BarrierOps API

What can I read?

18 paths under the base URL, each one a resource or one item of one. Most are a GET; the few that change something are named on the reference with the scope they need.

/openapi.json

This API’s OpenAPI 3.1 document, the one to generate a client from

/organizations

The organisations a key reaches: its own, or an agency’s clients

/properties

The assets those organisations audit — list them, and add one

/properties/{id}

One asset — read it, and change its name or kind

/properties/{id}/scans

An asset’s scan history, and the trigger that starts a scan

/scans/{id}

One scan: where it stands and what it covered

/properties/{id}/issues

An asset’s issues, filtered by impact, status, viewport and success criterion

/issues/{id}

One issue, and the status and owner changes that move it

/issues/{id}/occurrences

The pages an issue appears on — one row per page

/properties/{id}/documents

The documents an asset links to, and what checking them found

/documents/{id}

One document

/properties/{id}/vendors

The vendor products linked to an asset, and the evidence on file for each

/vendors/{id}

One vendor product, and the changes a script may make to it

/properties/{id}/evidence

The evidence ledger, oldest first, in the order the hash chain is walked

/properties/{id}/evidence/verify

Recompute the hash chain and return what the walk found

/reports

Generate a report, and list the reports there are

/reports/{id}

One report: its status, and its link once it is ready

/cms/content

Post a page’s address from a CMS and receive its known issues, split into content-authored and template-level

The evidence endpoints matter most. An agency building a client dashboard wants the current state; an auditor wants the ledger.

How do I authenticate?

An API key in an Authorization header. Not OAuth — our consumers are server-to-server scripts, not third-party apps acting for users.

A key is scoped to an organisation, or to an agency across its clients. Authentication covers the key format, the header, the three scopes, rotation and what to do if a key leaks.

Is there a spec?

OpenAPI 3.1.0 at /docs/openapi.json, generated from the same schemas the API validates against. The same document is at /docs/openapi.yaml in YAML.

Neither address carries a build hash, so a bookmark or a generator configured with one keeps working. The document describes every operation, every response and the nine webhook messages, and the API serves it too, at GET /openapi.json under the base URL, without a key.

Can I try it before we sign?

Yes. Every example here shows its complete response, and test mode returns fixture data. A key that starts bo_test_ reads the sandbox: City of Riverbend, Riverbend Public Library, Riverbend Water District — fictional organisations with frozen data, the same records on every request. What the API works out from today’s date moves with it: a vendor product’s evidenceStatus reads stale once its Voluntary Product Accessibility Template (VPAT) turns 24 months old, which for the sandbox’s Agenda Center is 12 September 2027, from midnight UTC.

An organisation’s test key reads City of Riverbend: 1 asset with 4,102 pages in its latest scan, 4 scans, 40 issues across 3 impact levels and 6 statuses, 25 documents of which 16 fail validation, 1 vendor product, and an evidence ledger of 5,710 events. An agency’s test key reads all 3 organisations.

Test mode never touches production data and production keys never return fixture data.

Every example here shows its complete response. You can build and test a client against these fixtures before you have a key. The quickstart starts there.

What stable means here

/api/v1/ is stable. Additive changes only — new fields, new endpoints, new optional parameters. A breaking change means /api/v2/, with both live for at least 12 months.

The version is in the path rather than in a header, because a government integrator reads the URL and files it. There is no content negotiation to get wrong and no default version to drift underneath a client that never asked for one. Every change is dated in the changelog, which is also a feed.

Why there is no search box

There is no search box. Every endpoint, parameter and field is on one reference page, so your browser’s own search reaches all of it.

A search that works with JavaScript disabled is not something a static site can offer, and a client-side index is around 40 KB to reproduce a keystroke every browser already has. Putting every endpoint on one page costs a reader one scroll and costs no download at all.

These pages describe API version v1.