API Reference

The SignalKit REST API lets you manage prompts, brands, reports, alerts, and more. Authenticate with an API key in the Authorization: Bearer header. Included with every account.

Base URL: https://signalkit.aiOpenAPI JSON →llms.txt →

Projects

Each project tracks a website and its brand, with its own prompts and segments. Company roles, project grants and API-key scope determine access.

Growth

Project-scoped decisions around the existing Content workflow. On-demand analysis reads saved evidence without model spend; scheduled Growth recipes can run explicitly selected semantic models under allowance ceilings. Keyword collection is a separate explicit request. To do items and outcomes retain source dates; missing measurements never mean zero and observed change does not establish causality.

Prompts

Create and manage tracking prompts that are queried against LLM platforms.

Segments

A segment is a market you compete in: a named subset of a project's prompts plus the brands it counts as competitors. Every project has at least one, the default, named after the project. Pass a segment's id as segmentId to a measurement endpoint to read it inside that segment; leave it out and every figure covers the whole project, exactly as it did before segments existed.

Brands

Track your own brand and competitors across AI responses.

Dashboard

One measured cohort per request: a calendar range, a platform set, a region set, a query class and — optionally — one segment. Every rate comes with the counts it is a ratio of and a stated reason wherever a figure is withheld; nothing here is a composite score or an average of percentages.

Sources

Retained source links from this project's answers. Explicitly unused retrievals are excluded; legacy links with unknown support remain labelled. Ownership is resolved from current brands. A source belongs to an answer, not to a mention.

Reports

Generate and download visibility, prompt performance, and competitor analysis reports in CSV, JSON, or PDF. Generation is synchronous and a period covers at most 31 inclusive days. No file is stored: a download regenerates from current data, so the same report id can return different numbers later. Every output carries a disclosure naming the report, its period, the population it was counted over, the calculation version and the generation time; the JSON output carries it as data and the row keeps it in filters.disclosure.

Alerts

An alert is an episode: one row per signal for as long as it is open, with a shared status (new, acknowledged, resolved) and a per-reader read state. Every episode carries the evidence it was raised on — period, threshold, what was observed, a link and the next action. A resolved episode never re-opens; a recurrence is a new episode.

Site audits

A Deep audit (2 per 30 days) of one public URL: a crawl, deterministic readiness checks, brand probes against the audit model and a synthesised report. A Quick audit (free) is the lighter one a visitor starts from the public page and it is not run through this API. 2 audits per project every 30 days, shared across the dashboard, this API and the MCP connector, and a competitor's audit spends it like your own site's; the allowance is reserved atomically before anything is bought, and a resend of the same request answers with the audit already queued.

Badge

A public shields-style badge stating the project's mention rate over the last 30 rolled-up days, with the counts it is a ratio of and the window. One colour whatever the number: it states a rate and does not grade it.

Billing

Account billing across all owned projects. Each active prompt-region in a switched-on project is one $3 monthly unit; a switched-off project is neither measured nor billed, and seats cost nothing. The $6 signup credit applies to Stripe invoices and grants no free prompt allocation. Saving a card does not start billing.

API Keys

Manage API keys for programmatic access. The full key is shown only once upon creation. A key carries two independent permissions, chosen at creation and not editable afterwards: scope (all or selected) says which projects it reaches, accessMode (read or write) says what it may do inside them, and neither widens the other. A new key is read-only unless it asks for write; a read key is refused every mutation over REST and over the MCP connector alike, where tools/list shows it only the read tools. An optional expiresAt is enforced before any handler runs; no expiry means the key runs until revoked.

Companies and access

Access is shared on two separate axes. A company role — Owner, Admin or Member — is what the identity provider records; Owners and Admins reach every project in the company, including ones created later, and manage billing, members and API keys. A Member reaches only the projects a per-project grant names, as a Viewer (read and export) or an Editor (read and change prompts, brands and settings). Members are not billed per seat. Companies, members and invitations are managed in the app with a signed-in session; an API key acts as the person who issued it and carries that person's reach, and is refused on the company endpoints themselves.

