Cybersecurity Configuration Intelligence API

SecurityHeadersTLSx402

Read security headers, TLS, cookies, CORS, and CSP from a public URL or from configuration supplied by the caller. Listed paths are the only extra resources requested.

API Documentation
POST/api/v1/security-configuration/header-audit$0.04 USDC

Read security headers from a public URL or from headers supplied by the caller. A missing header is a confirmed gap only when the response was available. This does not show that the site is secure.

POST/api/v1/security-configuration/tls-audit$0.04 USDC

Read the certificate from one public HTTPS request, or from certificate fields supplied by the caller. An old protocol, an expired certificate, a name mismatch, or an untrusted certificate is confirmed. This does not show that the site is secure.

POST/api/v1/security-configuration/cookie-audit$0.03 USDC

Check Secure, HttpOnly, and SameSite on Set-Cookie headers from one public response or from cookie lines supplied by the caller. Cookie values are not returned.

POST/api/v1/security-configuration/cors-policy-audit$0.04 USDC

Read CORS response headers. When an origin is supplied, it is sent once on the public GET. A wildcard, or a reflected origin with credentials, is confirmed. No other origins are tried.

POST/api/v1/security-configuration/csp-policy-analyze$0.04 USDC

Read Content-Security-Policy from a public response or from policy text supplied by the caller. unsafe-inline, unsafe-eval, a script wildcard, and data: scripts are confirmed. This is not a full policy review.

POST/api/v1/security-configuration/exposed-file-check$0.05 USDC

Request only the paths the caller lists, on the same host as the supplied URL. A non-HTML HTTP 200 is a confirmed reachable path. No common-file list is guessed and the body is not copied.

POST/api/v1/security-configuration/public-endpoint-audit$0.05 USDC

Send one GET to each listed public URL and record HTTPS, HSTS, and nosniff. Credential URLs and non-public addresses are not fetched. No login or credential test is attempted.

POST/api/v1/security-configuration/website-report$0.12 USDC

Combine header, TLS, cookie, CORS, and CSP observations for one public URL or supplied configuration. Extra paths and endpoints are requested only when listed. The report does not show that the site is secure.

Other products in this area. Open one for its resources and price.

CVE & Dependency Security API

Independent API for vulnerability and dependency security: CVE details, package checks, batch queries, risk assessments, dependency trees, project health, repository Scorecard, and lockfile auditing from OSV, CISA KEV, FIRST EPSS, NVD, Google deps.dev, and OpenSSF Scorecard.

SecurityVulnerabilitiesCVEDependencyx402

Software Supply Chain Security API

Independent SBOM and dependency checks for exact package versions: OSV advisory ranges, CISA KEV exposure, open-source licence policy, and publicly documented malicious-package advisories.

SecuritySBOMDependenciesLicencesx402

Malware & File Threat Intelligence API

Extract behaviour indicators, cluster artifacts, analyze executable metadata, detect macro/document risk, extension mismatches, suspicious script patterns, archive payload risks, and IoCs—using local static parsing of caller-supplied files and analysis reports only.

MalwareFile SecurityIoCStatic AnalysisArchivesx402

Threat Intelligence & Public Signals API

Aggregate verified key-free public threat feeds, enrich IoCs, analyze domain history, cluster certificate and phishing infrastructure, detect typosquats, review exposed-service inventory, and score indicator confidence—without API keys, paid providers, or intrusive scanning.

Threat IntelligenceIoCPhishingCertificatesDNSx402

Email & Domain Intelligence API

Check email syntax, MX, SPF, DKIM, DMARC, RDAP registration, and public TLS for a domain. Mailbox existence is not tested, and no reputation score is invented.

EmailDNSDeliverabilityx402