# APIVoid Documentation — Full Content

> Complete text content of every page on https://docs.apivoid.com/ in a single file, for AI agents and LLMs. All APIs use HTTPS POST to https://api.apivoid.com/v2/{service} with Content-Type: application/json and an X-API-Key header. See https://docs.apivoid.com/llms.txt for the page index.

---

Source: <https://docs.apivoid.com/>

# Getting Started with APIVoid APIs

Threat analysis, domain and IP intelligence, and security APIs for developers. Every endpoint requires HTTPS POST over TLS 1.2+, accepts a JSON body, returns structured JSON responses, and authenticates requests using the `X-API-Key` header.

> Follow the [changelog](https://changelog.apivoid.com/) for officially released updates. We also announce API updates in our newsletter to registered users. See [Versioning](https://docs.apivoid.com/versioning/) for which changes are backward-compatible, and which only arrive with a new major version under a new versioned URL. Following both is the easiest way to pick up new endpoints and fields as they ship.

## Quick start

1. Get an API key. [Create an account](https://dash.apivoid.com/register/) and copy your API key from the dashboard.
2. Start a free trial or subscribe. Activate your 30-day trial or choose a paid subscription.
3. Make your first request. Send an HTTPS POST request with your key in the `X-API-Key` header:

```bash
curl -X POST "https://api.apivoid.com/v2/ip-reputation" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"ip": "80.82.77.139"}'
```

The `Content-Type: application/json` header is required for every API request.

A successful request returns HTTP `200` with a JSON body.

## The basics

These concepts apply to every API, so they are documented once:

- [Authentication](https://docs.apivoid.com/authentication/): How to send your API key, where to find it, and how to keep it safe across your applications and environments.
- [How credits work](https://docs.apivoid.com/how-credits-work/): Fixed credit costs per API, no credits consumed on errors, overage, and when your balance resets.
- [X-Service-Quota header](https://docs.apivoid.com/service-quota/): Read your credit usage, remaining balance, next credits reset and overage status from every response.
- [API errors & retries](https://docs.apivoid.com/errors/): The error format, 4xx vs 5xx, and which status codes are safe to retry when handling failed API requests.
- [Request timeouts](https://docs.apivoid.com/request-timeout/): Average and maximum response times for every API, and the client timeout we suggest for each.
- [Rate limits](https://docs.apivoid.com/rate-limit/): Concurrency and RPS limits, the X-Concurrency-Limit and Retry-After headers, and limits per plan.

## Base URL & conventions

```text
https://api.apivoid.com/v2/{service}
```

- All endpoints use HTTPS POST with `Content-Type: application/json`.
- TLS `1.2+` is required; older TLS/SSL versions are not supported for security reasons.
- All request and response bodies, including errors, are encoded in JSON format.
- Successful requests always return status `200`; anything else is an [error](https://docs.apivoid.com/errors/).
- Each API consumes a fixed number of credits per successful call, listed on its reference page.
- Responses with a non-200 status code, such as 4xx or 5xx errors, never consume credits.
- Every API call performs a fresh, live analysis of the submitted target.
- Successful responses include the [X-Service-Quota header](https://docs.apivoid.com/service-quota/) with your live usage stats.

## Production checklist

Before going live, make sure your integration checks these boxes:

- Store API keys securely. Use environment variables or a secrets manager. See [Authentication](https://docs.apivoid.com/authentication/).
- Handle API errors. Check non-200 responses and retry only when safe. See [API errors & retries](https://docs.apivoid.com/errors/).
- Respect rate limits. Back off when you hit concurrency or RPS limits. See [Rate limits](https://docs.apivoid.com/rate-limit/).
- Set proper timeouts. Allow enough time for longer scans. See [Request timeouts](https://docs.apivoid.com/request-timeout/).
- Monitor API usage. Track credits and overage via [X-Service-Quota header](https://docs.apivoid.com/service-quota/) or [Account Info API](https://docs.apivoid.com/account-info-api/).
- Estimate credit usage. Project your monthly [credit volume](https://docs.apivoid.com/how-credits-work/) with the [pricing calculator](https://www.apivoid.com/pricing/#pricing-calculator).

---

Source: <https://docs.apivoid.com/authentication/>

# Authentication

Every APIVoid request is authenticated with an API key sent in the `X-API-Key` HTTP header.

## Where to find your API key

Your API key is available in the [APIVoid dashboard](https://dash.apivoid.com/) after you [create an account](https://dash.apivoid.com/register/), on the "API Keys" page, where you can create and manage your keys. A single key works across all API services available on your plan.

## How to authenticate a request

Add the `Content-Type` and `X-API-Key` headers to your HTTPS POST request:

```bash
curl -X POST "https://api.apivoid.com/v2/ip-reputation" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"ip": "93.174.95.106"}'
```

The same header in PHP with cURL:

```php
$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/ip-reputation');
curl_setopt($curl, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'X-API-Key: ' . $apiKey
]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['ip' => '93.174.95.106']));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
```

If the key is missing or invalid, the API returns a 4xx status with a JSON `error` field.

If the `Content-Type` header is not `application/json`, the API returns a 4xx status with a JSON `error` field.

> ⚠ Repeated requests with an invalid key will result in the requesting IP address being blocked for 1 hour.

See [API Errors & Retries](https://docs.apivoid.com/errors/) for additional details.

## Keep your key secret

- Never expose the key client-side. Keep it out of browser JavaScript and mobile apps.
- Use your backend. Send API requests from your server to keep the key private.
- Store it in environment variables or a secrets manager, not in source code or public repositories.
- Rotate the key from the dashboard if you suspect it has been exposed.
- Monitor usage via the [X-Service-Quota header](https://docs.apivoid.com/service-quota/) or the dashboard to spot anomalies early.

---

Source: <https://docs.apivoid.com/how-credits-work/>

# How Credits Work

Every APIVoid plan includes a monthly amount of credits. Each API consumes a fixed number of credits per successful call, so costs are predictable and easy to estimate.

## Credit cost per API

The credit cost is fixed per API service and listed on each API's reference page. For example, [DNS Lookup API](https://docs.apivoid.com/dns-lookup-api/) costs 1 credit per request, while [Screenshot API](https://docs.apivoid.com/screenshot-api/) costs 20. To estimate your monthly credit needs and find the right plan for your expected usage, you can use the [pricing calculator](https://www.apivoid.com/pricing/#pricing-calculator), just enter the estimated monthly API calls for each API.

## Errors never consume credits

Only successful requests that return HTTP `200` consume credits.

## Overage

Overage is available on Startup plans and above. It lets you continue making API requests after your monthly credit quota is exhausted (so the service is not interrupted), until your next reset.

- Overage is disabled by default and must be enabled from the Subscription page in the [dashboard](https://dash.apivoid.com/).
- The default overage limit is 250,000 credits and can be increased up to 500,000; [contact us](https://www.apivoid.com/contacts/) for higher limits.
- Overage credits are billed separately from the subscription at a rate that [varies by plan](https://www.apivoid.com/pricing/).
- Check the [X-Service-Quota header](https://docs.apivoid.com/service-quota/) fields `overage-value` and `overage-limit`.

## Credit resets

Your credit balance replenishes at the start of each billing cycle. The exact reset time is always available as a Unix timestamp in the `reset` field of the [X-Service-Quota header](https://docs.apivoid.com/service-quota/), returned with every successful response.

## Monitoring your usage

You can track consumption in three ways:

- Programmatically, by reading the [X-Service-Quota header](https://docs.apivoid.com/service-quota/) on every successful response.
- Via the [Account Info API](https://docs.apivoid.com/account-info-api/), which returns your plan details, credits balance and usage, and consumes no credits.
- From the dashboard, where you can view your usage, remaining balance and overage status at any time.

---

Source: <https://docs.apivoid.com/service-quota/>

# X-Service-Quota Header

Every successful API response includes an `X-Service-Quota` header with your live credit usage, so you can monitor consumption programmatically without extra API calls. If you prefer to get this information via an API, you can use [Account Info API](https://docs.apivoid.com/account-info-api/), which doesn't consume credits.

