Name: Web App Manifest Checker API: PWA Manifest Validator
Brand: glowhalo
SKU: api-glowhalo-web-app-manifest-checker-api
Availability: InStock
Author: API Market

# Web App Manifest Checker API

## Overview

The Web App Manifest Checker API takes a page URL, finds the page's `<link rel="manifest">`, fetches the manifest and validates it against the W3C Web App Manifest specification. You get one JSON report with coded issues, an overall grade (A+ to F), a score out of 100 and an installability verdict with a list of blockers. A second endpoint validates manifest JSON you paste in, offline, with no outbound request, so you can test a manifest before it ships.

It is built for developers, PWA auditors, SEO and QA teams who need a quick headless check from CI or a script without running Lighthouse. The installability verdict follows Chrome's manifest-level install criteria only: a `name` or `short_name`, a `start_url` that is same-origin and inside the scope, an installable `display` mode, a 192px icon with purpose `any`, no `prefer_related_applications`, and an HTTPS page. Those are the only checks that fill `installability.blockers`. Everything else (512px icon, maskable icon, colors, `lang`, `id`, shortcuts, screenshots, the page's viewport and theme-color tags) is quality advice reported as warnings or infos.

The grade and score use the provider's own formula (100 minus 25 per error, 10 per warning and 1 per info). They are not a Lighthouse score. The verdict reads declarations only: it does not guarantee that a browser will show an install prompt, and it does not check service workers, offline support, certificate quality or whether the icon files actually load.

## Features

*   **2 endpoints**: Check the manifest of a live URL, or validate manifest JSON you supply.
*   **Automatic manifest discovery**: The page is fetched (up to 5 redirects, first 512 KB of HTML), its manifest link is read and the manifest is fetched (up to 256 KB).
*   **Flexible input**: A value without a scheme, such as `example.com`, is treated as https. The aliases `u`, `link`, `target`, `site`, `website`, `domain` and `host` are accepted for `url`.
*   **Installability verdict**: `installability.installable` plus a `blockers` list that names the Chrome criteria the manifest fails.
*   **Coded findings**: Every finding is an `issues[]` entry with a stable `code` (for example `icon_192_missing`, `display_missing`, `no_maskable_icon`), a severity (error, warning or info) and a message.
*   **Grade and score**: An A+ to F grade and a 0 to 100 score (A+ 97 and up, A 90, B 80, C 70, D 60, F below 60), plus counts of errors, warnings and infos.
*   **Structured output**: `manifestSummary` (name, start URL, display, colors, counts), a resolved `icons[]` list and page signals (`manifestLinks`, `themeColorMeta`, `viewport`, `appleTouchIcon`, `https`).
*   **Offline validation**: `POST /v1/validate` makes no outbound request; pass `manifestUrl` to resolve relative URLs and enable same-origin checks.
*   **Caching**: Check results are cached for 6 hours per URL; add `fresh=1` to bypass the cache.
*   **Rate limit**: 10 requests per second on both the Free and Basic plans.

## Use Cases

*   **CI and release gates**: Fail a pipeline when a deploy breaks the manifest or makes the site not installable.
*   **PWA audits**: Check a list of customer or competitor sites and see which manifests are missing icons, a start URL or a display mode.
*   **SEO and site-audit tools**: Add a manifest section to a crawl report with a grade and coded issues.
*   **Debugging**: Paste a manifest into the validate endpoint and see what Chrome would object to before you deploy.
*   **Monitoring**: Re-check key sites on a schedule and alert when the grade or the installability verdict changes.

## API Documentation

### Base URL

All requests go through the API.market gateway at this base URL:

```
https://prod.api.market/api/v1/glowhalo/web-app-manifest-checker-api
```

### Authentication

Every request needs your API.market key in the `x-api-market-key` header:

```
x-api-market-key: YOUR_API_KEY
```

Replace `YOUR_API_KEY` with your actual API key.

### Endpoints

#### 1. Check the Web App Manifest of a URL

Sends one anonymous GET to the page, follows up to 5 redirects, finds the manifest link, fetches the manifest and validates it. When the page declares no manifest, the response has `found` set to `false` and `grade` set to `no_manifest`. When the page itself answers with HTTP 4xx or 5xx (for example because it blocks datacenter traffic), `grade` is `unchecked`. Results are cached for 6 hours per URL.

