Use Accessio.AI from Claude

Three integration paths, ordered from least to most setup:

1. REST API — `X-API-Key` against `https://api.accessio.ai/v1\`. Server-side scripts, CI jobs, dashboards.
2. Claude API with mcp_servers — server-to-server. Claude calls Accessio.AI tools on behalf of your backend.
3. Custom Connector in claude.ai (OAuth 2.1) — end-user-facing. Each user authorizes Accessio.AI inside Claude with their own scopes; tokens scope to their organization.

All three speak the same MCP tool surface and audit log on the Accessio.AI side.

1. Create a service-account API key

In the dashboard, go to Settings → API keys, create a new key, and grant the scopes you need:

Keys are hashed at rest; the plaintext is shown once. Store it in your secret manager as ACCESSIO_API_KEY.

2. Call the REST API directly

curl -H "X-API-Key: $ACCESSIO_API_KEY" \
     "https://api.accessio.ai/v1/scans?limit=20"

Response:

{
  "success": true,
  "data": [
    {
      "id": "…",
      "embedScriptId": "…",
      "pageUrl": "https://example.com/",
      "totalIssues": 4,
      "criticalCount": 1,
      "seriousCount": 2,
      "moderateCount": 1,
      "minorCount": 0,
      "scanDurationMs": 1234,
      "createdAt": "2026-04-17T12:34:56.000Z"
    }
  ],
  "metadata": { "limit": 20, "nextCursor": null },
  "disclaimer": "Automated WCAG scan. Not a legal compliance certification.",
  "scanSchemaVersion": "1.0.0"
}

Every response carries:

• disclaimer — the scan is automated and not a legal compliance certification.
• scanSchemaVersion — semver of the scan output schema; agents that cache results must revalidate on change.
• X-Request-Id response header — pass it back on support requests to locate the exact call in our audit log.

Paginate with ?cursor=<last-id>&limit=<n>. Maximum limit is 100.

3. Let Claude call the API for you

The Anthropic Messages API can invoke accessio.ai tools via mcp_servers. Your API key goes in authorization_token; Claude treats it as a Bearer token on the MCP transport.

curl https://api.anthropic.com/v1/messages \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "anthropic-beta: mcp-client-2025-11-20" \
  -H "content-type: application/json" \
  -d '{
    "model": "claude-opus-4-7",
    "max_tokens": 1024,
    "mcp_servers": [{
      "type": "url",
      "url": "https://mcp.accessio.ai",
      "name": "accessio",
      "authorization_token": "'"$ACCESSIO_API_KEY"'"
    }],
    "messages": [{
      "role": "user",
      "content": "List our 10 most recent accessibility scans and summarize the critical issues."
    }]
  }'

Tool surface (admin tier):

Each tool's complete metadata (annotations, scopes, JSON schema) is at https://mcp.accessio.ai/.well-known/mcp.json.

4. Add Accessio as a Custom Connector in claude.ai (OAuth 2.1)

End-user-facing flow. Each Claude user authorizes Accessio.AI inside their own claude.ai session; tokens are scoped to whichever organization they pick at consent time.

1. In claude.ai → Settings → Connectors → Add custom connector, paste:
   • Server URL: https://mcp.accessio.ai/mcp
   • The connector auto-discovers the OAuth authorization server via https://mcp.accessio.ai/.well-known/oauth-protected-resource.
2. Click Connect. Claude opens a popup to https://auth.accessio.ai/oauth2/auth with PKCE.
3. Sign in to Accessio.AI (or create an account). Pick the organization to grant access for. Review the scope list. Click Allow access.
4. Claude exchanges the auth code for an access token in the background. The connector is now wired.

The connector uses Dynamic Client Registration (RFC 7591), so no manual client setup is needed. The OAuth flow uses PKCE (RFC 7636) and resource indicators (RFC 8707) — tokens are bound to either https://mcp.accessio.ai or https://api.accessio.ai, never replayable across them.

5. Example prompts that work end-to-end

Once the connector is enabled (or mcp_servers is configured in your API call), these prompts exercise the tool surface. They're the same prompts Anthropic's review uses to validate the directory listing.

Example 1 — Triage the alt-text review queue

"Show me all alt-text suggestions still pending review on my Accessio.AI account, then approve any that look reasonable for product images and reject anything decorative."

Claude will: call list_alt_text with status=PENDING → loop the rows → call approve_alt_text or reject_alt_text per row, choosing a reason for rejections (typically DECORATIVE or BRAND_SPECIFIC).

Expected outcome: a summary of how many were approved/rejected and why.

Example 2 — Re-scan after a deploy

"My team just shipped a fix for the colour-contrast issues on our pricing page. Re-run the most recent scan for that page and tell me if the issues are resolved."

Claude will: call list_scans to find the pricing-page scan → call run_scan with that scan id and an idempotency key → wait briefly → call get_scan to read the new issue counts → compare and explain.

Expected outcome: a before/after on critical issue counts plus any remaining issues.

Example 3 — Plan-usage check before a bulk operation

"Before I have you process all the alt-text on my newest store, check how much quota I have left this month and warn me if it's tight."

Claude will: call get_quota → compare remaining to the size of the pending queue (from list_alt_text) → warn if the bulk job would exceed quota.

Expected outcome: a clear "you have N credits remaining, the queue is M rows, here's what I'd recommend" decision aid.

Example 4 — Multi-store inventory

"List every site on my Accessio.AI account that has the widget installed, and for each one show the most recent scan's critical issue count."

Claude will: call list_embed_scripts → for each row, call list_scans with that embedScriptId filter → return a table of site → most-recent-scan critical-issue count.

Expected outcome: a portfolio view of your sites' accessibility posture.

6. Security notes

⚠️ Never paste your API key into a chat prompt. Keys go in environment variables on your server, in CI secrets, or in a secret manager. A key dropped into a Claude/ChatGPT conversation may be logged, cached, or trained on — treat it as leaked the moment it reaches a prompt.

• Do not ship the key to a browser. The mcp_servers.authorization_token is a server-to-server secret. Use a backend proxy if your frontend needs scan data.
• Rotate on leak. Revoke in the dashboard; Accessio supports a 30-day dual-active window so rotation does not break live Claude sessions.
• Scope narrowly. Keys issued with only scans:read cannot invoke writes, even if Claude is tricked by a prompt-injected product title.
• Rate limited. Each key is capped at 60 requests/minute per route in v1 (Phase 2 raises this and adds per-tool weights). Watch for 429 Rate limit exceeded and back off using the Retry-After header.
• IP privacy. We coarsen client IPs (IPv4 → /24, IPv6 → /48) before they land in the audit log.
• Audit log. Every tool call and REST call is recorded with principalId, organizationId, action, requestId, and a SHA-256 hash of the arguments. Raw arguments are never stored; audit rows are retained for 90 days by default.
• Deprecation. When a route is scheduled for retirement we set Deprecation, Sunset, and Link: rel="successor-version" response headers per RFC 8594. Agents that cache responses must honor these.

7. Troubleshooting

Common errors and what to do about them. Every response carries an X-Request-Id header — include it in any support email so we can locate the exact call in our audit log.

Authentication

Rate limits

MCP tool errors

Connector setup in claude.ai

Other

Still stuck?

Email [email protected] with:

1. The X-Request-Id from the failing response
2. A timestamp (UTC) of when the error happened
3. The HTTP method + URL, or the MCP tools/call name + arguments (redact sensitive fields)

We'll locate the exact call in the audit log within minutes.

OpenAPI spec

• Machine-readable: api.accessio.ai/v1/openapi.json
• Interactive explorer: api.accessio.ai