API 09 · Runs on Vercel

URL Safety

Scores a URL with explainable static heuristics (credentials in the authority, IP hosts, punycode, risky TLDs, shorteners, credential-lure keywords, length and encoding), resolves its registrable domain from the Public Suffix List, and optionally follows redirects safely to detect downgrades and cross-domain hops. Every point carries a reason. No reputation or malware database is used, and a low score is not a safety guarantee.

POST https://dev.itsozy.lol/api/v1/url/check

Runs on Vercel. Fully served by the Rust function on Vercel.

Authentication

Send Authorization: Bearer ozy_… with an API key that includes the url permission (or *). Signed-in dashboard sessions work in the playground. Each call costs 1 unit.

Parameters

Name	Type		Description
`url`	string	required	URL to analyse
`follow_redirects`	boolean	optional	Fetch and inspect redirects (default true)

Example request

curl -X POST https://dev.itsozy.lol/api/v1/url/check \
  -H "Authorization: Bearer $OZY_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "http://secure-login.example-account.top/verify"}'

Example response (illustrative)

{
  "domain": {
    "host": "secure-login.example-account.top",
    "public_suffix": "top",
    "registrable_domain": "example-account.top"
  },
  "malware_detection": false,
  "reasons": [
    "+15 unencrypted http scheme",
    "+10 top-level domain frequently seen in abuse reports",
    "+15 multiple credential-lure keywords"
  ],
  "risk_level": "high",
  "risk_score": 55,
  "valid": true
}

Errors

Errors use one envelope: {"error": {"code": "…", "message": "…"}}.

Status	Code	Meaning
400	`invalid_input`	A parameter is missing or invalid
401	`unauthorized`	No valid API key or session
403	`permission_denied`	The key does not include this API's permission
429	`quota_exceeded`	Free-tier quota reached (20 units/min, 100 units/day)
503	`database_unavailable`	Persistent storage is temporarily unavailable

Rate limits

20 units per minute and 100 units per day per account; outbound fetches to the same host are spaced at least one second apart. Exceeding a limit returns 429.

Try it in the playground