**Method:** `GET`

**Endpoint:** `/v1/check`

**Parameters:**

| Name | In | Description | Type | Required | Default | Max Value |
|---|---|---|---|---|---|---|
| `url` | query | Page to inspect, for example `https://web.dev`. A value without a scheme is treated as https. The aliases `u`, `link`, `target`, `site`, `website`, `domain` and `host` are also accepted. | string | Yes | - | - |
| `fresh` | query | Set to `1` to bypass the 6-hour result cache. | string | No | - | - |

**Example Request:**

```bash
curl -X GET "https://prod.api.market/api/v1/glowhalo/web-app-manifest-checker-api/v1/check?url=https://web.dev" \
  -H "x-api-market-key: YOUR_API_KEY"
```

**Example Response (200 OK, abridged: 2 of 8 icons shown):**

```json
{
  "url": "https://web.dev/",
  "finalUrl": "https://web.dev/",
  "statusCode": 200,
  "cached": false,
  "checkedAt": "2026-10-13T18:03:28.931Z",
  "note": "Service workers and icon file reachability are not evaluated; only the page HTML and the manifest JSON are read.",
  "found": true,
  "manifestUrl": "https://web.dev/_pwa/web/manifest.json",
  "manifestStatus": 200,
  "page": {
    "manifestLinks": 1,
    "themeColorMeta": "#3740ff",
    "viewport": "width=device-width, initial-scale=1",
    "appleTouchIcon": true,
    "https": true
  },
  "installability": {
    "installable": true,
    "blockers": []
  },
  "grade": "B",
  "score": 86,
  "summary": {
    "errors": 0,
    "warnings": 1,
    "infos": 4
  },
  "manifestSummary": {
    "name": "web.dev",
    "shortName": "web.dev",
    "id": null,
    "startUrl": "https://web.dev/",
    "scope": null,
    "display": "standalone",
    "displayOverride": null,
    "orientation": "portrait",
    "themeColor": "#3740ff",
    "backgroundColor": "#fff",
    "lang": null,
    "dir": null,
    "iconCount": 8,
    "hasMaskableIcon": false,
    "screenshotCount": 0,
    "shortcutCount": 0
  },
  "icons": [
    {
      "src": "icons/icon-192x192.png",
      "resolved": "https://web.dev/_pwa/web/icons/icon-192x192.png",
      "sizes": "192x192",
      "type": "image/png",
      "purpose": "any"
    },
    {
      "src": "icons/icon-512x512.png",
      "resolved": "https://web.dev/_pwa/web/icons/icon-512x512.png",
      "sizes": "512x512",
      "type": "image/png",
      "purpose": "any"
    }
  ],
  "issues": [
    {
      "severity": "warning",
      "code": "no_maskable_icon",
      "message": "No icon with purpose \"maskable\"; Android launchers will shrink your icon onto a white circle or square instead of filling the adaptive shape."
    },
    {
      "severity": "info",
      "code": "id_missing",
      "message": "No \"id\"; Chrome falls back to \"start_url\" as the app identity, so changing start_url later makes it a different app. Set an explicit \"id\"."
    }
  ]
}
```

#### 2. Validate manifest JSON offline

Validates a manifest you provide and makes no outbound request. Send `manifest` as a JSON object or as JSON text. Without `manifestUrl`, relative URLs resolve against a placeholder origin, same-origin checks are skipped and HTTPS is not evaluated; the response says so in `assumptions`. The response has the same grade, score, installability, summary, icons and issues as the check endpoint.

**Method:** `POST`

**Endpoint:** `/v1/validate`

**Parameters:**

| Name | In | Description | Type | Required | Default | Max Value |
|---|---|---|---|---|---|---|
| `manifest` | body | The manifest as a JSON object, or as JSON text. | object or string | Yes | - | 256 KB |
| `manifestUrl` | body | URL the manifest is served from, for example `https://example.com/manifest.webmanifest`. Resolves relative URLs and enables same-origin checks. | string | No | - | - |

**Example Request:**

```bash
curl -X POST "https://prod.api.market/api/v1/glowhalo/web-app-manifest-checker-api/v1/validate" \
  -H "x-api-market-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"manifest":{"name":"Demo App","start_url":"/","display":"standalone","icons":[{"src":"/i192.png","sizes":"192x192","type":"image/png"}]}}'
```