## Header format

```text
X-Service-Quota: call-usage=5; available=49942; reset=1738279565; overage-allowed=true; overage-enabled=true; overage-value=0; overage-limit=250000;
```

## Fields

| Field | Type | Description |
| --- | --- | --- |
| `call-usage` | Integer | Credits consumed by this request |
| `available` | Integer | Credits currently available on your plan |
| `reset` | Timestamp | Unix timestamp of when your credits next reset |
| `overage-allowed` | Boolean | True if overage is allowed on your subscription plan |
| `overage-enabled` | Boolean | True if you have enabled the overage option |
| `overage-value` | Integer | Overage credits consumed so far in this billing cycle |
| `overage-limit` | Integer | Maximum overage credits you can consume in a billing cycle |

## Parsing example

The header is a simple semicolon-separated list of `key=value` pairs:

```python
quota_header = "call-usage=5; available=49942; reset=1738279565; overage-allowed=true;"

quota = {}
for pair in quota_header.split(";"):
    pair = pair.strip()
    if not pair:
        continue
    key, value = pair.split("=", 1)
    quota[key] = value

print(quota["available"])  # 49942
```

```php
$quotaHeader = 'call-usage=5; available=49942; reset=1738279565; overage-allowed=true;';

$quota = [];
foreach (explode(';', $quotaHeader) as $pair) {
    $pair = trim($pair);
    if ($pair === '') continue;
    [$key, $value] = explode('=', $pair, 2);
    $quota[$key] = $value;
}

echo $quota['available']; // 49942
```

```javascript
const quotaHeader = "call-usage=5; available=49942; reset=1738279565; overage-allowed=true;";

const quota = {};
for (const pair of quotaHeader.split(";")) {
  const trimmed = pair.trim();
  if (!trimmed) continue;
  const i = trimmed.indexOf("=");
  quota[trimmed.slice(0, i)] = trimmed.slice(i + 1);
}

console.log(quota.available); // 49942
```

```go
package main

import (
	"fmt"
	"strings"
)

func main() {
	quotaHeader := "call-usage=5; available=49942; reset=1738279565; overage-allowed=true;"

	quota := map[string]string{}
	for _, pair := range strings.Split(quotaHeader, ";") {
		pair = strings.TrimSpace(pair)
		if pair == "" {
			continue
		}
		key, value, _ := strings.Cut(pair, "=")
		quota[key] = value
	}

	fmt.Println(quota["available"]) // 49942
}
```

```java
import java.util.HashMap;
import java.util.Map;

public class Main {
    public static void main(String[] args) {
        String quotaHeader = "call-usage=5; available=49942; reset=1738279565; overage-allowed=true;";

        Map<String, String> quota = new HashMap<>();
        for (String pair : quotaHeader.split(";")) {
            pair = pair.trim();
            if (pair.isEmpty()) continue;
            String[] kv = pair.split("=", 2);
            quota.put(kv[0], kv[1]);
        }

        System.out.println(quota.get("available")); // 49942
    }
}
```

---

Source: <https://docs.apivoid.com/errors/>

# API Errors & Retries

Successful requests always return HTTP `200`. Any other status code is an error, and the JSON body tells you what went wrong. Your credits are never decreased in the event of an error.

## Error format

Error responses contain a single `error` field with a human-readable message:

```json
{
   "error": "API key is not valid"
}
```

## 4xx — client errors

4xx status codes indicate a problem with the request: an invalid API key, a missing required parameter, an unknown parameter, a malformed value, or rate limiting. Check the `error` message, fix the request, and try again.

> Only retry `429` (rate limited) automatically. All other 4xx errors will keep failing until the request itself is fixed; retrying them wastes requests, can get you rate limited, and won't fix the problem. See [Rate Limits](https://docs.apivoid.com/rate-limit/) for why `429` happens, the `Retry-After` header, and how to size your concurrency to avoid it.

## 5xx — server errors

5xx status codes indicate a problem on the APIVoid side. Only `500`, `502`, `503` and `504` should be retried; treat other 5xx codes as final for that request and check the [service status page](https://status.apivoid.com/) if they persist.

