# Tityra information and audit request API

Browse the [documentation index](/docs), [audit methodology](/audit-methodology) and [contact information](/contact).

## Public information

GET /api/site.json returns public company details, audit packages, Agent Experience content, audiences, content for all four industry pages, process information and resource links. It requires no authentication and supports cross-origin reads. It does not execute audits or payments.

The provider is Digital Domain Technologies Ltd, trading as CogNovaMX. Its legal name is Digital Domain Technologies Limited, company 03651124. Registered office: 33 Merchant Way, York, United Kingdom, YO23 3TS. [Companies House record](https://find-and-update.company-information.service.gov.uk/company/03651124).

The response contains:

| Field | Content |
| --- | --- |
| name, legal_name, trading_name, company_number | Brand and legal company identity. |
| url, type, description, mx_definition, discovery_questions | Website and Agent Experience overview. |
| address, contact, same_as, company_register_url | Postal address, email and public company links. |
| services | Assessment scope and limits, packages, deliverables, request fields and confirmation. |
| audiences | Who It's For heading, introduction and four groups. All four groups have dedicated pages and available status. |
| audit_process | Audit workflow and links to request a Free AX Audit. |
| publishing_groups | Publishers hero and portfolio content, four assessment checks, three workflow steps and assessment limits. |
| ecommerce_retail | Ecommerce & Retail hero and catalogue content, four assessment checks, three workflow steps and assessment limits. |
| saas_technology | SaaS & Technology product and documentation content, four assessment checks, three workflow steps and assessment limits. |
| agencies_partners | Agencies & Partners client content, four assessment checks, three workflow steps and assessment limits. |
| machine_experience | Definition, introduction, discovery questions, three principles, page example and audit explanation from /agent-experience. |
| machine_experience_url, publishers_url, ecommerce_url, technology_url, agencies_url, privacy_notice_url, cookie_information_url | Related website pages. |
| privacy_notice | Privacy notice title, description and link. |
| machine_readable | Homepage, all four industry pages, Agent Experience, Privacy and Cookies Markdown, llms, API catalogue, OpenAPI and documentation links. |

<!-- tityra-content:assessment:start -->
Agent Experience (AX) is how easily AI agents can access, understand and use digital content to help people achieve their goals.

We check against the AgentReady essentials within the agreed website scope. Website checks include HTML structure, Schema.org data and automated accessibility checks, plus available source, date and usage information.

For website audits, we compare the original HTML with the page after JavaScript runs to identify differences in the available content.

Scores summarise the agreed checks. They do not certify full accessibility conformance or predict AI citations, rankings or recommendations.

### Packages

[View current audit packages, scope, deliverables and prices](https://tityra.com/#pricing). Current package information is also available in the [site API](https://tityra.com/api/site.json).

Includes a review of the first PDF discovered, where available. Additional PDF reviews are available on request.

Pricing entries include id, name, cta and deliverables alongside amount, currency, unit and description. Paid entries include vat_note and value_added_tax_included: false. Page counts apply to pages scanned, regardless of report length. The service pdf_review_scope records the PDF scope note.
<!-- tityra-content:assessment:end -->

## Website audit request submissions

POST /api/audit-requests accepts only AX Audit requests from the website form. It is not an unrestricted agent API: use the audit request form to obtain verification and submit. No account or API key is needed; the server checks the Origin against its configured allowlist. Arbitrary cross-origin submissions are rejected. Website audit requests require Cloudflare Turnstile verification for action `audit`.

Send application/json with a maximum body size of 24 KiB. Strings are trimmed and validated on the server; unsupported fields are rejected. Requests require `type: "mx-audit"`, name (1–120 characters), email (valid address, up to 254 characters), submissionId (version-4 UUID), company, website scope, an authorisation declaration and affirmative terms acceptance. Keep the same submissionId when retrying the same unchanged payload; email delivery uses it as an idempotency key. The website creates a new identifier after the payload changes. Turnstile tokens must be refreshed as needed; they are verified against the request Origin hostname and action `audit`.

### Audit request

Submit a request through the [website audit form](/#audit-request), [Tityra](https://app.tityra.com/), or [email info@tityra.com](mailto:info@tityra.com) with your chosen package, website URL and proposed scope. Audit links in pricing or on any of the four industry pages open the form for the selected package when JavaScript is available, or an email request otherwise. The generic audit request form title is “Request an AX Audit”.

| Field | Requirement |
| --- | --- |
| type | Required: mx-audit. |
| plan | Required: free, automated or human. The package selector supplies this field. |
| name, email, submissionId | Required identity and request fields described above. |
| company | Required, up to 160 characters. |
| websiteUrl | Required, up to 2,000 characters; absolute http:// or https:// URL with a dotted hostname, no embedded credentials, whitespace or control characters. One website per audit request. |
| contentType | Required: `website`. |
| relationship | Required, one of the relationship values below. |
| authorisation | Required boolean true, from the unchecked-by-default declaration. |
| termsAccepted | Required boolean true, from the separate unchecked-by-default agreement checkbox. |
| organisationType | Optional; empty or one of the organisation values below. |
| notes | Optional, up to 4,000 characters. |
| turnstileToken | Required for website audit requests, up to 2,048 characters; action audit. |
| website | Reserved hidden form field; leave empty. |

