Url Inspect

{
  "completeness": {
    "complete": true,
    "dnsQueries": 2,
    "httpTargets": 1,
    "notPerformed": [
      "response_body_download",
      "get_request_fallback",
      "javascript_rendering",
      "malware_or_phishing_reputation",
      "certificate_chain_validation",
      "rdap_registration",
      "bgp_or_rpki_validation"
    ],
    "partialReasons": []
  },
  "findings": [
    {
      "code": "header_not_observed",
      "detail": "strict-transport-security was not present in the HEAD response; absence alone is not a vulnerability verdict.",
      "target": 0
    },
    {
      "code": "header_not_observed",
      "detail": "content-security-policy was not present in the HEAD response; absence alone is not a vulnerability verdict.",
      "target": 0
    },
    {
      "code": "header_not_observed",
      "detail": "x-frame-options was not present in the HEAD response; absence alone is not a vulnerability verdict.",
      "target": 0
    },
    {
      "code": "header_not_observed",
      "detail": "x-content-type-options was not present in the HEAD response; absence alone is not a vulnerability verdict.",
      "target": 0
    },
    {
      "code": "header_not_observed",
      "detail": "referrer-policy was not present in the HEAD response; absence alone is not a vulnerability verdict.",
      "target": 0
    },
    {
      "code": "header_not_observed",
      "detail": "permissions-policy was not present in the HEAD response; absence alone is not a vulnerability verdict.",
      "target": 0
    }
  ],
  "inputUrl": "https://example.com/",
  "normalizedUrl": "https://example.com/",
  "observedAt": "2026-09-21T15:56:40.037Z",
  "redirects": [],
  "sourceLinks": {
    "dns": "https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/",
    "http": "https://www.rfc-editor.org/rfc/rfc9110.html",
    "platformSecurity": "https://developers.cloudflare.com/workers/reference/security-model/"
  },
  "targets": [
    {
      "dns": {
        "a": [
          "104.20.23.154",
          "172.66.147.243"
        ],
        "aaaa": [
          "2606:4700:10::ac42:93f3",
          "2606:4700:10::6814:179a"
        ],
        "observedAt": "2026-09-21T15:56:40.006Z",
        "status": "resolved"
      },
      "hostname": "example.com",
      "http": {
        "headers": {
          "contentSecurityPolicy": null,
          "permissionsPolicy": null,
          "referrerPolicy": null,
          "strictTransportSecurity": null,
          "xContentTypeOptions": null,
          "xFrameOptions": null
        },
        "location": null,
        "method": "HEAD",
        "observedAt": "2026-09-21T15:56:40.036Z",
        "status": 200
      },
      "url": "https://example.com/"
    }
  ],
  "terminal": {
    "status": 200,
    "target": 0
  },
  "warnings": []
}

# bash or zsh: see the payment challenge. Nothing is charged.
curl -sS -g -i 'https://toolvend.dev/url/inspect?url=https%3A%2F%2Fexample.com'

# x402 v2 sends the challenge base64-encoded in the PAYMENT-REQUIRED header (v1 sends it in the body).
# To read the header:
curl -sS -g -o /dev/null -D - 'https://toolvend.dev/url/inspect?url=https%3A%2F%2Fexample.com' \
  | grep -i '^payment-required:' | cut -d' ' -f2 | tr -d '\r' | base64 --decode

// npm i @x402/fetch @x402/evm viem
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

// Pays at most $0.009 per call.
const client = new x402Client().setSpendControls({ maxAmountPerPayment: "$0.009" });
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.EVM_PRIVATE_KEY) });
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? ToolVet checks it first for $0.005. Pay for that from a separate
// client: this one is capped at $0.009 per payment. GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Ftoolvend.dev%2Furl%2Finspect
const res = await pay("https://toolvend.dev/url/inspect?url=https%3A%2F%2Fexample.com");
console.log(res.status, await res.text());

# pip install "x402[requests,evm]"
import os
from eth_account import Account
from x402 import x402ClientSync
from x402.http.clients import x402_requests
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client

# Pays at most $0.009 per call.
client = x402ClientSync().set_spend_controls({"max_amount_per_payment": "$0.009"})
register_exact_evm_client(client, EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"])))

with x402_requests(client) as session:
    res = session.get("https://toolvend.dev/url/inspect?url=https%3A%2F%2Fexample.com")
    print(res.status_code, res.text)