**Example Response (200 OK, abridged to 2 of 8 issues):**

```json
{
  "grade": "C",
  "score": 74,
  "summary": {
    "errors": 0,
    "warnings": 2,
    "infos": 6
  },
  "installability": {
    "installable": true,
    "blockers": []
  },
  "assumptions": {
    "manifestUrl": null,
    "note": "Validated offline without \"manifestUrl\": relative URLs resolve against a placeholder origin and same-origin checks are skipped. HTTPS is not evaluated."
  },
  "manifestSummary": {
    "name": "Demo App",
    "shortName": null,
    "startUrl": "https://app.example/",
    "display": "standalone",
    "iconCount": 1,
    "hasMaskableIcon": false
  },
  "icons": [
    {
      "src": "/i192.png",
      "resolved": "https://app.example/i192.png",
      "sizes": "192x192",
      "type": "image/png",
      "purpose": "any"
    }
  ],
  "issues": [
    {
      "severity": "warning",
      "code": "icon_512_missing",
      "message": "No icon of at least 512x512 with purpose \"any\"; Chrome uses it for the splash screen and install dialog."
    },
    {
      "severity": "warning",
      "code": "no_maskable_icon",
      "message": "No icon with purpose \"maskable\"; Android launchers will shrink your icon onto a white circle or square instead of filling the adaptive shape."
    }
  ],
  "checkedAt": "2026-10-13T18:12:03.376Z"
}
```

## Status Codes

| Code | Status | Description |
|---|---|---|
| 200 | OK | The report is in the response body. For check, the target page's own HTTP status is reported in `statusCode`, and a page that answers 4xx or 5xx gives grade `unchecked`. |
| 400 | Bad Request | The `url` parameter or the validate body is missing or invalid, or the target is a private-network address. The body carries an error code and message. |
| 401 | Unauthorized | The `x-api-market-key` value is invalid or expired. |
| 403 | Forbidden | Your subscription does not include this endpoint. |
| 404 | Not Found | The endpoint path does not exist. Check the path against this page. |
| 413 | Payload Too Large | The validate request body is larger than 256 KB. |
| 429 | Too Many Requests | You went over 10 requests per second or used up your plan's request quota. |
| 500 | Internal Server Error | Something failed while processing the request. Retry after a short delay. |
| 502 | Bad Gateway | Check could not fetch the target URL. |
| 504 | Gateway Timeout | The target URL did not respond in time. |

## Rate Limits

Both plans allow 10 requests per second: the Free plan (500 requests per month) and the Basic plan (25,000 requests per month). Both quotas are hard limits. Requests above the per-second limit, or after the monthly quota is used up, return `429 Too Many Requests`; back off before retrying and honour any `Retry-After` header. Check results are cached for 6 hours per URL, so repeated checks of the same page within that window return the cached report; use `fresh=1` only when you need a new fetch, for example right after a deploy.

## FAQ

**Does installable mean the browser will show an install prompt?**

No. `installability.installable` only says whether the manifest meets the manifest-level Chrome criteria listed above. Browsers also look at service workers, user engagement and other signals that this API does not check.

**What do the grade and score mean?**

They summarize the manifest using the provider's own formula: the score is 100 minus 25 per error, 10 per warning and 1 per info, and the grade is derived from it (A+ 97 and up, A 90, B 80, C 70, D 60, F below 60). They are not a Lighthouse score.

**What does grade no_manifest or unchecked mean?**

`no_manifest` means the page HTML contains no manifest link. `unchecked` means the page answered with HTTP 4xx or 5xx, which often happens with sites that block datacenter traffic, so no manifest could be read.

**Are service workers and icon files checked?**

No. Only the declarations in the page HTML and the manifest JSON are checked. Service workers, offline support, certificate quality and whether the icon files actually load are not evaluated.

**Which manifests are not detected?**

Manifest tags injected by JavaScript and manifests declared only in an HTTP `Link` header are not detected. The page HTML is read up to 512 KB and the manifest up to 256 KB.

**How do I check a manifest before it is deployed?**

Send it to `POST /v1/validate`. No request is made to any site. Pass `manifestUrl` to resolve relative URLs and enable the same-origin checks.

**How fresh are check results?**

Results are cached for 6 hours per URL, and the `cached` field tells you whether the response came from the cache. Add `fresh=1` to force a new fetch.

**Can I check internal or staging hosts?**

Only if they are reachable from the public internet. Private-network targets are rejected. For anything else, copy the manifest and use the validate endpoint.

## Contact Us

If you have any questions or need assistance, you can reach out to us through the embedded chat on the bottom right corner of the page or send an email to hello@magicapi.com.


Web App Manifest checker API: find and validate a site's manifest, get coded issues, an A+ to F grade and a Chrome installability verdict in JSON.

Web App Manifest Checker API: PWA Manifest Validator