do you store files I scan? ↓

No. /v1/scan/file decodes and scans the bytes in memory and discards them — nothing is written to disk or retained. Hash lookups send only the hash, never the file.

Is this an abuse vector? ↓

No. These are defensive, read-only lookups — no port scanning, no mass enumeration, no breach data. URL reputation never fetches the URL, and file scanning is size-capped and rate-limited.

Agent Tools Bundle

AI & Search

👤 For AI agent builders and RAG pipelines that want fast, deterministic text and JSON utilities behind the same Bearer token — instead of bundling six libraries into every agent.

8 Operations

~2 cr Est. Run Band

1 Token All Endpoints

Showing 8 operations · Flat 1-3 cr / call

Method	Endpoint Path	Summary	Credits
POST	/v1/tokens/count	Count tokens (and characters) for any string under a tiktoken encoding — estimate prompt cost before you call a model. Free.	0 cr
POST	/v1/text/chunk	Token-aware text splitting for RAG ingestion: sliding windows of N tokens with optional overlap, decoded back to text.	1 cr
POST	/v1/json/repair	Repair malformed JSON from an LLM — trailing commas, single quotes, missing brackets, markdown fences — into a valid object.	1 cr
POST	/v1/json/validate	Validate data against a JSON Schema and get every error, or omit the schema to infer one from the data.	1 cr
POST	/v1/text/similarity	Fuzzy string similarity (0–100): pairwise scores, or rank a list of candidates against a query, best first.	1 cr
POST	/v1/lang/detect	Detect the dominant language of a string with a confidence score — offline, no network.	1 cr
POST	/v1/datetime/parse	Parse a natural-language or messy date ("next tuesday", "3 days ago") into ISO-8601 plus a Unix timestamp.	1 cr
POST	/v1/text/diff	Diff two strings (unified or ndiff) with a similarity score — verify an agents edit before applying it.	1 cr

STEP 01

Before calling a model, size the prompt with /v1/tokens/count and split long context into clean RAG windows with /v1/text/chunk.

STEP 02

Detect the input language with /v1/lang/detect and normalize any dates with /v1/datetime/parse.

STEP 03

When the model returns JSON, fix it with /v1/json/repair, then enforce your contract with /v1/json/validate.

STEP 04

Match or dedupe candidate strings with /v1/text/similarity, and confirm an edit with /v1/text/diff before you write it back.

curl -X POST https://api.ollagraph.com/v1/json/repair \n  -H "Authorization: Bearer $OLLAGRAPH_API_KEY" \n  -H "Content-Type: application/json" \n  -d "{\"text\":\"{\\\"name\\\":\\\"Ada\\\",\\\"skills\\\":[\\\"math\\\",]}\"}"

import httpx, os

r = httpx.post(
    "https://api.ollagraph.com/v1/json/repair",
    headers={"Authorization": f"Bearer {os.environ['OLLAGRAPH_API_KEY']}"},
    json={"text": '{"name":"Ada","skills":["math",]}'},
    timeout=30.0,
)
print(r.json())

const res = await fetch("https://api.ollagraph.com/v1/json/repair", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OLLAGRAPH_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ text: '{"name":"Ada","skills":["math",]}' }),
});
console.log(await res.json());

Do these call out to any model or external service? ↓

No. They run in-process on the API, fully offline — no model weights, no network, no GPU. The value is one Bearer token and one bill for utilities your agent would otherwise vendor or self-host.

Why is /v1/tokens/count free? ↓

Token counting is something every agent does constantly and costs us almost nothing, so we leave it uncharged. The other seven utilities are 1 credit each.

Which tokenizer does counting and chunking use? ↓

tiktoken’s cl100k_base by default (the OpenAI family, so boundaries match what your model sees). Pass an encoding such as o200k_base to switch.

COMPARE ALL WORKFLOWS

Which bundle fits your pipeline?

Workflow cost band is the sum of credits across bundle endpoints divided by four. Most production workflows touch a subset; treat the band as an upper bound on a single run.

Category	Endpoints	Workflow Cost Band	Best For	Action
AI & Search	11	~4 credits	For AI-discovery teams, agencies, and content engineers measuring AEO posture across pages and competitors.	Deep Dive
AI & Search	13	~3 credits	For SEO consultants and in-house technical SEO leads.	Deep Dive
Domains & Infra	6	~2 credits	For DevOps doing migrations, security researchers, and domain investigators.	Deep Dive
Domains & Infra	4	~1 credits	For outbound sales, ESP integrators, fraud and onboarding teams.	Deep Dive
Domains & Infra	24	~6 credits	For security teams, sign-up enrichment pipelines, fraud detection, compliance, SRE audits, OSINT investigations.	Deep Dive
Data & Scraping	13	~3 credits	For AI agents, data engineers, and RAG pipelines fetching the live web.	Deep Dive
Data & Scraping	8	~4 credits	For RAG ingest, knowledge-base pipelines, and document-processing SaaS.	Deep Dive
Security & Audits	10	~3 credits	For agencies running monthly client audits combining uptime, security, SEO, and AEO.	Deep Dive
Security & Audits	7	~2 credits	For security teams, SOC analysts, and AI agents triaging URLs, files, and indicators against free, abuse-resistant threat data.	Deep Dive
AI & Search	8	~2 credits	For AI agent builders and RAG pipelines that want fast, deterministic text and JSON utilities behind the same Bearer token — instead of bundling six libraries into every agent.	Deep Dive

1,000 free credits · No card required

One Bearer token. Every bundle.

1,000 credits on signup. Every endpoint in every bundle, day one. No card. No vendor sprawl.

Request access View docs

✓ No credit card required

✓ Flat 1 credit / call base

✓ 104 operations ready

Workflows, not endpoints.
Pick a bundle. Ship.

10 Purpose-Built API Workflows

AEO

SEO

DNS

Email

Domain Intelligence

Scraping

Conversion

Site Audit

Security

Agent Tools

No matching bundles found

Inspect Active Bundle & Endpoints

AEO Bundle

Audit then iterate

SEO Bundle

Page-level technical audit

DNS Bundle

Migration cutover check

Email Bundle

List hygiene before send

Domain Intelligence Bundle

Sign-up enrichment + risk score

Scraping Bundle

RAG ingest of a site section

Conversion Bundle

Mixed-format knowledge-base ingest

Site Audit Bundle

Monthly client audit

Security Bundle

Triage an unknown indicator

Agent Tools Bundle

Prep and verify an agents text I/O

Which bundle fits your pipeline?

One Bearer token. Every bundle.