## Retry with incremental backoff

When retrying (a `429`, or a `500`/`502`/`503`/`504`), wait progressively longer between attempts and cap the number of attempts. The examples below wait 1, 5, 15, 30 and then 60 seconds: the two longer waits let your code ride out a brief maintenance window (up to about a minute of downtime) and still come back with a successful response instead of giving up. Each example uses no third-party dependencies, and also retries transient connection errors and timeouts. On a `429` the response carries a [`Retry-After`](https://docs.apivoid.com/rate-limit/) header, which is a floor rather than an estimate, so the examples wait for whichever is longer, the header or the current backoff step; that way a retry never arrives before the limit has actually cleared:

```python
import json
import socket
import time
import urllib.request
import urllib.error

MAX_ATTEMPTS = 6  # Initial attempt + one retry per delay
DELAYS = [1, 5, 15, 30, 60]  # Seconds before each retry
RETRYABLE = {429, 500, 502, 503, 504}
TIMEOUT = 180  # Seconds; covers even the slowest APIs (up to 150s)

def call_apivoid(payload: dict) -> dict:
    request = urllib.request.Request(
        "https://api.apivoid.com/v2/ip-reputation",
        data=json.dumps(payload).encode("utf-8"),
        headers={
            "Content-Type": "application/json",
            "X-API-Key": "YOUR_API_KEY_HERE",
        },
        method="POST",
    )
    for attempt in range(MAX_ATTEMPTS):
        retry_after = 0
        try:
            with urllib.request.urlopen(request, timeout=TIMEOUT) as response:
                return json.loads(response.read().decode("utf-8"))  # Success (200)
        except urllib.error.HTTPError as error:
            # The API responded with a non-200 status code
            if error.code not in RETRYABLE:
                raise  # Not retryable: fix the request instead
            retry_after = int(error.headers.get("Retry-After", 0) or 0)  # Sent on 429
        except (urllib.error.URLError, socket.timeout):  # socket.timeout is TimeoutError on Python 3.10+
            # Connection error (DNS failure, refused, reset) or timeout: retry
            pass
        if attempt < MAX_ATTEMPTS - 1:
            time.sleep(max(retry_after, DELAYS[attempt]))  # Never retry before Retry-After
    raise RuntimeError("Request failed after all retry attempts")

result = call_apivoid({"ip": "80.82.77.139"})
print(result)
```

```php
$maxAttempts = 6; // Initial attempt + one retry per delay
$delays = [1, 5, 15, 30, 60]; // Seconds before each retry
$retryable = [429, 500, 502, 503, 504];

function callApiVoid(array $payload): array
{
    $curl = curl_init('https://api.apivoid.com/v2/ip-reputation');
    curl_setopt($curl, CURLOPT_HTTPHEADER, [
        'Content-Type: application/json',
        'X-API-Key: YOUR_API_KEY_HERE',
    ]);
    curl_setopt($curl, CURLOPT_POST, true);
    curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode($payload));
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($curl, CURLOPT_TIMEOUT, 180); // Seconds; covers even the slowest APIs (up to 150s)
    $retryAfter = 0;
    curl_setopt($curl, CURLOPT_HEADERFUNCTION, function ($curl, $header) use (&$retryAfter) {
        if (stripos($header, 'Retry-After:') === 0) { // Sent on 429
            $retryAfter = (int) trim(substr($header, 12));
        }
        return strlen($header);
    });
    $body = curl_exec($curl);
    // http_code is 0 on connection error (DNS failure, refused, reset) or timeout
    $httpCode = ($body === false) ? 0 : curl_getinfo($curl, CURLINFO_HTTP_CODE);
    curl_close($curl);
    return ['http_code' => $httpCode, 'body' => ($body === false) ? null : json_decode($body, true), 'retry_after' => $retryAfter];
}

$result = null;
for ($attempt = 0; $attempt < $maxAttempts; $attempt++) {
    $response = callApiVoid(['ip' => '80.82.77.139']);
    if ($response['http_code'] === 200) {
        $result = $response['body'];
        break; // Success (200)
    }
    if ($response['http_code'] !== 0 && !in_array($response['http_code'], $retryable, true)) {
        // Not retryable: fix the request instead
        throw new RuntimeException('API error ' . $response['http_code'] . ': ' . ($response['body']['error'] ?? 'unknown'));
    }
    // Connection error, timeout or retryable status code: retry
    if ($attempt < $maxAttempts - 1) {
        sleep(max($response['retry_after'], $delays[$attempt])); // Never retry before Retry-After
    }
}
if ($result === null) {
    throw new RuntimeException('Request failed after all retry attempts');
}
print_r($result);
```

```javascript
// Requires Node.js 18+ (uses the built-in fetch)
const MAX_ATTEMPTS = 6; // Initial attempt + one retry per delay
const DELAYS = [1000, 5000, 15000, 30000, 60000]; // Milliseconds before each retry
const RETRYABLE = new Set([429, 500, 502, 503, 504]);
const TIMEOUT = 180000; // Milliseconds; covers even the slowest APIs (up to 150s)

const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

async function callApiVoid(payload) {
    for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
        let retryAfter = 0;
        try {
            const response = await fetch("https://api.apivoid.com/v2/ip-reputation", {
                method: "POST",
                headers: {
                    "Content-Type": "application/json",
                    "X-API-Key": "YOUR_API_KEY_HERE",
                },
                body: JSON.stringify(payload),
                signal: AbortSignal.timeout(TIMEOUT),
            });
            if (response.ok) {
                return await response.json(); // Success (200)
            }
            if (!RETRYABLE.has(response.status)) {
                const { error } = await response.json();
                throw new Error(`API error ${response.status}: ${error}`); // Not retryable: fix the request instead
            }
            retryAfter = (parseInt(response.headers.get("retry-after") ?? "0", 10) || 0) * 1000; // Sent on 429
        } catch (error) {
            if (error instanceof Error && error.message.startsWith("API error")) {
                throw error; // Non-retryable API error from above
            }
            // Connection error (DNS failure, refused, reset) or timeout: retry
        }
        if (attempt < MAX_ATTEMPTS - 1) {
            await sleep(Math.max(retryAfter, DELAYS[attempt])); // Never retry before Retry-After
        }
    }
    throw new Error("Request failed after all retry attempts");
}

callApiVoid({ ip: "80.82.77.139" }).then(console.log).catch(console.error);
```

```go
package main

import (
	"bytes"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"net/http"
	"strconv"
	"time"
)

const maxAttempts = 6 // Initial attempt + one retry per delay

var delays = []time.Duration{ // Wait before each retry
	1 * time.Second, 5 * time.Second, 15 * time.Second, 30 * time.Second, 60 * time.Second,
}
var retryable = map[int]bool{429: true, 500: true, 502: true, 503: true, 504: true}

// Timeout covers even the slowest APIs (up to 150s)
var client = &http.Client{Timeout: 180 * time.Second}

func callApiVoid(payload map[string]any) (map[string]any, error) {
	body, err := json.Marshal(payload)
	if err != nil {
		return nil, err
	}
	for attempt := 0; attempt < maxAttempts; attempt++ {
		retryAfter := time.Duration(0)
		req, err := http.NewRequest("POST", "https://api.apivoid.com/v2/ip-reputation", bytes.NewReader(body))
		if err != nil {
			return nil, err
		}
		req.Header.Set("Content-Type", "application/json")
		req.Header.Set("X-API-Key", "YOUR_API_KEY_HERE")

		resp, err := client.Do(req)
		if err == nil { // The API responded; check the status code
			respBody, readErr := io.ReadAll(resp.Body)
			resp.Body.Close()
			if resp.StatusCode == http.StatusOK && readErr == nil {
				var result map[string]any
				if err := json.Unmarshal(respBody, &result); err == nil {
					return result, nil // Success (200)
				}
			} else if !retryable[resp.StatusCode] {
				// Not retryable: fix the request instead
				return nil, fmt.Errorf("API error %d: %s", resp.StatusCode, respBody)
			}
			if n, convErr := strconv.Atoi(resp.Header.Get("Retry-After")); convErr == nil { // Sent on 429
				retryAfter = time.Duration(n) * time.Second
			}
		}
		// Connection error, timeout or retryable status code: retry
		if attempt < maxAttempts-1 {
			wait := delays[attempt]
			if retryAfter > wait { // Never retry before Retry-After
				wait = retryAfter
			}
			time.Sleep(wait)
		}
	}
	return nil, errors.New("request failed after all retry attempts")
}

func main() {
	result, err := callApiVoid(map[string]any{"ip": "80.82.77.139"})
	if err != nil {
		panic(err)
	}
	fmt.Println(result)
}
```

```java
// Requires Java 11+ (uses the built-in java.net.http.HttpClient)
import java.io.IOException;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.time.Duration;
import java.util.Set;

public class Main {
    static final int MAX_ATTEMPTS = 6; // Initial attempt + one retry per delay
    static final int[] DELAYS = {1, 5, 15, 30, 60}; // Seconds before each retry
    static final Set<Integer> RETRYABLE = Set.of(429, 500, 502, 503, 504);
    static final Duration TIMEOUT = Duration.ofSeconds(180); // Covers even the slowest APIs (up to 150s)
    static final HttpClient CLIENT = HttpClient.newHttpClient();

    static String callApiVoid(String payload) throws InterruptedException {
        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://api.apivoid.com/v2/ip-reputation"))
                .header("Content-Type", "application/json")
                .header("X-API-Key", "YOUR_API_KEY_HERE")
                .timeout(TIMEOUT)
                .POST(HttpRequest.BodyPublishers.ofString(payload))
                .build();
        for (int attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
            long retryAfter = 0;
            try {
                HttpResponse<String> response = CLIENT.send(request, HttpResponse.BodyHandlers.ofString());
                if (response.statusCode() == 200) {
                    return response.body(); // Success (200)
                }
                if (!RETRYABLE.contains(response.statusCode())) {
                    // Not retryable: fix the request instead
                    throw new RuntimeException("API error " + response.statusCode() + ": " + response.body());
                }
                retryAfter = response.headers().firstValueAsLong("Retry-After").orElse(0); // Sent on 429
            } catch (IOException error) {
                // Connection error (DNS failure, refused, reset) or timeout: retry
            }
            if (attempt < MAX_ATTEMPTS - 1) {
                Thread.sleep(Math.max(retryAfter, DELAYS[attempt]) * 1000L); // Never retry before Retry-After
            }
        }
        throw new RuntimeException("Request failed after all retry attempts");
    }

    public static void main(String[] args) throws InterruptedException {
        String result = callApiVoid("{\"ip\": \"80.82.77.139\"}");
        System.out.println(result);
    }
}
```

These examples are reactive: they send a request, and back off when the API pushes back. That is the right shape for occasional or user-facing calls, where one request has to succeed and there is nothing to pace. For batch work the better approach is proactive: avoid the `429` in the first place by reading `X-RateLimit-Remaining` and `X-RateLimit-Reset-After` and pacing against them, and by sizing your worker pool from `X-Concurrency-Limit`.

See [Rate Limits](https://docs.apivoid.com/rate-limit/) for worked examples of that pattern.

## Choosing a request timeout

The examples above set the request timeout to 180 seconds, which safely covers every APIVoid API, including the slowest ones (up to 150 seconds, e.g. the Screenshot API). A timeout is an upper bound, not a wait: fast responses still come back immediately. See the [Request Timeouts](https://docs.apivoid.com/request-timeout/) page for average and maximum response times per API, suggested timeouts for each, and what the timeout applies to in each language. Never use a short timeout (e.g. 30 seconds) with the slower APIs: you would abort requests the API was about to answer, and each aborted request is retried from zero.

## Quick reference

| Status | Meaning | Retry? |
| --- | --- | --- |
| `200` | Success | No |
| `4xx` | Client error (fix the request, see `error` message) | No, except `429` |
| `429` | Rate limited | Yes, with backoff |
| `500` / `502` / `503` / `504` | Server error (see `error` message) | Yes, with backoff |
| Other `5xx` | Server error | No |

---

Source: <https://docs.apivoid.com/request-timeout/>

# Request Timeouts

Every HTTP client lets you set a request timeout: how long to wait for a response before giving up. This page lists the typical and maximum response time of each API, suggests a client timeout for each, and explains why response times vary.

## How to choose a timeout

A timeout is an upper bound, not a wait: fast responses still come back immediately, the timeout only decides how long your code waits before aborting a request that is still in flight. That makes a generous timeout cheap and a short one expensive: if the timeout is below the API's maximum response time, you abort requests the API was about to answer, and each aborted request has to be retried from zero. When in doubt, use 180 seconds: that covers every API, including the slowest ones such as Screenshot API, HTTP Tracker API and URL to PDF API.

