API Endpoints

All endpoints are prefixed with https://api.incluxa.com/api/v1. This page lists what your widget key (X-Api-Key: inc_live_…) can call. The widget SDK and the <script> embed call these for you; you only need them if you build your own widget integration.

Important
A widget key is a publishable key: it sits in your page source, so it can only reach the widget endpoints below. Any other endpoint answers 403 with the code API_KEY_NOT_PERMITTED. Scanning, compliance reports, sites, analytics dashboards, team, keys, webhooks and billing are managed in the INCLUXA portal while you are signed in. There are no management API keys today.

Widget

GET/widget/configWidget configuration for your key (checks the page origin against your domain allowlist)
GET/widget/plan-featuresTools and theme your plan enables
POST/widget/boot-tokenShort-lived widget token used by the embed
POST/widget/feedbackVisitor feedback (rating 1–5, category, optional comment)
POST/widget/reportVisitor accessibility report

Presets

GET/presetsList the available presets and their tools

Profiles

Profiles store one visitor's accessibility preferences. The userId is your system's identifier for that visitor. GET returns a short-lived profileToken; a PUT must send it back in the X-Profile-Token header, so a key alone cannot overwrite any profile.

GET/profiles/{userId}Profile with feature settings and a profileToken
GET/profiles/{userId}/active-featuresOnly the enabled features (lightweight)
PUT/profiles/{userId}Update feature settings (needs X-Profile-Token)

Get a profile

curl https://api.incluxa.com/api/v1/profiles/user_123 \
  -H "X-Api-Key: inc_live_YOUR_KEY"

Update a profile

curl -X PUT https://api.incluxa.com/api/v1/profiles/user_123 \
  -H "X-Api-Key: inc_live_YOUR_KEY" \
  -H "X-Profile-Token: PROFILE_TOKEN_FROM_GET" \
  -H "Content-Type: application/json" \
  -d '{
    "features": [
      { "featureCode": "reading_mask", "isEnabled": true },
      { "featureCode": "text_zoom", "isEnabled": true, "value": "150" }
    ]
  }'

To apply a preset, read it from GET /presets and send its tools in a profile update. Deleting a profile is done in the portal.

Usage events

POST/analytics/logRecord that a visitor turned a tool on or off

The SDK sends these automatically when trackUsage is enabled. Usage reports are read in the portal, not with the key.

AI content transforms

These use AI credits from your plan's AI add-on.

POST/content/simplifySimplify text to a target reading level
POST/content/alt-textSuggest alt text for an image
POST/content/vocabularyPick out vocabulary words from text
POST/content/hintsScaffolded hints for a question
POST/content/rephraseRephrase text
POST/content/translateTranslate text to a target language
POST/content/summarizeSummarize a passage
POST/content/aria-fixSuggest ARIA fixes for a page fragment
POST/content/tts-exportText-to-speech export

Simplify text

curl -X POST https://api.incluxa.com/api/v1/content/simplify \
  -H "X-Api-Key: inc_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "The mitochondria is the powerhouse of the cell.",
    "targetGradeLevel": 5
  }'

Everything else: the portal

These are available in the INCLUXA portal while you are signed in, not with a widget key:

  • WCAG scanning and scan results
  • Compliance targets, snapshots and VPAT / compliance reports
  • Sites, verified domains and the widget domain allowlist
  • Usage analytics and dashboards
  • Team members, roles and the audit log
  • Widget keys (create, rotate, revoke) and webhooks
  • Billing and plan changes

Health

GEThttps://api.incluxa.com/healthAPI health check (outside /api/v1; no key needed)