Public configuration
GET /api/v1/public-config
Returns live checkout URLs, current plan amounts, validator costs, and free-preview limits. Launch pricing is $14.99 for 1 credit, $49 for 10 credits, and $299 for 100 credits. Standard checks use 1 credit, complex checks use 3 credits, and credits expire 12 months after purchase.
List active validators
GET /api/v1/validators
Returns current machine-readable validator metadata, including identifier, supported inputs, profiles, sources, and credit cost.
curl https://submissionpreflight.com/api/v1/validators
Email-verified free preview
Request a link with POST /api/v1/free/request, form fields email and empty honeypot website. The link contains #free_token=. Confirm it with POST /api/v1/free/status, form field token.
Run the preview with POST /api/v1/free/check/{validator_id}, multipart field upload, form field token, and optional validator-specific ruleset and profile. It returns a verdict, up to five findings, and report_download: false. Do not attempt to construct a report that the endpoint did not return.
Paid API-key check
POST /api/v1/check/{validator_id}
Send multipart field upload, optional validator-specific ruleset and profile, and header x-api-key. Launch maximum is 50 MiB. A selected profile may enforce a lower limit.
curl -X POST \ -H "x-api-key: sp_your_key" \ -F "[email protected]" \ -F "profile=forms-i" \ https://submissionpreflight.com/api/v1/check/nih-common-form
A paid result includes passed, counts, findings, document metadata, and a disclaimer. Findings include explanation, remediation, and source URL.
Recover and inspect paid access
Request an account link with POST /api/v1/access/request, form fields email and empty honeypot website. The link contains #access_token=. Redeem it once using POST /api/v1/access/status, form field token. The response returns api_key, credits, expires_at, and expired.
For an existing key, GET /api/v1/access/me with x-api-key returns remaining credits and expiry state.
Errors and scope
Use standard HTTP error handling. A missing token or key, invalid multipart field, expired access link, exhausted credits, unsupported file, or unavailable service must be surfaced to the operator. A technical result is not acceptance by an external destination.