> What the timeout applies to differs by HTTP client. Node.js `AbortSignal.timeout()`, Go's `http.Client.Timeout` and PHP cURL's `CURLOPT_TIMEOUT` cap the whole request, from connection to full response. Python `urllib`'s `timeout` applies to the connection attempt and to each blocking socket read instead, so it aborts a server that stops sending data for that long rather than a response that legitimately takes longer to complete.

## Response times per API

Average response times are measured under normal conditions; the "can take up to" column is the worst case you should plan for, and the suggested timeout sits comfortably above it. APIs without a listed maximum stay close to their average range, and the suggested 30-second timeout leaves ample margin.

| API | Avg response time | Can take up to | Suggested timeout |
| --- | --- | --- | --- |
| [Account Info API](https://docs.apivoid.com/account-info-api/) | 150 ms – 250 ms | – | 30 seconds |
| [ASN Info API](https://docs.apivoid.com/asn-info-api/) | 150 ms – 500 ms | – | 30 seconds |
| [BIMI Validator API](https://docs.apivoid.com/bimi-validator-api/) | 150 ms – 3 s | 30 seconds | 60 seconds |
| [DKIM Validator API](https://docs.apivoid.com/dkim-validator-api/) | 150 ms – 500 ms | – | 30 seconds |
| [DMARC Validator API](https://docs.apivoid.com/dmarc-validator-api/) | 150 ms – 500 ms | – | 30 seconds |
| [DNS Lookup API](https://docs.apivoid.com/dns-lookup-api/) | 150 ms – 500 ms | 15 seconds | 30 seconds |
| [DNS Propagation API](https://docs.apivoid.com/dns-propagation-api/) | 500 ms – 1 s | 15 seconds | 30 seconds |
| [DNSSEC Status API](https://docs.apivoid.com/dnssec-status-api/) | 150 ms – 500 ms | – | 30 seconds |
| [Domain Age API](https://docs.apivoid.com/domain-age-api/) | 150 ms – 3 s | 30 seconds | 60 seconds |
| [Domain Info API](https://docs.apivoid.com/domain-info-api/) | 150 ms – 3 s | 30 seconds | 60 seconds |
| [Domain Reputation API](https://docs.apivoid.com/domain-reputation-api/) | 150 ms – 3 s | – | 30 seconds |
| [Email Verify API](https://docs.apivoid.com/email-verify-api/) | 150 ms – 3 s | – | 30 seconds |
| [EML Insights API](https://docs.apivoid.com/eml-insights-api/) | 500 ms – 5 s | 30 seconds | 60 seconds |
| [Geo Request API](https://docs.apivoid.com/geo-request-api/) | 500 ms – 5 s | 30 seconds | 60 seconds |
| [HTML to PDF API](https://docs.apivoid.com/html-to-pdf-api/) | 5 s – 10 s | 150 seconds | 180 seconds |
| [HTML to PNG API](https://docs.apivoid.com/html-to-png-api/) | 5 s – 10 s | 150 seconds | 180 seconds |
| [HTTP Tracker API](https://docs.apivoid.com/http-tracker-api/) | 5 s – 10 s | 150 seconds | 180 seconds |
| [HTTP3 Status API](https://docs.apivoid.com/http3-status-api/) | 1 s – 3 s | 30 seconds | 60 seconds |
| [IP Reputation API](https://docs.apivoid.com/ip-reputation-api/) | 150 ms – 3 s | – | 30 seconds |
| [Parked Domain API](https://docs.apivoid.com/parked-domain-api/) | 500 ms – 3 s | 30 seconds | 60 seconds |
| [Phone Validator API](https://docs.apivoid.com/phone-validator-api/) | 150 ms – 500 ms | – | 30 seconds |
| [Ping Test API](https://docs.apivoid.com/ping-test-api/) | 3 s – 5 s | – | 30 seconds |
| [Port Scan API](https://docs.apivoid.com/port-scan-api/) | 500 ms – 3 s | – | 30 seconds |
| [QR Scan API](https://docs.apivoid.com/qr-scan-api/) | 250 ms – 3 s | – | 30 seconds |
| [Reverse IP API](https://docs.apivoid.com/reverse-ip-api/) | 500 ms – 3 s | – | 30 seconds |
| [Screenshot API](https://docs.apivoid.com/screenshot-api/) | 5 s – 10 s | 150 seconds | 180 seconds |
| [Security Headers API](https://docs.apivoid.com/security-headers-api/) | 500 ms – 5 s | 30 seconds | 60 seconds |
| [Site Trustworthiness API](https://docs.apivoid.com/site-trustworthiness-api/) | 3 s – 5 s | 75 seconds | 90 seconds |
| [SPF Validator API](https://docs.apivoid.com/spf-validator-api/) | 150 ms – 500 ms | – | 30 seconds |
| [SSL Info API](https://docs.apivoid.com/ssl-info-api/) | 250 ms – 3 s | 30 seconds | 60 seconds |
| [TLS Check API](https://docs.apivoid.com/tls-check-api/) | 250 ms – 3 s | 60 seconds | 90 seconds |
| [Tor Test API](https://docs.apivoid.com/tor-test-api/) | 3 s – 5 s | 30 seconds | 60 seconds |
| [URL Reputation API](https://docs.apivoid.com/url-reputation-api/) | 3 s – 5 s | 60 seconds | 90 seconds |
| [URL Status API](https://docs.apivoid.com/url-status-api/) | 3 s – 5 s | 60 seconds | 90 seconds |
| [URL to PDF API](https://docs.apivoid.com/url-to-pdf-api/) | 5 s – 10 s | 150 seconds | 180 seconds |
| [VPN Test API](https://docs.apivoid.com/vpn-test-api/) | 3 s – 5 s | 30 seconds | 60 seconds |

## Why response times vary

Two main factors drive most of the variation:

- The target. APIs that connect to a remote host, such as the [Screenshot](https://docs.apivoid.com/screenshot-api/), [URL to PDF](https://docs.apivoid.com/url-to-pdf-api/), [URL Status](https://docs.apivoid.com/url-status-api/), [Site Trustworthiness](https://docs.apivoid.com/site-trustworthiness-api/) and [TLS Check](https://docs.apivoid.com/tls-check-api/) APIs, can only be as fast as the target lets them: a website that is slow to resolve, connect, or render slows the API response by the same amount, regardless of our own server performance.
- The request parameters. Some options may increase the work per request. For example, the [TLS Check API](https://docs.apivoid.com/tls-check-api/) with `scan_ciphers` set to `true` takes longer than a plain check, and the [Screenshot API](https://docs.apivoid.com/screenshot-api/) with `full_page` set to `true` takes longer than a viewport-only screenshot. These options require additional processing work.

This is why the table lists ranges rather than single numbers: pick your timeout from the "can take up to" column, not from the average. This leaves enough headroom for slower targets and more demanding request options, reducing avoidable client-side timeouts during requests that are still processing normally.

## Timeouts and retries

Timeouts and retries work together: the timeout decides when to give up on a single attempt, the retry policy decides what happens next. A timed-out request should be retried with incremental backoff exactly like a `5xx` response, see [API Errors & Retries](https://docs.apivoid.com/errors/) for ready-to-use retry examples in Python, PHP, Node.js, Go and Java.

---

Source: <https://docs.apivoid.com/rate-limit/>

# Rate Limits

Every API has two throughput limits, applied per account and per API service rather than per API key: a concurrency limit (how many of your requests can be active at the same time) and a requests-per-second limit (how many you may start per window). Exceeding either returns HTTP `429`. These limits are about throughput, not usage.

> The two limits are separate budgets. On most APIs the requests-per-second limit is set to the same value as the concurrency limit, but that is not a guarantee: they may differ per API, and we may change one without the other. Read each one from its own response header rather than deriving one from the other.

