Skip to main content
The official Inspect.dev HTTP API supports release discovery, explicit CLI feedback, OAuth compatibility, account subscriptions, and billing. Mobile browser debugging itself runs locally through the Inspect CLI.

​
Machine-readable Inspect API contract

​
Inspect API conventions

  • Send Inspect-Version: 2026-08-06, or omit it to use the current version.
  • Errors use stable code, message, and recovery hint fields.
  • List endpoints use opaque cursors and return next-page state.
  • Responses advertise rate limits; HTTP 429 includes Retry-After.
  • Retriable billing writes accept Idempotency-Key.

​
Submit Inspect CLI feedback

POST https://inspect.dev/api/feedback accepts explicit, user-authored feedback from an authenticated Inspect user. Send the OAuth access token as a Bearer Authorization header. The required JSON object contains:
  • id: a caller-generated UUID. It is returned as the receipt and used to deduplicate delivery; reuse it when retrying the same submission.
  • message: the feedback text, from 1 to 4000 characters after trimming.
  • category: bug, idea, friction, or other.
  • cliVersion, platform, arch, and nodeVersion: basic CLI/runtime metadata strings from 1 to 128 characters each.
A successful response is { "received": true, "id": "<same UUID>" }. Invalid JSON or fields return HTTP 400, delivery failures return HTTP 500, and clients are limited to five submissions per authenticated user every 60 seconds. HTTP 429 includes Retry-After. The service derives the Clerk user ID from the validated bearer token and ties the delivered feedback to that account; a client-supplied user ID is rejected. The command sends only the generated receipt ID, explicit message, category, and listed CLI/runtime metadata in the JSON body. It does not attach logs, URLs, device or target identifiers, command history, or the working directory. Missing or invalid credentials return HTTP 401.

​
Authentication

Inspect uses OAuth 2.0 Authorization Code with PKCE through Clerk. See the Inspect authentication documentation and least-privilege permission matrix.
Use the CLI for local device and browser actions. Do not invent cloud API endpoints for snapshots, console messages, network requests, or screenshots.