API Documentation

All endpoints return JSON. No authentication required. Rate limited to 60 requests/hour per IP.

OpenAPI 3.1 spec · AI catalog — agent-friendly discovery.

GET /{domain}

Full scan — security headers, CSP, CORS, redirect chain, cache behavior. Returns HTML for browsers, JSON for everything else.

GET /{domain}/cors

CORS-focused scan — preflight simulation, origin reflection detection.

GET /{domain}/csp

CSP analysis — directive parsing, bypass detection, grading.

GET /{domain}/headers

Security headers only — HSTS, XFO, XCTO, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP.

GET /{domain}/chain

Redirect chain — follow up to 20 hops, per-hop timing, loop/mixed-content detection.

GET /{domain}/cache

Cache behavior — Cache-Control parsing, TTL, Vary, CDN detection.

POST /cors

CORS simulation. Body: {"target":"…","origin":"…","method":"GET","headers":[],"credentials":false}

POST /error

CORS error decoder. Body: {"error":"paste browser console error here"}

POST /csp/evaluate

Evaluate a CSP string. Body: {"policy":"default-src 'self'; script-src …"}

Response format

All domain scan responses include _meta.links with related resources: full_report on yoke.lol, tls_details on certs.lol, dns_details on ns.lol, and email_validation on vrfy.lol.