## Rate limit headers

Every response shows both API limits and your remaining allowance:

```text
X-Concurrency-Limit: 10
X-Concurrency-Remaining: 9
X-RateLimit-Limit: 10
X-RateLimit-Remaining: 9
X-RateLimit-Window: 1
X-RateLimit-Reset-After: 1
```

The `X-Concurrency-*` pair limits in-flight requests; the `X-RateLimit-*` family describes how many you may start per window. Size your worker pool from the first and pacing from the second.

| Header | Meaning |
| --- | --- |
| `X-Concurrency-Limit` | Maximum number of concurrent requests (active connections) your plan allows on this API. |
| `X-Concurrency-Remaining` | How many additional concurrent requests you can open on this API right now. |
| `X-RateLimit-Limit` | Maximum number of requests you may start per window on this API. |
| `X-RateLimit-Remaining` | How many requests are left in your current window. |
| `X-RateLimit-Window` | Window length in seconds (effective rate = Limit ÷ Window). |
| `X-RateLimit-Reset-After` | Seconds until a request slot frees up. |
| `X-RateLimit-Scope` | Only on `429` responses: which limit you hit, either `requests` or `concurrency`. |
| `Retry-After` | Only on `429` responses: seconds to wait before retrying. |

> Regarding `X-RateLimit-Reset-After`: the rate limit uses a sliding window, so there is no fixed moment when the counter drops to zero. The value counts down to when the oldest request in your window ages out and one slot becomes available, so on an API with a one-second window it stays at `1` at full rate rather than counting toward a boundary. A simple rule that works on every API: when `X-RateLimit-Remaining` is `0`, wait `X-RateLimit-Reset-After` seconds before your next request, and you will not hit the rate limit. On APIs with a longer window this matters most: `Reset-After` is usually shorter than the full `X-RateLimit-Window`, so sleeping for the whole window would waste time.

> Regarding `Retry-After`: it is always a floor, the minimum you should wait, not a promise that the retry will then succeed. How tight the `Retry-After` floor is depends on which limit you hit. For the requests-per-second limit it is tight: waiting the stated number of seconds frees one slot, so a single retry normally goes through. For the concurrency limit it is loose (always `1`): a slot frees only when an in-flight request completes, which on slower APIs can take considerably longer, up to that API's [request timeout](https://docs.apivoid.com/request-timeout/). Branch on `X-RateLimit-Scope` to tell the two apart.

## When you are rate limited

If you exceed the concurrency (active connections) limit or start more requests per window than `X-RateLimit-Limit`, the API responds with status `429`, an [error body](https://docs.apivoid.com/errors/), an `X-RateLimit-Scope` header naming the limit you hit (can be `concurrency` or `requests`), and a `Retry-After` header, to indicate temporary rate limiting:

```text
HTTP/2 429
...
X-RateLimit-Scope: concurrency
Retry-After: 1
```

`429` is a safe status code to retry automatically, and no credits are consumed. This means the request was rejected before normal processing, so retry behavior can be handled predictably without risking duplicate billable work.

Here are the two cases:

- `X-RateLimit-Scope: requests` – requests-per-second limit. `Retry-After` is a tight floor: wait that many seconds and one slot frees, so the retry should go through. The [retry examples](https://docs.apivoid.com/errors/) wait for the larger of `Retry-After` and their backoff step, so they satisfy the header on any window length and avoid an immediate retry that would fail.
- `X-RateLimit-Scope: concurrency` – concurrency limit. `Retry-After` is a loose floor (always `1`): a slot only frees when an in-flight request completes, and on slower APIs that can take well over a second. Don't retry in a tight loop based on the header; use the [incremental backoff](https://docs.apivoid.com/errors/) retries, whose growing delays give in-flight requests time to finish. Or better, avoid most of these `429` errors by never opening more connections than `X-Concurrency-Limit`, as shown below. Capping your own pool is enough when you are the only caller; if several processes share the account, they draw on the same budget, so make sure to leave a little headroom in each.

> Add your own jitter. `Retry-After` is a floor, not an exact estimate, and every client rejected in the same instant receives the same `Retry-After` value. If several of your workers are throttled together, spread their retries by adding a small random delay on top of the header value, otherwise they will all come back simultaneously and collide again.

## Limits per plan

Each subscription plan allows a different number of concurrent connections, and the exact value also varies per API service; heavier APIs have lower limits than lighter ones by design. Typical ranges:

| Plan | Concurrent requests per API |
| --- | --- |
| Basic | 5 – 10 |
| Startup | 20 – 25 |
| Growth | 30 – 40 |
| Business | 45 – 50 |
| Enterprise | 50 – 75 |

> Read the limits from the headers, not from this table. The exact value depends on which API service you are calling, and limits are adjusted as our capacity grows. Rather than hardcoding a number, read `X-Concurrency-Limit` and `X-RateLimit-Limit` from any response, as shown below, and your client always uses the current limit.

