Base URL and contract
All stable agent REST endpoints are versioned under /api/v1/agent. The OpenAPI 3.1 document is the canonical schema.
https://submitforbacklinks.com
Download /openapi.json or discover the same document at /.well-known/openapi.json.
Request limits
Limits are enforced across application instances. A rejected request returns HTTP 429 with an exact Retry-After value in whole seconds.
General Agent API and MCP
Every 60 seconds: 120 requests per IP, 120 per API key, and 240 per owner account.
Badge verification
Every 3600 seconds: 20 requests per IP, 10 per API key, and 15 per owner account.
Endpoints
/api/v1/agent/capabilities
Public service discovery and canonical documentation links.
Authentication: Public
/api/v1/agent/scan
Prepare a stateless proposed draft; no domain is reserved and creation eligibility is not guaranteed.
Authentication: Public; optional Bearer requires sites:scan
/api/v1/agent/submissions?limit=50&cursor=…
List owner-scoped submissions newest first. limit defaults to 50 and is capped at 100; pass the opaque nextCursor to continue.
Authentication: Bearer · submissions:read
/api/v1/agent/submissions
Create a free draft, or submit only when all reviewed listing fields are supplied.
Authentication: Bearer · submissions:write (+ sites:scan when the server must scan; + submissions:submit for action=submit) · idempotency
/api/v1/agent/submissions/{id}
Retrieve one owner-scoped submission and its current status.
Authentication: Bearer · submissions:read
/api/v1/agent/submissions/{id}
Replace nine reviewed fields on an editable owner-scoped submission and optionally update founder details.
Authentication: Bearer · submissions:write · idempotency
/api/v1/agent/submissions/{id}/submit
Finalize an existing draft after explicit owner confirmations.
Authentication: Bearer · submissions:write + submissions:submit · idempotency
/api/v1/agent/submissions/{id}/badge
Retrieve the free-listing badge, verification, follow-window, and markup state.
Authentication: Bearer · submissions:read
/api/v1/agent/submissions/{id}/badge
Issue badge markup for an owner-scoped free listing.
Authentication: Bearer · submissions:write · idempotency
/api/v1/agent/submissions/{id}/badge/verify
Verify issued badge markup on a public HTTPS page of the submitted domain.
Authentication: Bearer · submissions:write · idempotency
Authentication
Direct REST and MCP clients send the owner-scoped token in the Authorization header. The CLI obtains and stores it automatically after domain proof. Never put it in a URL or request body.
Authorization: Bearer ${SUBMITFORBACKLINKS_API_KEY}Authentication failures return HTTP 401 with a WWW-Authenticate Bearer challenge. A valid token without a required scope returns HTTP 403.
Bounded submission lists
GET /api/v1/agent/submissions uses keyset pagination so account history remains fast as it grows. Pass limit from 1 to 100; the default is 50. When nextCursor is not null, send it unchanged as cursor on the next request. Existing clients can continue reading the submissions array and ignore the added nextCursor field.
GET /api/v1/agent/submissions?limit=50&cursor=${NEXT_CURSOR}Durable outcomes and safe retries
Every mutating request requires a caller-generated UUID in Idempotency-Key: draft creation, direct submission, submission update, finalization, badge issue, and badge verification. The first outcome, including an error, is stored for that key. After a timeout or unknown response, reuse the same key to retrieve the exact outcome. If a replayed transient error includes error.fields.submissionId, retrieve that submission before doing anything else. Use a new UUID only after confirming that no submission exists, correcting the cause, and intentionally starting a new operation.
Idempotency-Key: 00000000-0000-4000-8000-000000000001Terminal agent-operation records are retained for 30 days after their final status update. Revoked API-key metadata is retained for 30 days after revocation, and expired API-key metadata for 30 days after expiration. Raw API-key secrets are never stored. Completed and failed website-scan records, including prepared draft results, are retained for 30 days after their final update. Active scans and the 24-hour quota and cache window are not deleted.
