---
title: "Documentation"
source: "https://ottom.io/docs"
summary: "Reference documentation for Ottom: every plan and what it includes, enterprise contracts, the limits on every scan, how a score is calculated, what alerts are sent, how workspaces and their roles work, how to prove a store is yours, how to connect a store from its own platform, and how to let our agent through your CDN."
---

# Documentation

Reference documentation for Ottom: every plan and what it includes, enterprise contracts, the limits on every scan, how a score is calculated, what alerts are sent, how workspaces and their roles work, how to prove a store is yours, how to connect a store from its own platform, and how to let our agent through your CDN.

- Plans and what each one includes: https://ottom.io/docs/plans
- Enterprise contracts: https://ottom.io/docs/enterprise
- Limits, and what happens when a store reaches one: https://ottom.io/docs/limits
- How an Ottom score is calculated: https://ottom.io/docs/scoring
- Alerts, and when each one is sent: https://ottom.io/docs/alerts
- Workspaces, roles and adding a store: https://ottom.io/docs/workspaces
- Proving a store is yours with a DNS record: https://ottom.io/docs/verify-store
- Connecting a store from its own platform: https://ottom.io/docs/connect

## Reference elsewhere on the site

- Our agent: https://ottom.io/agent. The user agent, egress address and synthetic identity, and how to opt a store out.
- Stall library: https://ottom.io/learn/stalls. Every finding a scan can report, with what causes it and how to fix it.
- HTTP API reference: https://ottom.io/developers/api. Start a scan from CI and read its result: endpoints, fields and error codes.
- MCP server: https://ottom.io/developers/mcp. Check a store from any AI assistant: tools, keys, limits and errors.
- OpenAPI document: https://ottom.io/developers/openapi.json. The same API, machine-readable, for generating a client.
- Developer changelog: https://ottom.io/developers/changelog. Dated changes to the API, the MCP server, the agent’s identity and the developer docs.
- Stall taxonomy as JSON: https://ottom.io/taxonomy.json. The same findings, machine-readable, under CC BY 4.0.
- Benchmark methodology: https://ottom.io/benchmarks/methodology. How scores are combined across stores into the category benchmarks.
- Trust centre: https://ottom.io/trust. The security controls, data flow and subprocessors a security review asks about.
- Glossary: https://ottom.io/glossary. The terms these pages use, defined once.

## Letting our agent through your CDN

- Letting our agent through your CDN: https://ottom.io/docs/cdn
- Allowing our agent through Cloudflare: https://ottom.io/docs/cdn/cloudflare
- Allowing our agent through Fastly: https://ottom.io/docs/cdn/fastly
- Allowing our agent through Akamai: https://ottom.io/docs/cdn/akamai
- Allowing our agent through AWS WAF and CloudFront: https://ottom.io/docs/cdn/aws
- Allowing our agent through Azure Front Door: https://ottom.io/docs/cdn/azure-front-door
- Allowing our agent through Google Cloud Armor: https://ottom.io/docs/cdn/google-cloud-armor
- Allowing our agent through the Vercel Firewall: https://ottom.io/docs/cdn/vercel

## Release gates in CI

- Release gates: failing a build when AI agents stall: https://ottom.io/docs/ci