## Size your client from the headers

When processing a large batch, e.g. scanning 1,000 IP addresses, don't guess how many parallel requests to open or how fast to send them. Make a single request first and read both limits from the response: size your worker pool from `X-Concurrency-Limit`, and pace your requests at `X-RateLimit-Limit ÷ X-RateLimit-Window` per second. You get your plan's full throughput, and automatically adapt to any limit change without modifying your code:

```python
import json
import time
import urllib.request
from concurrent.futures import ThreadPoolExecutor
from threading import Lock

ENDPOINT = "https://api.apivoid.com/v2/ip-reputation"
API_KEY = "YOUR_API_KEY_HERE"

class RateLimiter:
    def __init__(self, rate_per_sec):
        self.interval = 1.0 / rate_per_sec
        self.next_slot = time.monotonic()
        self.lock = Lock()

    def acquire(self):
        with self.lock:
            now = time.monotonic()
            wait = max(0.0, self.next_slot - now)
            self.next_slot = max(now, self.next_slot) + self.interval
        if wait:
            time.sleep(wait)

def call_apivoid(ip: str):
    request = urllib.request.Request(
        ENDPOINT,
        data=json.dumps({"ip": ip}).encode("utf-8"),
        headers={"Content-Type": "application/json", "X-API-Key": API_KEY},
        method="POST",
    )
    with urllib.request.urlopen(request, timeout=180) as response:
        return json.loads(response.read().decode("utf-8")), response.headers

ips = ["80.82.77.139", "1.1.1.1", "8.8.8.8"]  # ... e.g. 1,000 IPs to scan

# 1. Single request first: discover the current limits
data, headers = call_apivoid(ips[0])
results = {ips[0]: data}

# 2. Pool size comes from the concurrency limit
max_workers = int(headers.get("X-Concurrency-Limit", 1))  # Default to 1 if not present

# 3. Pacing comes from the requests-per-second limit: Limit / Window
rps_limit = int(headers.get("X-RateLimit-Limit", max_workers))
rps_window = max(1, int(headers.get("X-RateLimit-Window", 1)))
limiter = RateLimiter(rps_limit / rps_window)

def call_apivoid_limited(ip: str):
    """Returns the API response, or None if the request failed."""
    limiter.acquire()
    try:
        return call_apivoid(ip)[0]
    except Exception as error:  # HTTP error (e.g. 429), connection error or timeout
        print(f"{ip} failed: {error}")
        return None

# 4. Process the rest with a worker pool sized to the concurrency limit.
#    A failed IP is reported and skipped, so one error never stops the batch.
with ThreadPoolExecutor(max_workers=max_workers) as pool:
    for ip, result in zip(ips[1:], pool.map(call_apivoid_limited, ips[1:])):
        if result is not None:
            results[ip] = result

failed = len(ips) - len(results)
print(f"Scanned {len(results)} IPs with {max_workers} workers, {failed} failed")
```

```php
$endpoint = 'https://api.apivoid.com/v2/ip-reputation';
$apiKey = 'YOUR_API_KEY_HERE';

function newHandle(string $endpoint, string $apiKey, string $ip)
{
    $curl = curl_init($endpoint);
    curl_setopt_array($curl, [
        CURLOPT_HTTPHEADER => ['Content-Type: application/json', 'X-API-Key: ' . $apiKey],
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => json_encode(['ip' => $ip]),
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HEADER => true, // Keep the response headers, the limits are read from them
        CURLOPT_TIMEOUT => 180, // Client-side timeout, so a stalled request frees its slot
        CURLOPT_PRIVATE => $ip, // Remember which IP this handle belongs to
    ]);
    return $curl;
}

// Split a raw response into [HTTP status code, headers (lowercase names), body]
function parseResponse($curl, string $raw): array
{
    $httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
    $headerSize = curl_getinfo($curl, CURLINFO_HEADER_SIZE);
    $headers = [];
    foreach (explode("\r\n", substr($raw, 0, $headerSize)) as $line) {
        if (strpos($line, ':') !== false) {
            [$name, $value] = explode(':', $line, 2);
            $headers[strtolower(trim($name))] = trim($value);
        }
    }
    return [$httpCode, $headers, substr($raw, $headerSize)];
}

$ips = ['80.82.77.139', '1.1.1.1', '8.8.8.8']; // ... e.g. 1,000 IPs to scan
$results = [];

// 1. Single request first: discover the current limits
$curl = newHandle($endpoint, $apiKey, $ips[0]);
$raw = curl_exec($curl);
[$httpCode, $headers, $body] = parseResponse($curl, (string) $raw);
curl_close($curl);
if ($httpCode !== 200) {
    throw new RuntimeException('First request failed with HTTP ' . $httpCode);
}
$results[$ips[0]] = json_decode($body, true);

// 2. Pool size comes from the concurrency limit
$maxWorkers = max(1, (int) ($headers['x-concurrency-limit'] ?? 1)); // Default to 1 if not present

// 3. Pacing comes from the requests-per-second limit: Limit / Window
$rpsLimit = max(1, (int) ($headers['x-ratelimit-limit'] ?? $maxWorkers));
$rpsWindow = max(1, (int) ($headers['x-ratelimit-window'] ?? 1));
$interval = $rpsWindow / $rpsLimit; // Seconds between two request starts
$nextSlot = microtime(true);

// 4. Process the rest with a curl_multi pool sized to the concurrency limit.
//    A failed IP is reported and skipped, so one error never stops the batch.
$queue = array_slice($ips, 1);
$multi = curl_multi_init();
$inFlight = 0;
$failed = 0;

while ($queue || $inFlight > 0) {
    // Start a request when a slot is free and the next paced start time has arrived
    if ($queue && $inFlight < $maxWorkers && microtime(true) >= $nextSlot) {
        $nextSlot = max(microtime(true), $nextSlot) + $interval;
        curl_multi_add_handle($multi, newHandle($endpoint, $apiKey, array_shift($queue)));
        $inFlight++;
        continue; // Try to fill the next free slot right away
    }
    // Drive the transfers and collect the finished ones
    curl_multi_exec($multi, $running);
    while ($info = curl_multi_info_read($multi)) {
        $curl = $info['handle'];
        $ip = curl_getinfo($curl, CURLINFO_PRIVATE);
        [$httpCode, $hdrs, $body] = parseResponse($curl, (string) curl_multi_getcontent($curl));
        if ($info['result'] === CURLE_OK && $httpCode === 200) {
            $results[$ip] = json_decode($body, true);
        } else { // HTTP error (e.g. 429), connection error or timeout
            $failed++;
            echo $ip . ' failed: ' . ($httpCode ? 'HTTP ' . $httpCode : curl_strerror($info['result'])) . PHP_EOL;
        }
        curl_multi_remove_handle($multi, $curl);
        curl_close($curl);
        $inFlight--;
    }
    if ($inFlight > 0) {
        curl_multi_select($multi, 0.05); // Wait for network activity, up to 50 ms
    } else {
        usleep(10000); // Nothing in flight: wait for the next paced start
    }
}
curl_multi_close($multi);

printf("Scanned %d IPs with %d workers, %d failed\n", count($results), $maxWorkers, $failed);
```

```javascript
// Requires Node.js 18+ (built-in fetch) and must run as an ES module
// (a .mjs file or "type": "module" in package.json) because it uses top-level await
const ENDPOINT = "https://api.apivoid.com/v2/ip-reputation";
const API_KEY = "YOUR_API_KEY_HERE";

function createRateLimiter(ratePerSec) {
  const interval = 1000 / ratePerSec;
  let nextSlot = Date.now();
  return async () => {
    const now = Date.now();
    const wait = Math.max(0, nextSlot - now);
    nextSlot = Math.max(now, nextSlot) + interval;
    if (wait) await new Promise((r) => setTimeout(r, wait));
  };
}

async function callApiVoid(ip) {
  const response = await fetch(ENDPOINT, {
    method: "POST",
    headers: { "Content-Type": "application/json", "X-API-Key": API_KEY },
    body: JSON.stringify({ ip }),
    signal: AbortSignal.timeout(180000), // Client-side timeout, so a stalled request frees its worker
  });
  if (!response.ok) throw new Error(`HTTP ${response.status}`);
  return { data: await response.json(), headers: response.headers };
}

const ips = ["80.82.77.139", "1.1.1.1", "8.8.8.8"]; // ... e.g. 1,000 IPs to scan
const results = {};

// 1. Single request first: discover the current limits
const first = await callApiVoid(ips[0]);
results[ips[0]] = first.data;

// 2. Pool size comes from the concurrency limit
const maxWorkers = parseInt(first.headers.get("x-concurrency-limit") ?? "1", 10); // Default to 1 if not present

// 3. Pacing comes from the requests-per-second limit: Limit / Window
const rpsLimit = parseInt(first.headers.get("x-ratelimit-limit") ?? String(maxWorkers), 10);
const rpsWindow = parseInt(first.headers.get("x-ratelimit-window") ?? "1", 10) || 1;
const acquire = createRateLimiter(rpsLimit / rpsWindow);

// 4. Process the rest with a worker pool sized to the concurrency limit.
//    A failed IP is reported and skipped, so one error never stops the batch.
const queue = ips.slice(1);
let failed = 0;
await Promise.all(
  Array.from({ length: maxWorkers }, async () => {
    let ip;
    while ((ip = queue.shift()) !== undefined) {
      await acquire();
      try {
        results[ip] = (await callApiVoid(ip)).data;
      } catch (error) { // HTTP error (e.g. 429), connection error or timeout
        failed++;
        console.error(`${ip} failed: ${error.message}`);
      }
    }
  })
);

console.log(`Scanned ${Object.keys(results).length} IPs with ${maxWorkers} workers, ${failed} failed`);
```

```go
package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"strconv"
	"sync"
	"time"
)

const endpoint = "https://api.apivoid.com/v2/ip-reputation"
const apiKey = "YOUR_API_KEY_HERE"

// Client-side timeout, so a stalled request frees its worker
var client = &http.Client{Timeout: 180 * time.Second}

func callApiVoid(ip string) (map[string]any, http.Header, error) {
	payload, _ := json.Marshal(map[string]string{"ip": ip})
	req, _ := http.NewRequest("POST", endpoint, bytes.NewReader(payload))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("X-API-Key", apiKey)

	resp, err := client.Do(req)
	if err != nil {
		return nil, nil, err
	}
	defer resp.Body.Close()

	if resp.StatusCode/100 != 2 {
		return nil, resp.Header, fmt.Errorf("HTTP %d", resp.StatusCode)
	}

	var data map[string]any
	err = json.NewDecoder(resp.Body).Decode(&data)
	return data, resp.Header, err
}

func main() {
	ips := []string{"80.82.77.139", "1.1.1.1", "8.8.8.8"} // ... e.g. 1,000 IPs to scan
	results := map[string]map[string]any{}

	// 1. Single request first: discover the current limits
	data, headers, err := callApiVoid(ips[0])
	if err != nil {
		panic(err)
	}
	results[ips[0]] = data

	// 2. Pool size comes from the concurrency limit
	maxWorkers := 1 // Default to 1 if not present
	if n, err := strconv.Atoi(headers.Get("X-Concurrency-Limit")); err == nil && n > 0 {
		maxWorkers = n
	}

	// 3. Pacing comes from the requests-per-second limit: Limit / Window
	rpsLimit := maxWorkers
	if n, err := strconv.Atoi(headers.Get("X-RateLimit-Limit")); err == nil && n > 0 {
		rpsLimit = n
	}
	rpsWindow := 1
	if n, err := strconv.Atoi(headers.Get("X-RateLimit-Window")); err == nil && n > 0 {
		rpsWindow = n
	}
	limiter := time.NewTicker(time.Duration(rpsWindow) * time.Second / time.Duration(rpsLimit))
	defer limiter.Stop()

	// 4. Process the rest with a semaphore sized to the concurrency limit.
	//    A failed IP is reported and skipped, so one error never stops the batch.
	var mu sync.Mutex
	var wg sync.WaitGroup
	failed := 0
	sem := make(chan struct{}, maxWorkers)
	for _, ip := range ips[1:] {
		wg.Add(1)
		go func(ip string) {
			defer wg.Done()
			sem <- struct{}{}       // concurrency limit first: take a slot
			defer func() { <-sem }()
			<-limiter.C             // then pace: one token every rpsWindow/rpsLimit second
			d, _, err := callApiVoid(ip)
			mu.Lock()
			defer mu.Unlock()
			if err != nil { // HTTP error (e.g. 429), connection error or timeout
				failed++
				fmt.Printf("%s failed: %v\n", ip, err)
				return
			}
			results[ip] = d
		}(ip)
	}
	wg.Wait()

	fmt.Printf("Scanned %d IPs with %d workers, %d failed\n", len(results), maxWorkers, failed)
}
```

```java
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.time.Duration;
import java.util.List;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.atomic.AtomicInteger;

public class Main {
    static final String ENDPOINT = "https://api.apivoid.com/v2/ip-reputation";
    static final String API_KEY = "YOUR_API_KEY_HERE";
    static final HttpClient CLIENT = HttpClient.newHttpClient();

    static final Object rateLock = new Object();
    static long intervalNanos;
    static long nextSlot = System.nanoTime();

    static void acquireRateLimit() throws InterruptedException {
        long wait;
        synchronized (rateLock) {
            long now = System.nanoTime();
            wait = Math.max(0, nextSlot - now);
            nextSlot = Math.max(now, nextSlot) + intervalNanos;
        }
        if (wait > 0) Thread.sleep(wait / 1_000_000, (int) (wait % 1_000_000));
    }

    static HttpResponse<String> callApiVoid(String ip) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create(ENDPOINT))
                .header("Content-Type", "application/json")
                .header("X-API-Key", API_KEY)
                .timeout(Duration.ofSeconds(180)) // Client-side timeout, so a stalled request frees its worker
                .POST(HttpRequest.BodyPublishers.ofString("{\"ip\": \"" + ip + "\"}"))
                .build();
        HttpResponse<String> response = CLIENT.send(request, HttpResponse.BodyHandlers.ofString());
        if (response.statusCode() / 100 != 2) throw new RuntimeException("HTTP " + response.statusCode());
        return response;
    }

    public static void main(String[] args) throws Exception {
        List<String> ips = List.of("80.82.77.139", "1.1.1.1", "8.8.8.8"); // ... e.g. 1,000 IPs to scan
        Map<String, String> results = new ConcurrentHashMap<>();

        // 1. Single request first: discover the current limits
        HttpResponse<String> first = callApiVoid(ips.get(0));
        results.put(ips.get(0), first.body());

        // 2. Pool size comes from the concurrency limit
        int maxWorkers = Integer.parseInt(
                first.headers().firstValue("X-Concurrency-Limit").orElse("1")); // Default to 1 if not present

        // 3. Pacing comes from the requests-per-second limit: Limit / Window
        int rpsLimit = Integer.parseInt(
                first.headers().firstValue("X-RateLimit-Limit").orElse(String.valueOf(maxWorkers)));
        int rpsWindow = Integer.parseInt(
                first.headers().firstValue("X-RateLimit-Window").orElse("1"));
        intervalNanos = 1_000_000_000L * Math.max(1, rpsWindow) / rpsLimit;

        // 4. Process the rest with a thread pool sized to the concurrency limit.
        //    A failed IP is reported and skipped, so one error never stops the batch.
        AtomicInteger failed = new AtomicInteger();
        ExecutorService pool = Executors.newFixedThreadPool(maxWorkers);
        for (String ip : ips.subList(1, ips.size())) {
            pool.submit(() -> {
                try {
                    acquireRateLimit();
                    results.put(ip, callApiVoid(ip).body());
                } catch (Exception error) { // HTTP error (e.g. 429), connection error or timeout
                    failed.incrementAndGet();
                    System.out.println(ip + " failed: " + error.getMessage());
                }
            });
        }
        pool.shutdown();
        pool.awaitTermination(1, TimeUnit.HOURS); // Wait for all submitted tasks to finish

        System.out.println("Scanned " + results.size() + " IPs with " + maxWorkers
                + " workers, " + failed.get() + " failed");
    }
}
```