Settings

Read or update stored notification configuration and integration choices.

Content

The content workspace: the reads, plus the two payment starts. The dashboard's own API carries further content routes — creating and revising an artifact, reviewing, approving, publishing, configuring a destination and connecting a provider — which this reference does not cover yet. Content & Growth is a separate subscription from monitoring on the same account, with its own allowance ledger, and the two may invoice on different dates. It has two tiers: Managed offers the drafting platforms ChatGPT, Claude, Perplexity, Gemini, Grok and DeepSeek; BYOK offers GPT-4.1 mini, Claude Sonnet 5.5 or 4.5, and GLM 4.6 only when the matching OpenAI, Anthropic or Z.AI key is connected, and the customer pays those vendor tokens separately. Each tier's price, included units, top-up pack and card-backed trial come from this deployment's Stripe prices: GET /api/content/billing returns them and the billing page shows them before anything is charged. Allowances stay in their original tier. A deployment that has not been given its Stripe price ids answers 503 with content_plan_unconfigured on both payment routes and names what is outstanding, rather than selling at an invented number.

System

Operational endpoints.

Authentication

You can authenticate in two ways:

  1. Session cookie -- Automatically set when you log in via the web UI.
  2. API key -- Generate one at POST /api/api-keys and pass it as a bearer token in the Authorization header.
curl -s -H "Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  https://signalkit.ai/api/prompts

MCP Server

New

Use SignalKit from Claude, Claude Code, Cursor, Cline, Zed or any client that takes a remote MCP server by URL, so you can ask "what's my mention rate this week?" in plain English. The hosted connector at https://app.signalkit.ai/api/mcp exposes 57 typed tools — 33 reads over projects, segments, brands, prompts, the measured overview, query fan-out, data health, the weekly brief, results, sources, alert episodes, audits, reports, billing, settings and the content workspace, and 24 writes that create, change, run or spend. It also exposes list_app_operations to discover registered REST workflows before a connection uses read_app or change_app. The catalog labels mutation input as an authored validation schema or as field hints; for hints, each route remains authoritative for required fields, types and nested objects.

On the content workspace the connector reads the queue, the library and one artifact, can store an idea, brief or draft it wrote itself, and can buy the next revision from SignalKit's own editorial pipeline. Only the last of those spends the content allowance, and its hold is keyed on the artifact and its head revision number — derived by the server, not sent by the caller — so a retry shares a hold and a stale request cannot replay a settled one. Clinical certification and publishing require a signed-in person in the app. API-key agents are also refused destination and recipe management; an OAuth connection retains its signed-in person's ordinary administration role. Each read reports that limit in an authority block rather than leaving the agent to discover it. Discovered app operations that need a signed-in person return a dashboard handoff and execute nothing. While Content & Growth is unpriced on a deployment the two writing tools are refused as subscription_required.

The key's access mode carries into the connector: a read key is offered only the read tools by tools/list and refused a write tool if it calls one anyway; a write key gets all of them. No read tool triggers paid work. An OAuth connection gets every tool, acting with the signed-in person's own projects and role. The connector also exposes list_organizations; its tenant tools accept organizationId when a person belongs to several organizations. A stdio package over the same REST API exists in the source tree for clients that run a command; it is not published to npm.

Connect a client

Copy-paste setup for Claude Code, Cursor and the local stdio server, with read-key guidance, is at /docs/connector. Contact hello@signalkit.ai if your client needs a different connection flow.

Rate Limiting

Limits are ten times higher for API-key callers than for a signed-in browser session. Most endpoints allow 600 requests per minute per API key (60 per browser session); report generation allows 200 per minute per API key (20 per session). Two endpoints are much tighter: POST /api/prompts/{id}/run allows 100 per hour per API key (10 per browser session) — per hour, not per minute — and POST /api/prompts/suggest allows 100 per minute per key (10 per session). When a rate limit is exceeded the API returns 429 Too Many Requests with a Retry-After header.