Direct submission requires reviewed fields
action=draft saves owner-scoped work without attestations. Domain and duplicate enforcement happens during creation, not the earlier stateless scan. action=submit is only valid when the caller has already inspected a scan result and sends all nine reviewed listing fields under overrides, plus every explicit confirmation. The server does not treat an unseen internal scan as reviewed content.
{
"websiteUrl": "https://yourproduct.com",
"action": "submit",
"listingType": "FREE",
"overrides": {
"name": "Your Product",
"tagline": "A focused workflow for growing SaaS teams",
"shortDescription": "Your Product helps SaaS teams organize work and move from an idea to a clear result.",
"fullDescription": "Your Product gives growing SaaS teams one focused workspace for planning, collaboration, and delivery. Teams can organize active work, keep decisions visible, and reduce time spent moving between disconnected tools. Review this text against the product website before submitting it.",
"primaryCategorySlug": "productivity",
"tags": ["Productivity", "Collaboration"],
"pricingModel": "SUBSCRIPTION",
"platformType": "WEB",
"productType": "SAAS"
},
"attestations": {
"guidelinesAccepted": true,
"badgeRequirementAcknowledged": true,
"canRepresentProduct": true,
"reviewedGeneratedContent": true
}
}Draft → inspect → finalize is the normal path
Create a draft, retrieve it with GET /api/v1/agent/submissions/{id}, show the generated fields to the owner, correct it with PATCH if needed, retrieve the saved result again, and then finalize it. Use direct submission only when the caller already holds and reviewed the complete scan result.
Correct an editable owner-scoped submission
PATCH replaces the complete set of nine listing fields on an editable owner-scoped submission. Send all nine reviewed values under overrides, even when only one changed. Founder name, contact email, and company name are optional. Updating a submitted or published working copy may return it to DRAFT for re-review while the current public listing remains live. Retrieve the submission again so the owner reviews the exact saved state before finalizing.
{
"overrides": {
"name": "Your Product",
"tagline": "A focused workflow for growing SaaS teams",
"shortDescription": "Your Product helps SaaS teams organize work and move from an idea to a clear result.",
"fullDescription": "Your Product gives growing SaaS teams one focused workspace for planning, collaboration, and delivery. Teams can organize active work, keep decisions visible, and reduce time spent moving between disconnected tools.",
"primaryCategorySlug": "productivity",
"tags": ["Productivity", "Collaboration"],
"pricingModel": "SUBSCRIPTION",
"platformType": "WEB",
"productType": "SAAS"
},
"founderName": "Founder Name",
"contactEmail": "[email protected]",
"companyName": "Your Company"
}Finalize an existing draft
Retrieve and review the saved draft first, then use its submission ID. The finalization request independently requires an idempotency key and all four confirmations. launchWeekStart is optional; the service otherwise selects the next available week.
{
"attestations": {
"guidelinesAccepted": true,
"badgeRequirementAcknowledged": true,
"canRepresentProduct": true,
"reviewedGeneratedContent": true
}
}Issue, install, and verify the free-listing badge
POST action=issue to receive the exact badge markup, install one returned theme on a public HTTPS page of the submitted domain, then POST its targetUrl to the verification endpoint. GET the badge resource to inspect status, failure reason, timestamps, follow-window state, link policy, and markup. Verification completed before publication remains pending until the approved listing goes live.
{
"action": "issue"
}{
"targetUrl": "https://yourproduct.com/partners"
}Verified free badges are rechecked daily. Transient network or server failures retain verification and retry after 15 minutes, one hour, then six hours. Definitive missing or invalid markup changes the listing to nofollow. A successful later verification restores only the time remaining in the original 60-day window. See the badge verification guide.
Optional media is dashboard-managed
A logo and up to three screenshots are optional listing media. Agent API v1 has no media-upload operation; REST, CLI, and MCP clients cannot upload or replace these files.
The owner can add or manage media from the signed-in browser dashboard.
Stable error envelope
Branch on error.code. Display error.message to the operator, use fields for validation, and respect the Retry-After header on HTTP 429 instead of retrying immediately.
{
"error": {
"code": "VALIDATION_ERROR",
"message": "Review the highlighted fields.",
"fields": {
"launchWeekStart": ["Choose an available free launch week."]
}
}
}