A few practical notes:

- The limits are per API service, so discover them separately for each API you batch against.
- If other processes or servers share the same account API keys, leave a little headroom (e.g. `max_workers = limit - 1`) so they are not starved, since all of them draw on one account-wide budget, and watch `X-Concurrency-Remaining` and `X-RateLimit-Remaining` to see when a sibling process is competing with you.
- These examples read the headers once, from the first response, which is enough for a short batch. A long-running worker should re-read them on every response and adjust its pacing, so a limit change reaches it without a restart.
- These examples report a failed IP and move on, so one error never stops the batch, but they do not retry: in production, combine this pattern with the [retry logic](https://docs.apivoid.com/errors/) so an occasional `429` or transient error inside the pool is retried instead of counted as a failure, which is especially important for continuous workloads.

---

Source: <https://docs.apivoid.com/versioning/>

# API Versioning

All API requests are versioned using the major version, prefixed by a `v` in the URL path (e.g. `v1`, `v2`). The latest and recommended version is v2. The version in the URL only changes when we introduce breaking changes; backward-compatible improvements, such as bug fixes, new endpoints, and new fields, are released continuously within the same major version.

```text
https://api.apivoid.com/v2/{service}
```

## Backward-compatible changes

The following changes are considered non-breaking and can be released at any time within the current major version, without a new versioned URL. Your integration should be built to tolerate them:

- Adding new API endpoints (services).
- Adding new optional request parameters.
- Adding new fields to JSON responses.
- Changing the order of fields within JSON responses.
- Adding new HTTP response headers.

> Build a tolerant parser: read the fields you need and ignore any you do not recognize. Fields that are not documented on these pages are pre-release, and may be renamed, changed, or removed at any time without notice, so do not depend on them in production. This helps keep your integration resilient as the API evolves.

## Breaking changes

The following changes are considered breaking and are only introduced with a new major version (e.g. `v2` → `v3`), released under a new versioned URL endpoint to avoid disrupting existing integrations:

- Removing or renaming documented JSON response fields.
- Changing the data type or meaning of a documented field.
- Removing request parameters, or making optional parameters required.
- Removing or renaming API endpoints.
- Changing the authentication method or the error response format.

## Deprecation policy

When we release a new major API version, the previous version is deprecated but remains fully operational for at least 6 months from the announcement date, giving you time to migrate at your own pace. After the announced end-of-life date, deprecated endpoints may be shut down and stop responding at any time.

> Recommendation: always integrate against the latest major version (currently at `v2`) and follow the [changelog](https://changelog.apivoid.com/) to stay informed about new features and announcements, including API enhancements, newly available endpoints, important behavioral changes, deprecations, migration guidance, and other updates that may affect your integration.

When a new major version is announced, we will:

- Notify all registered users via our newsletter, including the end-of-life date of the deprecated version.
- Publish the announcement and migration notes on our [changelog](https://changelog.apivoid.com/).
- Update these documentation pages with the new version's reference and a migration guide.

---

Source: <https://docs.apivoid.com/openapi-specification/>

# OpenAPI Specification

All APIVoid v2 APIs are described in a single machine-readable [OpenAPI 3.0](https://spec.openapis.org/oas/v3.0.3) file: every endpoint, request parameter, response schema, credit cost, and the authentication scheme, generated from the same reference pages present in this documentation.

## Download

```text
https://docs.apivoid.com/openapi.json
```

[Download openapi.json](https://docs.apivoid.com/openapi.json) – or use the URL above directly in tools that support importing by URL.

