Developers

Your workspace, readable from your stack.

Bearer-authenticated REST reads over the same live data the app shows. Mint a key in Settings → API access; it’s shown once and stored only as a hash.

Authentication

curl https://growthberry.ai/api/v1/guides \
  -H "Authorization: Bearer gbk_live_your_key_here"

Every key is scoped to one workspace — it can never read another workspace’s data. Keys carry an expiry you choose at creation (90 days recommended), and revoking one in Settings takes effect immediately.

Endpoints

GET/api/v1/guides
Your guides (generated, approved, published) with their public URLs.
GET/api/v1/guides/{id}
One full guide document — plus a validation block whose score is re-computed live for your request, never cached bravado.
GET/api/v1/audit
Your newest Kickoff initial-audit report (GEO score, crawler access, backlink compliance).
GET/api/v1/visibility
The AI-visibility rollup: share of voice, per-prompt presence, engines, sentiment.

No key needed — the audit badge

GET/api/badge/audit.svg?id=<proof>

The embeddable “Audited by GrowthBerry” SVG — public, cache-friendly, no auth. The badge shows the score GrowthBerry actually measured: run the free audit and the results page hands you a copy-paste snippet with your proof id. The score can’t be set by hand, and the badge stops showing it once the proof expires.

Publish webhook — connect any CMS

WordPress and GitHub have native adapters; everything else connects here. Add a webhook on Your Site and every publish POSTs the full structured guide to your endpoint — a few lines in a serverless function or middleware turn it into a page via Webflow, Shopify, Ghost, Wix, or your own stack’s API.

POSTyour endpoint URL

Headers: x-growthberry-event: guide.published and x-growthberry-signature — an HMAC-SHA256 hex digest of the raw body, keyed with the secret you set when connecting. One signed delivery per publish, 10-second timeout, and every attempt (success or failure) lands in the Your Site delivery log.

// Payload
{
  "event": "guide.published",
  "tenant": "your-workspace",
  "slug": "california-lease-costs",
  "state_code": "CA",
  "template": "cost",
  "published_at": "2026-07-31T23:51:27Z",
  "guide": { "title": "…", "tldr": "…", "sections": [ … ],
             "faq": [ … ], "internal_links": [ … ], "citations": [ … ] }
}

// Verify the signature (Node)
import { createHmac, timingSafeEqual } from "node:crypto";
const expected = createHmac("sha256", process.env.GB_WEBHOOK_SECRET)
  .update(rawBody).digest("hex");
const ok = timingSafeEqual(Buffer.from(expected),
  Buffer.from(req.headers["x-growthberry-signature"]));

Example response — live validation

{
  "object": "guide",
  "id": 41,
  "slug": "new-york-pet-trust-checklist",
  "status": "generated",
  "guide": { "title": "…", "tldr": "…", "sections": [ … ] },
  "validation": {
    "score": 100,
    "checks": [ { "label": "Grounded in verified facts", "pass": true }, … ],
    "note": "computed live for this request"
  }
}

Fair use, honestly stated

Reads are free for every workspace. Each key is limited to 120 requests per 10 minutes — past that the API answers 429 with a plain JSON error and the window clears on its own, so a looping script is bounded instead of billed. If the limit ever changes, this page changes first. Write endpoints ship with scoped key permissions, not before.

Prefer tools over REST? Our MCP server exposes the audit engines directly inside Claude.