API Documentation

Scan endpoints return JSON (HTML for browsers). No authentication required. Fresh scans are rate limited to 60 requests/hour per IP; cached results don't count toward the limit, and static, docs, and health routes are not limited.

OpenAPI 3.1 spec · AI catalog — agent-friendly discovery.

Privacy

No accounts, no tracking. Scan results are cached for one hour in Cloudflare KV, keyed by domain and scan type. Usage is logged only as aggregate scan counts per day (no domain names, no IPs), retained 7 days, and rate limiting keys on a hashed IP. TLS enrichment uses a Fly.io probe that receives only the target domain. Full policy: Privacy.

GET /{domain}

Full scan — security headers, CSP, CORS, redirect chain, cache behavior. Returns HTML for browsers, JSON for everything else.

GET /{domain}/cors

CORS-focused scan — preflight simulation, origin reflection detection.

GET /{domain}/csp

CSP analysis — directive parsing, bypass detection, grading.

GET /{domain}/headers

Security headers only — HSTS, XFO, XCTO, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP.

GET /{domain}/chain

Redirect chain — follow up to 20 hops, per-hop timing, loop/mixed-content detection.

GET /{domain}/cache

Cache behavior — Cache-Control parsing, TTL, Vary, CDN detection.

POST /cors

CORS simulation. Body: {"target":"…","origin":"…","method":"GET","headers":[],"credentials":false}

POST /error

CORS error decoder. Body: {"error":"paste browser console error here"}

POST /csp/evaluate

Evaluate a CSP string. Body: {"policy":"default-src 'self'; script-src …"}

Response format

All domain scan responses include _meta.links with related resources: full_report on yoke.lol, tls_details on certs.lol, dns_details on ns.lol, and email_validation on vrfy.lol.