All endpoints

Summary#

This is the complete list of HTTP routes served by the Metric Vault Worker, grouped by feature area. Only POST /api/v1/analyze and the three /api/keys/* management routes are a supported public integration surface; everything else exists to serve the web app, the Chrome extension, the public blog and the operator tooling. They are documented here so a developer or a support engineer can tell exactly what a request did and what guarded it.

Overview#

How routing works#

Every request to metricvaultai.com reaches one Cloudflare Pages Worker before anything else. The Worker evaluates a flat, ordered chain of path checks and the first match wins; anything unmatched falls through to the static assets. Order is load-bearing in a few places, most notably that the Stripe webhook is matched before any body-reading middleware so the raw bytes stay available for signature verification, and that /api/blog/site and /api/blog/sites are matched before the /api/blog/* catch-all.

Fifteen paths never reach the Worker at all: /free/*, /blog.html, /favicon.ico, /favicon.png, /favicon-16x16.png, /favicon-32x32.png, /apple-touch-icon.png, /og-image.png, /logo-dark.png, /logo-light.png, /icon-192.png, /icon-192.svg, /icon-512.png, /icon-512.svg and /manifest.json. They are served directly as static assets.

Authentication mechanisms#

Seven distinct mechanisms appear in the tables below.

CORS#

Successful JSON responses carry Access-Control-Allow-Origin: *. The OPTIONS preflight answers for every path with:

Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization

The Chrome-extension endpoint uses a wider set that also allows the X-Extension-Version header.

Billing and account#

Library, saved results and history#

Tools and AI#

The 18 tool types accepted by /api/tools are onpage_seo, pagespeed, robots_audit, schema_check, http_headers, sitemap_validator, redirect_chain, mixed_content, hreflang_checker, tech_stack, dup_content, internal_linking, ai_visibility, geo_audit, ai_overview, ai_citation, seo_compare and llms_txt. Anything else returns Invalid tool type: <type>.

Article writer#

The Article Writer runs through POST /api/premium-ai like every other dashboard tool, with the tool type in the request body.

There used to be a separate three-route job queue here — /api/article-start, /api/article-status and /api/article-process. It was removed on 2026-09-01: nothing in the product called it, and /api/article-start was public. See Internal endpoints for why an internal handoff cannot carry a caller's identity.

Tier-2 AI visibility#

Competitor Monitor#

All ten are POST, authenticated by session email, and cost no credits.

Responsive Website Analyzer#

Google and social integrations#

The six supported platforms are LinkedIn, X, Facebook, Instagram, TikTok and Threads. Instagram and TikTok return a "needs media" notice on text publishing.

Team and workspaces#

Notifications, preferences and branding#

Alerts, schedules, editorial, publishing, sharing#

Blog#

The authenticated sub-router covers posts, categories, tags, authors, media, stock search, subscribers, newsletter templates and sending, AI generation and AI translation. Blog roles are owner, editor and author; anything else is coerced to author. See Roles and what each can do.

API keys and the public API#

Administration#

All 22 routes are POST and take a session token in the body as token. A caller that is not an active administrator receives HTTP 403 with {"error":"Unauthorized"}.

Internal and diagnostic routes#

Full detail is in Internal endpoints and Diagnostic endpoints.

Non-API routes served by the Worker#

Anything else falls through to the static assets. Clean URLs are remapped (/ to /index.html, /dashboard to /dashboard.html, and the same for /login, /admin, /privacy and /terms). A 404 on a path with no file extension is upgraded to the branded 404 page; a 404 on a path that has a file extension keeps its bare 404, so a missing script never receives an HTML body.

Paths that are not routes#

Request logging#

Every request passes through an activity wrapper before and after routing. It records a row in the activity log for recognized routes, using the actor resolved from the body, the x-mv-user header, or a query parameter. Read-only polling routes such as /api/library, /api/usage and /api/notifications are excluded. Status 429 is recorded as warning, any other status of 400 or above as failed, and everything else as success. Logging happens after the response is produced and never blocks or fails a request.