Same engine, from a pipeline
A dashboard scan is the right tool for a human. A pull request is not a human with a browser tab.
The Developers section is FontScanner as JSON: start a job, wait (or don’t), act on commercial matches.
One authentication scheme — X-API-Key — and three start routes:
POST /api/ci/scans/website— crawl a domainPOST /api/ci/scans/pdf— upload a brochure or brand PDFPOST /api/ci/scans/image— identify type in a mockup
Every start returns 202 with a jobId. Status moves Queued → Processing → Completed (or Failed).
Poll or webhook
Poll GET /api/ci/jobs/{jobId} until Completed. Fine for a GitHub Action step that can wait.
Webhook — pass webhook: { enabled: true, url, headers } at start time. FontScanner POSTs the same job envelope the moment the scan finishes. Use that when the crawl should not block the job runner.
Completed jobs put a slim result in result: jobId, domain, status, scanTime, jobType, matchedKnownFonts, and pages with per-font license flags. Website jobs list crawled pages; PDF and image jobs put detections on a single page row.
The full dashboard JSON remains on GET /api/scans/{id} if a human needs the same report in the UI.
Fail the build on purpose
The useful CI rule is boring:
- Start a website scan for the preview or production host
- Wait for
Completed - If
matchedKnownFontscontains a commercial family you have not approved — fail
That is how a theme update that quietly added Gotham becomes a red check instead of a letter from a foundry. Pair it with your license inventory: credited scans can show Verified / Domain not covered / Missing the same way the dashboard does.
Credits
- Website and PDF — 1 scan credit each (the free welcome credit applies)
- Image — counts against the daily identification limit, not a credit
Create a key under Profile → API Keys. The same key works for every CI endpoint. Docs, curl examples, and field tables live on the Developers page.
How this sits next to the other products
| Surface | Who it is for |
|---|---|
| Developers / API | Pipelines, bots, preview deploys |
| Chrome extension | A human already on the page |
| Quick website scan | A no-account homepage sniff |
| Image scan | Mockups and screenshots |
| Full audit | Launch QA and client reports |
The API is not a different detector. It is the same catalog, started by a header instead of a form.
Conclusion
If fonts can ship without a review, they will. Wire the scan into CI so “unlicensed commercial font” is a build failure — not a surprise in production.