Scope values:

| Value | Label |
| --- | --- |
| website | Website |

Relationship values:

| Value | Label |
| --- | --- |
| owner-team | Owner / team |
| agency | Agency / authorised representative |
| other | Other |

Organisation values:

| Value | Label |
| --- | --- |
| publisher | Publisher / media group |
| ecommerce | Ecommerce / retail |
| technology | SaaS / technology |
| agency | Agency / partner |
| other | Other |

Declaration: “I own this website or I'm authorised to request an audit of it.” The outgoing request email includes the request ID, UTC declaration timestamp, relationship, notice version and manual-review status. Email/website domain mismatches and the Other relationship are flagged for review. A declaration or matching domain alone does not prove authority. Scope and authority must be checked before work begins or a report is disclosed.

<!-- tityra-content:agreement:start -->
The website form requires the boolean `termsAccepted` to be `true`. The agreement checkbox is unchecked by default; missing or false values are rejected. Its statement is:

> I agree to the Terms and Conditions and acknowledge the Privacy Policy.

[Terms and Conditions](https://tityra.com/terms) (version 2026-10-25) · [Privacy Policy](https://tityra.com/privacy).

The submit button is “Request audit”.
<!-- tityra-content:agreement:end -->

### Responses and delivery

Responses are JSON with ok and message, and Cache-Control: no-store. Errors additionally include a stable code and a recovery hint. Unknown API paths return JSON 404 errors, and unsupported methods return JSON 405 errors with Allow. A normal 202 response confirms receipt of the audit request; it does not confirm a scan result or delivery date. The hidden anti-spam field can return an audit acknowledgement without saving a request or delivering email.

| Status | Meaning |
| --- | --- |
| 202 | Audit request received; ok: true. |
| 400 | Invalid JSON or request shape. |
| 403 | Origin rejected, or verification missing, failed or expired. |
| 413 | Request body exceeds 24 KiB. |
| 415 | Content-Type is not application/json. |
| 422 | Invalid fields, selection, UUID, URL, required authorisation or required terms acceptance. |
| 429 | In-memory rate limit reached; Retry-After: 600. |
| 502 | Email delivery failed or was rejected by the provider. |
| 503 | The service is temporarily unavailable. Retry with the same request details and submissionId. |

The server rate-limits parsed submission attempts, including retries and failed verification, to five per client per ten-minute window before catalogue, storage or verification calls. On Cloud Run, the client is the final platform-appended X-Forwarded-For IP; caller-supplied prefixes and X-Real-IP are ignored. Outside Cloud Run, or without a valid platform IP, requests share an unknown-client bucket. This is a per-process, best-effort throttle, not a global quota. Its bounded cache evicts the least recently used client when full instead of rejecting all new clients. A successful response confirms receipt of the request; it does not mean that an audit has completed or a report has been released.

After submitting the website form, you receive a confirmation email with a **Track your request** button. Use the link to create a password or sign in. Creating an account is optional; your request continues if you choose not to.

Audit success message:

> Thanks for requesting an AX Audit. We've received your request. Check your email for confirmation and next steps. Use the Track your request button in that email to create a password or sign in. Each report is reviewed by a member of our team before release.

No form submission starts an audit, takes payment or delivers an instant report. The [privacy notice](/privacy) explains how request information and audit content are used, stored and retained, the service providers involved, and your rights. General enquiry messages and contact details are deleted within 12 months of the enquiry being closed. Accounting records are kept for six years from the end of the last company financial year they relate to, or longer where UK accounting and tax rules require it. The notice explains legitimate interests, contract with individuals, legal obligation and consent, along with non-identifying aggregated research, objection rights and conditional international transfer protections. The [cookie page](/cookies) explains optional analytics choices. Contact details and audit URLs must not be sent to analytics.

See [OpenAPI](/openapi.json), [public access](/auth.md), [API catalogue](/.well-known/api-catalog), [Publishers & Media Markdown](/publishers.md), [Ecommerce & Retail Markdown](/ecommerce.md), [SaaS & Technology Markdown](/technology.md), [Agencies & Partners Markdown](/agencies.md) and [full context](/llms-full.txt). For enquiries: [info@tityra.com](mailto:info@tityra.com).

## Compatibility and discovery

OpenAPI info.version versions this document; it is not an API path version. Existing unversioned endpoints remain supported. Additive fields are compatible, so clients should tolerate unknown response fields. A breaking change will use a new major API path and a migration guide before removal of the current contract. No removal is scheduled.

The [documentation index](/docs) links the supported public interfaces. The [ARD manifest](/.well-known/ard.json) advertises the public OpenAPI contract and a website audit guide, not an MCP server or an autonomous audit service. The [skill index](/.well-known/agent-skills/index.json) contains a SHA-256 digest of the published Markdown artifact. These draft discovery formats do not grant any account or execution permissions.

### Agent Experience naming

Public product names are Agent Experience (AX), AX Audit and Free AX Audit. The form discriminator `mx-audit` and existing identifiers are unchanged. Prefer `ax_definition`, `agent_experience`, `agent_experience_url` and `machine_readable.agent_experience_markdown` in the site response. The earlier `mx_definition` and `machine_experience*` fields remain compatibility aliases with current AX copy.