API Reference

# Quickstart

Create an API key under Settings > API keys. The key starts with xtraq_ and is shown only once.

$ curl -H "Authorization: Bearer xtraq_IHR_KEY" \
       https://api.xictraq.com/api/websites

[{"id":"019d7e3c-...","name":"Shop","url":"https://shop.invalid","is_up":true}]

# Complete endpoint reference

Generated live from the OpenAPI spec — always current. The detailed examples further down cover the most common endpoints.

Loading …

# Plan Limits

# Websites

# Scans

# Uptime & SSL

# Alerts

# Analytics (Starter+)

# E-commerce & shop data (Business)

Revenue, orders, products and the data from the Shopware 6 order import. The reports and shop data endpoints require the Business plan; the shop connection itself (shop-integration) does not, there only switching on the order import does. All endpoints can be used with an API key, writing ones only with the key’s write permission. Amounts ending in _minor are in cents. Imported orders without a tracker purchase count in revenue, orders, products and export, not in conversion, funnel and ROAS. Name, company and customer number from the import only appear with customer identification in the plan and never in a neutralised call. Share links never deliver customer data, neither from the import nor tracker identities (name, company, customer ID, external_user_id); the figures remain.

# Heartbeats

# API Monitoring (Starter+)

# API keys (Business+, geo key on every plan)

# Neutralised responses (GDPR)

Every endpoint can return its response without personal data: names, email addresses and phone numbers are removed, every other field stays untouched. Intended for downstream processing in a data warehouse, in a BI tool, or at a processor that does not need the personal data.

[
  {
    "id": "019d8f2a-…",
    "email": "team@firma.invalid",
    "role": "editor",
    "status": "accepted",
    "created_at": "2026-06-14T09:12:00Z"
  }
]

[
  {
    "id": "019d8f2a-…",
    "email": null,
    "role": "editor",
    "status": "accepted",
    "created_at": "2026-06-14T09:12:00Z"
  }
]

# Geo API (Add-on)

Native, offline IP geolocation served straight from our own indexes — GDPR-compliant, with no live request to any third party. Data is sourced from open datasets. The Geo API is an add-on on every plan, including Free, booked in three volume tiers: Starter (50,000 lookups/month), Pro (500,000) and Business (3M). Without a booked add-on, 1,000 lookups per month are included for testing.

# Invoices

# Referral Program

# VAT ID (VIES)

# Account

# Status Pages (all plans)

# Team & Agency

Invite team members (from Starter), manage the client portal (Agency), grant agency access (all plans).

# Browser Monitors (Business+)

Playwright-based multi-step scripts: check login flows, checkout and forms automatically.

# Reports & Templates (Business+)

Create and schedule automated reports and send them to recipients.

# Webhooks (Business+)

JSON POST on every alert. Events: alert.opened, alert.resolved. HMAC-SHA256 signature.

POST https://hooks.firma.invalid/xictraq
X-Xictraq-Event: alert.opened
X-Xictraq-Delivery: dlv_8f3a91c2d4e6f0a1
X-Xictraq-Signature: sha256=8f3a91...

{
  "event": "alert.opened",
  "delivered_at": "2026-06-20T09:14:07+00:00",
  "data": {
    "alert_id": "019d7e3c-...",
    "incident_id": "019d7e3c-...",
    "type": "downtime",
    "severity": "critical",
    "title": "HTTP 503",
    "message": "...",
    "website": { "id": "019d7e3c-..." },
    "is_resolved": false,
    "created_at": "2026-06-20T09:14:06+00:00"
  },
  "source": "XICTRAQ"
}

# Related documentation