---
name: site-check
description: Check a public URL or domain on https://one-api.ai. Use for a page audit, a domain brief, an ads.txt read, or a Tranco rank.
---

Check a public page or domain by calling one-api. Report only fields the responses contain.

## Key

Read `ONE_API_KEY` from the environment. Send it on every POST as `Authorization: Bearer` with that value, and send `Content-Type: application/json`. The same value is also accepted in `x-api-key`.

The operator issues the key. Public signup is not open. When `ONE_API_KEY` is unset, or the response is HTTP 401 with `error.code` `unauthorized`, stop and say the operator has to issue a key.

## Which calls

A full check of one URL calls all four routes below, in this order. When the user asks for one of them, call that route only.

Each lookup is one credit. One credit is $0.001. The worker counts 25 lookups per account per UTC month before it debits a credit. https://one-api.ai/pricing says a lookup is one credit, or it sits in a free monthly quota once charging opens.

Take the host from a URL by keeping the hostname, lowercased, with no scheme, no port, no path, and no trailing dot. `www.example.com` and `example.com` are different hosts. Pass the host the user named.

`truncated` true means the fetched body was cut at 1 MiB.

## Page audit

`POST https://one-api.ai/v1/page-audit`

Body: `{"url":"https://example.com/"}` with the user's absolute `http` or `https` URL.

The JSON `source` is `one-api`. Read `final_url`, `status`, `title`, `meta_description`, `canonical`, `robots_meta`, `headings` (`h1`, `h2`, `h3`), `hreflang` (`lang`, `href`), `json_ld_types`, `links` (`internal`, `external`), and `truncated`. A null field is absent.

HTTP 403 `robots_disallow` means robots.txt disallows that URL and the page was not fetched. Report that and continue any later call the user still wants.

`GET https://one-api.ai/v1/sample` audits `https://example.com/` only and needs no key. It is not the user's page.

## Domain brief

`POST https://one-api.ai/v1/domain-brief`

Body: `{"domain":"example.com"}`.

The JSON `source` is `RDAP`. Read `domain`, `registration_date`, `registrar`, `nameservers`, `robots_disallow_count`, `sitemap_url_count`, and `capped`. A missing RDAP field is null. The sitemap count stops at 50 files or 5,000 URLs. `capped` true means that stop was hit.

## ads.txt

`POST https://one-api.ai/v1/ads-txt`

Body: `{"host":"example.com"}`.

The JSON `source` is `one-api`. Read `host`, then `ads_txt` and `sellers_json`. Each of those has `found`, `status`, and `truncated`.

`ads_txt.records` entries have `domain`, `publisher_id`, `relationship` (`DIRECT` or `RESELLER`), and `certification_authority_id`. `ads_txt.variables` entries have `name` and `value`.

`sellers_json` has `contact_email`, `contact_address`, `version`, `identifiers` (`name`, `value`), and `sellers` (`seller_id`, `seller_type`, `is_confidential`, `name`, `domain`). `sellers` null means the file was found and was not sellers.json.

## Tranco rank

`POST https://one-api.ai/v1/rank`

Body: `{"domain":"example.com"}`.

The JSON `source` is `Tranco`. Read `domain`, `rank`, `list_id`, and `list_date`. `rank` null with HTTP 200 means the domain is not on that list.

## Errors

The error body is `{"error":{"code":"...","message":"..."}}`.

- HTTP 400 `bad_url` means the URL or host is not allowed. Report it and stop that call.
- HTTP 400 `bad_request` means the body is not the JSON object for that route.
- HTTP 402 `insufficient_credits` means the call did not run. Stop the remaining calls and report that code.
- HTTP 502 `bad_gateway` means the upstream request failed. Report that message. The response has no upstream body.

When the host already has the one-api MCP server, the same four calls are the tools `page_audit`, `domain_brief`, `ads_txt`, and `rank_check` on `POST https://one-api.ai/mcp`, with the same bearer token and the same body fields.

Done when each requested route has been called once and every reported field comes from its JSON.