Try any of 919 endpoints — live.
Pick an endpoint, load a working example, tweak the params, and send — no signup to try. Results render the way the data deserves; raw JSON, headers & code are one tab away.
Audit raw HTML you supply (CI / staging use-case) — no fetch by default (fully offline, deterministic). Same axe-core engine + contract as audit_url.
Raw HTML document/fragment to audit (≤4MB). Fragments are wrapped in a minimal document. The CI / staging path — no fetch unless allow_remote_resources=true.
Let the supplied HTML load remote css/img/fonts (SSRF-guarded). Default false = fully offline render (deterministic CI mode).
Base URL for relative asset paths in the supplied HTML (injected as <base href>); SSRF-validated.
Conformance standard to test against (selects the axe rule tag set).
Viewport to render at before auditing (responsive a11y differs by breakpoint).
Add axe 'best-practice' rules on top of the chosen WCAG standard (usability checks beyond strict conformance).
Also return the rules that PASSED (passes[]) — useful for evidence reports. Default false (smaller response).
Return axe 'incomplete' results — checks that need human review (folded into needs_review). Default true.
Attach a curated fix_hint to each issue (default true).
Restrict the audit to these axe rule ids (comma-separated or JSON array). Empty = all rules for the standard.
Disable these axe rule ids for the run (comma-separated or array).
Only audit elements inside these CSS selectors (axe context include).
Skip elements matching these CSS selectors (axe context exclude — drop third-party widgets you don't control).
Cap the number of returned issues (0 = no cap). Summary counts are always complete. (0–1000)
Navigation wait condition before auditing.
Additionally wait until this CSS selector is visible (15s budget) — the reliable signal for heavy SPAs.
Extra settle delay after load before auditing, 0-5000ms. (0–5000)
Browser locale (Accept-Language + Intl), e.g. en-US, de-DE, ar-EG.
Override the browser User-Agent.
Extra request headers (JSON object). Cookie/Authorization are stripped (no-login content policy).
curl -X POST https://api.reefapi.com/a11y-audit/v1/audit_html \
-H "x-api-key: $REEF_KEY" \
-H "content-type: application/json" \
-d '{"html":"<html><body><img src='x.png'><a href='#'></a><input type='text'></body></html>"}'Hit Send to run this endpoint live.