API

Use RetainerProof from a script or an agent

The API writes to the account that owns the key. It lists sites, reads status, and adds the same work-log entries the dashboard form does. A check uses the same Run check now path.

Auth

Create a named key under Brand settings → API keys. The full key is shown once. RetainerProof stores only a SHA-256 hash. Send it on every request:

Authorization: Bearer rp_live_…

Keys look like rp_live_ plus a random secret. An account can keep 10 active keys. Revoke a key and it stops working. A key cannot read or write another account. Calls need an active subscription, same as the app. The limit is 60 requests a minute per key.

Base URL: https://retainerproof.com/api/v1. JSON in and out. Machine-readable spec: /api/v1/openapi.json.

Errors

401 missing, invalid, or revoked key.
403 the account has no active subscription.
404 that site or entry is not on this account.
422 the work-log body failed the same checks as the form.
429 over 60 requests in a minute. Retry-After is in seconds.

GET /api/v1/sites

Each site: id, name, url, and status with state, summary, and checkedAt.

curl -s https://retainerproof.com/api/v1/sites \
  -H "Authorization: Bearer rp_live_…"

GET /api/v1/sites/:id

Status for one site: uptime percent for the current period, TLS and domain expiry, last check time, and the secret client digest URL.

curl -s https://retainerproof.com/api/v1/sites/SITE_ID \
  -H "Authorization: Bearer rp_live_…"

Work log

GET and POST /api/v1/sites/:id/work-log. PATCH and DELETE /api/v1/sites/:id/work-log/:entryId.

Fields match the dashboard form. title is required (max 120 characters). date is YYYY-MM-DD or omit it. note is optional (max 2000). category is Update, Content, Fix, Meeting, or Other. minutes is optional, from 1 to 10080. The form names work_date, description, and tag also work.

curl -s -X POST https://retainerproof.com/api/v1/sites/SITE_ID/work-log \
  -H "Authorization: Bearer rp_live_…" \
  -H "Content-Type: application/json" \
  -d '{"title":"Homepage copy refresh","date":"2026-10-04","note":"Rewrote the hero.","category":"Content","minutes":45}'

Client digest recipients

GET and PUT /api/v1/sites/:id/recipients. emails replaces the list (max 5). Optional enabled and cadence (each, weekly, or monthly) control the email that goes out after a scheduled check. An address that unsubscribed stays unsubscribed. The response does not include unsubscribe tokens or any mail API key.

curl -s -X PUT https://retainerproof.com/api/v1/sites/SITE_ID/recipients \
  -H "Authorization: Bearer rp_live_…" \
  -H "Content-Type: application/json" \
  -d '{"emails":["[email protected]"],"enabled":true,"cadence":"weekly"}'

Client email and your own Resend key

On each site, Brand settings can email up to five client addresses after a scheduled digest: status, uptime, certificate and domain dates, and work-log lines, plus a button to the secret digest. Cadence is every digest, weekly, or monthly. Each mail has a one-click unsubscribe.

By default those messages (and status-page incident mail) send through RetainerProof’s Resend account. The From name is your studio name via RetainerProof. Reply-To is your brand contact email. Or paste your own Resend API key and a From address on a domain you verified in Resend. Test & save sends a test and stores the key only if that succeeds. The key is encrypted and is not shown again. If that key later fails, the client mail is not sent from the RetainerProof domain. Freelancer red alerts keep using RetainerProof mail.

The public status page has its own subscribe form. That address is confirmed before any incident mail, then gets one message when the site goes down and one when it recovers.

POST /api/v1/sites/:id/check

Starts the same check as Run check now. If a check is already running for that site, the response is that job and a second check is not queued. 202 with jobId, status, and alreadyRunning.

curl -s -X POST https://retainerproof.com/api/v1/sites/SITE_ID/check \
  -H "Authorization: Bearer rp_live_…"

Prompt for an LLM agent

Paste this into Claude, ChatGPT, Cursor, or another agent that can call HTTP. Replace the key. Do not commit the key or put it on a client page.

You can update a RetainerProof account over HTTP.
Base URL: https://retainerproof.com/api/v1
Authorization: Bearer rp_live_PASTE_KEY
OpenAPI: https://retainerproof.com/api/v1/openapi.json

Rules:
- Never send the key to anyone else or store it in a public file.
- GET /sites to find the site id.
- POST /sites/{id}/work-log with JSON title, optional date (YYYY-MM-DD), note, category (Update, Content, Fix, Meeting, Other), and optional minutes.
- PATCH or DELETE /sites/{id}/work-log/{entryId} to change or remove an entry.
- POST /sites/{id}/check to run the same check as the dashboard. If alreadyRunning is true, wait; do not start another.
- GET or PUT /sites/{id}/recipients to read or replace client digest emails (max 5). cadence is each, weekly, or monthly.
- 401 means the key is missing or revoked. 403 means the subscription is not active. 404 means that id is not on this account. 429 means wait for Retry-After.

Also see pricing and a sample client digest.