AutoIndexNow API reference

Authentication

Create an API key on the account page (Pro and Agency plans). Send it as a bearer token. Keys are shown once and stored hashed.

curl https://autoindexnow.com/api/v1/sites \
  -H "Authorization: Bearer ain_key_…"

All responses are JSON. Errors have the shape { "error": "code", "message": "…" }.

Sites

GET  /api/v1/sites                 # your sites with counts
GET  /api/v1/sites/{siteId}        # one site, recent runs, sitemaps
POST /api/v1/sites/{siteId}/check  # start a crawl (202; 200 if one is running)

Submit URLs

Marks the given URLs as changed and sends them in the next batch. URLs must be on the site host; unknown URLs are added to the tracked set (within your plan's limit) and checked on the next crawl.

POST /api/v1/sites/{siteId}/submit
Content-Type: application/json

{ "urls": ["https://example.com/pricing", "https://example.com/docs/api"] }

→ 202 { "accepted": 2, "rejected": [], "batches": ["cm…"] }

Read attempts and export history

GET /api/v1/sites/{siteId}/urls?state=pending&limit=100&cursor=…
GET /api/v1/sites/{siteId}/batches?limit=50
GET /api/v1/sites/{siteId}/batches/{batchId}     # attempts + URLs
GET /api/v1/sites/{siteId}/export?kind=submissions # CSV (kind=urls for the URL list)

Batch objects carry status, lastStatusCode, lastOutcome and an attempts array with statusCode, outcome, responseSnippet, durationMs and requestSha256.

Deploy hooks (trigger a re-scan)

Deploy hooks are per-site URLs with their own token, created on the site's "Deploy hooks" tab. They need no API key and work from any CI. A call starts the site's normal check: sitemap discovery, then every tracked URL is checked and real changes are submitted, exactly like scheduled monitoring.

# last step of a production deploy
curl -fsS https://autoindexnow.com/api/hooks/{hookId} \
  -H "Authorization: Bearer ain_hook_…"

→ 202 { "ok": true, "run": { "id": "cm…" }, "created": true,
        "quota": { "kind": "hook", "limit": 24, "used": 1, "remaining": 23, "resetAt": "…T00:00:00.000Z" } }

• GET only, with the token in the Authorization: Bearer header. No request body and no query string: a call with either is refused with 400, and the token never belongs in a URL (URLs end up in CI, proxy and CDN logs).
• Other methods answer 405 with Allow: GET, OPTIONS.
• A retry within the same minute returns the same run and is not counted again. A call while a check is running joins it ("created": false), also uncounted.

Changed in October 2026: POST and URL lists removed

Hooks used to accept POST, optionally with a {"urls": [...]} body. That form now returns 405. To migrate, drop -X POST and any body from the hook call. If you named specific pages, either let the hook's re-scan find them in your sitemap, or send them to POST /api/v1/sites/{siteId}/submit with an API key.

Idempotency

Starting a check while one is already running returns the running run with 200 instead of creating another. Submitting the same URLs twice before the first batch is sent does not create a second batch: batches are keyed on the set of pending changes.

Daily check limits

Scheduled monitoring is never limited by these. They cap checks you start yourself, per site and UTC day; the account-wide total is the per-site limit times the plan's site count. When a limit is reached the call returns 429 daily_trigger_limit with Retry-After, and every successful call reports quota plus x-trigger-limit, x-trigger-remaining and x-trigger-reset headers.

Errors and rate limits

• 401 invalid_api_key, 404 site_not_found, 402 url_limit / site_limit / api_access, 409 not_verified, 400 invalid_request.
• 429 rate_limited with a Retry-After header: 120 submit calls and 1200 read calls per hour per key, 6 checks per hour per site, 30 hook calls per hour per hook.
• 429 daily_trigger_limit and 429 daily_url_quota for the daily limits above.
• Submitted URLs also count against your plan's tracked-URL limit when they are new.