Public API

For the guided setup, see the Public API feature guide.

The public API gives you read-only access to the data RankMeFast already holds for your account: sites, the latest audit report, rank history, and tracked keywords. It is an Agency feature (see Plans, limits & credits). The API never triggers new vendor work. It only reads what your audits and rank checks have already produced.

Content Intelligence analysis and recommendation changes are not part of /api/v1. They remain signed-in product operations protected by Better Auth. MCP can read stored analyses, but it does not expose a start-analysis or recommendation-change tool.

Authentication

Create a key under Account → API keys (/profile?tab=api-keys). The full key is shown exactly once, so copy it right away. Afterwards, only its prefix is visible. You can hold up to ten active keys and revoke any of them at any time. A revoked key stops working immediately.

Send the key as a bearer token on every request:

Authorization: Bearer rmf_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Replace https://your-rankme-host in the examples below with your api origin (the SERVER_URL of your install).

Response language and data contract

Choose response copy with x-lang, then Accept-Language; the API falls back to en. Header values such as fr-CA safely resolve to fr. /api/v1 ignores browser cookies, account language, and workspace preferences. Every response includes the effective Content-Language and adds x-lang, Accept-Language to Vary without removing existing values.

Only RankMeFast-authored report, finding, action, and safe error text is localized. JSON property names, HTTP statuses, stable error codes, enum and status values, IDs, domains, URLs, keywords, timestamps, measurements, observations, cursors, and stored user or provider text do not change. Locale never changes sorting or number and date formats.

CSV is one byte-compatible machine contract in every response language. The UTF-8 BOM, header names and order, row order, RFC-4180 escaping, values, line endings, filename, pagination headers, and cursor behavior stay identical. Content-Language describes response selection; it does not translate or relabel the CSV bytes.

Endpoints

List your sites

curl -H "Authorization: Bearer rmf_..." \
  https://your-rankme-host/api/v1/sites

Returns { "sites": [{ "id", "domain", "url", "createdAt" }] }.

Latest audit report for a site

curl -H "Authorization: Bearer rmf_..." \
  https://your-rankme-host/api/v1/sites/<siteId>/report/latest

Returns the most recent succeeded audit as { "runId", "report" }, with the same findings, buckets, and localized copy the dashboard shows. Responds 404 when the site has no finished audit yet.

Rank history for a site

curl -H "Authorization: Bearer rmf_..." \
  "https://your-rankme-host/api/v1/sites/<siteId>/rank-history?from=2026-06-01&to=2026-07-01"

Returns { "keywords": [{ "id", "phrase", "series": [...] }] }. Each series point carries the position, the URL that ranked, and the Google AI Overview signals (aiOverviewPresent, aiCited, aiCitedUrl). from and to are optional ISO dates.

All tracked keywords

curl -H "Authorization: Bearer rmf_..." \
  https://your-rankme-host/api/v1/keywords

Returns every tracked keyword across your sites with its latest position, delta, and AI Overview fields.

CSV exports and stored rows

When PUBLIC_EXPORTS_ENABLED is on, request CSV from any list route with ?format=csv or Accept: text/csv. CSV files use stable columns, a UTF-8 BOM, RFC-4180 quoting, and formula-safe text. JSON on the four original routes is unchanged. Rank history accepts engine=google|bing|youtube|amazon; without it, CSV includes every engine in the engine column.

Rank-history and keyword CSV keep their legacy unpaged output unless you add limit or an opaque cursor. Explicit rank-history pages accept 1 to 25 keyword groups (each group is capped at 730 points); keyword pages accept 1 to 1,000 rows. Send the returned X-Next-Cursor value on the next request and stop when that header is absent. JSON ignores these CSV paging parameters and keeps its original response contract.

Two additional stored-data reads are available: GET /api/v1/serp-features?siteId=<siteId> and GET /api/v1/backlink-rows?siteId=<siteId>. Both accept limit from 1 to 1,000 and an opaque cursor, return only rows owned by the key account, and label observations with sourceKind=provider_observation (source_kind in CSV). When the flag is off, these routes and CSV return 503, while the original JSON routes remain live. Follow the Looker Studio guide for the connector and complete field mapping.

Compatibility

This release exposes exactly six read-only routes:

• GET /api/v1/sites
• GET /api/v1/sites/:siteId/report/latest
• GET /api/v1/sites/:siteId/rank-history
• GET /api/v1/keywords
• GET /api/v1/serp-features
• GET /api/v1/backlink-rows

Brand Radar, Review Intelligence, Link Intelligence, Traffic Insights, Keyword Trends, and the SERP Sensor do not add routes under /api/v1. The five paid surfaces remain authenticated dashboard features; the public sensor remains under /api/volatility. Existing response fields keep their meaning, and clients should ignore additive fields they do not recognize.

<!-- public-api-routes: GET /api/v1/sites; GET /api/v1/sites/:siteId/report/latest; GET /api/v1/sites/:siteId/rank-history; GET /api/v1/keywords; GET /api/v1/serp-features; GET /api/v1/backlink-rows -->

Rate limits

By default each key may make 120 requests per minute. Above that the API answers 429 until the window resets.

Errors

Errors use the shape { "error": { "message": "...", "details": ... } }. Their safe human message follows x-lang, then Accept-Language, then en; status, fields, stable codes, and safe details remain machine-compatible:

• 401: the key is missing, malformed, revoked, or unknown.
• 402: your plan does not include the API.
• 404: the site or report does not exist on your account.
• 429: rate limit exceeded (body: { "error": "..." }).

Back to the docs index