## Common uses

- Postman or Insomnia. Import the file (or the URL) to get a ready-to-use collection with one request per API, example payloads, and the `X-API-Key` authorization configured at the collection level for quick testing. Set your API key once in your secure Postman environment and every API request is ready to send.
- Generate an API client. Use [OpenAPI Generator](https://openapi-generator.tech/) to create a typed client in your language, e.g. `openapi-generator-cli generate -i https://docs.apivoid.com/openapi.json -g python -o ./apivoid-client`
- AI coding assistants. Point your AI assistant or agent at the specification URL so it can write correct integration code with the exact endpoints, parameters, and response fields for faster, more reliable API integrations. See also our [llms.txt](https://docs.apivoid.com/llms.txt) and [llms-full.txt](https://docs.apivoid.com/llms-full.txt) for the full documentation in AI-friendly format.
- Request validation and mocking. Validate outgoing requests against the schemas, or spin up a mock server from the specification while developing, testing edge cases, and verifying integrations before connecting to production APIs, helping catch issues earlier in the development process and reduce integration errors.
- Explore the APIs. Load the file in any OpenAPI viewer (such as Swagger UI or Redoc) to browse all endpoints and schemas in one place, to better understand available API operations.

## What it contains

- All v2 API endpoints, each as an HTTPS POST operation with a link back to its reference page.
- Request schemas with required and optional parameters, types, defaults, and descriptions.
- Response schemas with per-field descriptions, plus a complete example response per API.
- Authentication via the `X-API-Key` header, defined once as the security scheme. See [Authentication](https://docs.apivoid.com/authentication/).
- Credit costs per API in each operation description and in the `x-credits-per-request` extension. See [How credits work](https://docs.apivoid.com/how-credits-work/).
- Error responses with the shared JSON error format and retry guidance. See [API errors & retries](https://docs.apivoid.com/errors/).

> The specification is regenerated together with these documentation pages, so it always matches the published reference. Follow the [changelog](https://changelog.apivoid.com/) for API updates and any important specification changes.

---

Source: <https://docs.apivoid.com/migrate-to-v2/>

# Migrate from v1 to v2

If you are still using the APIVoid v1 endpoints, this guide covers everything needed to migrate to the v2 API. The v2 API introduces improved authentication, a cleaner JSON structure, and a more standardized request format. The complete v2 reference starts at the [documentation home](https://docs.apivoid.com/).

> The v1 API was deprecated more than a year ago: the v1 endpoints still work today, but they may be permanently removed at any time from November 1, 2026. Migrate as soon as possible to avoid service interruption. If you have any questions, or need help migrating, don't hesitate to [contact us](https://www.apivoid.com/contacts/).

## 1. HTTP method and authentication

In v1, requests used HTTP GET, with the API key passed in the query string via `key=`:

```bash
curl "https://endpoint.apivoid.com/iprep/v1/pay-as-you-go/?key=YOUR_API_KEY_HERE&ip=122.226.181.165"
```

In v2, requests use HTTP POST, the API key is sent in the `X-API-Key` header, and parameters go in a JSON body:

```bash
curl -X POST "https://api.apivoid.com/v2/ip-reputation" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"ip": "122.226.181.165"}'
```

What changed:

- HTTP method: `GET` → `POST`
- API key moved from the query string to the `X-API-Key` header. See [Authentication](https://docs.apivoid.com/authentication/).
- Parameters moved from the URL to the JSON request body.
- New base URL: `https://api.apivoid.com/v2/`
- New URL path per API, e.g. `ip-reputation` for IP Reputation API (see the API reference pages).

## 2. JSON response structure

Important breaking change: the root `data` object and the `data.report` wrapper were removed.

The v1 response structure:

```json
{
  "data": {
    "report": {
      "ip": "80.82.77.139",
      "blacklists": {
        ...
      }
    }
  }
}
```

To access the IP field in v1: `response.data.report.ip`

The v2 response structure:

```json
{
  "ip": "80.82.77.139",
  "version": "IPv4",
  "blacklists": {
    ...
  }
}
```

To access the IP field in v2: `response.ip`

What changed:

- Removed the `data` root object.
- Removed the `report` wrapper.
- Fields are now at the top level of the JSON response.
- Cleaner and flatter structure; the exact fields for each API are documented on its reference page.

## 3. Migration checklist

- If not already done, [create a v2 account](https://dash.apivoid.com/register/).
- Use the API keys from the new [v2 dashboard](https://dash.apivoid.com/).
- Check the [v2 API documentation](https://docs.apivoid.com/) for each API you use.
- Change the HTTP method from `GET` to `POST`.
- Move the API key from the query parameter to the `X-API-Key` header.
- Send request parameters as a JSON body with `Content-Type: application/json`.
- Update the base URL to `https://api.apivoid.com/v2/`.
- Update the URL path for each API (e.g. `ip-reputation`).
- Update your response parsing logic (remove `data.report`).
- Review [API errors & retries](https://docs.apivoid.com/errors/) and [rate limits](https://docs.apivoid.com/rate-limit/), which also changed in v2.

---

Source: <https://docs.apivoid.com/account-info-api/>

# Account Info API Reference

Get details about your APIVoid account and subscription: plan name, credits balance, credits used, next reset, and overage status. This endpoint consumes no credits.

Endpoint: `POST https://api.apivoid.com/v2/account-info`

Credit cost: Consumes no credits.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/account-info" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE"
```

The same request in PHP:

```php
$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/account-info');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

This endpoint does not take any JSON parameters: send an empty POST request with the `X-API-Key` header.

> This endpoint is limited to 1 request per second.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "credits": {
        "remained": 5851025,
        "next_reset_ts": 1759877820,
        "next_reset_datetime": "2025-10-07 22:57:00",
        "next_reset_days": 4
    },
    "overage": {
        "allowed": false,
        "enabled": false,
        "credits_consumed": 0,
        "max_limit": 250000
    },
    "usage_stats": {
        "daily": {
            "dates": [
                {
                    "date": "2025-10-03",
                    "credits": 107060
                },
                {
                    "date": "2025-10-02",
                    "credits": 161609
                },
                {
                    "date": "2025-10-01",
                    "credits": 156491
                },
                {
                    "date": "2025-09-30",
                    "credits": 179471
                },
                {
                    "date": "2025-09-29",
                    "credits": 206062
                },
                {
                    "date": "2025-09-28",
                    "credits": 202777
                },
                {
                    "date": "2025-09-27",
                    "credits": 195988
                },
                {
                    "date": "2025-09-26",
                    "credits": 212962
                },
                {
                    "date": "2025-09-25",
                    "credits": 194203
                },
                {
                    "date": "2025-09-24",
                    "credits": 218459
                },
                {
                    "date": "2025-09-23",
                    "credits": 216841
                },
                {
                    "date": "2025-09-22",
                    "credits": 198665
                },
                {
                    "date": "2025-09-21",
                    "credits": 142136
                },
                {
                    "date": "2025-09-20",
                    "credits": 146458
                },
                {
                    "date": "2025-09-19",
                    "credits": 225072
                },
                {
                    "date": "2025-09-18",
                    "credits": 227521
                },
                {
                    "date": "2025-09-17",
                    "credits": 225049
                },
                {
                    "date": "2025-09-16",
                    "credits": 221269
                },
                {
                    "date": "2025-09-15",
                    "credits": 218528
                },
                {
                    "date": "2025-09-14",
                    "credits": 207953
                },
                {
                    "date": "2025-09-13",
                    "credits": 206449
                },
                {
                    "date": "2025-09-12",
                    "credits": 218775
                },
                {
                    "date": "2025-09-11",
                    "credits": 184718
                },
                {
                    "date": "2025-09-10",
                    "credits": 209747
                },
                {
                    "date": "2025-09-09",
                    "credits": 228334
                },
                {
                    "date": "2025-09-08",
                    "credits": 227776
                },
                {
                    "date": "2025-09-07",
                    "credits": 209300
                },
                {
                    "date": "2025-09-06",
                    "credits": 226560
                },
                {
                    "date": "2025-09-05",
                    "credits": 242216
                },
                {
                    "date": "2025-09-04",
                    "credits": 228813
                }
            ],
            "total": 6047262
        },
        "monthly": {
            "dates": [
                {
                    "date": "2025-10",
                    "credits": 425160
                },
                {
                    "date": "2025-09",
                    "credits": 6259378
                },
                {
                    "date": "2025-08",
                    "credits": 2975389
                }
            ]
        }
    },
    "elapsed_ms": 1
}
```

## Response fields

The fields returned in the JSON response:

- `credits → remained` (integer): Number of API credits remaining on the account.
- `credits → next_reset_ts` (integer): Unix timestamp of the next credits reset.
- `credits → next_reset_datetime` (string): Date and time of the next credits reset.
- `credits → next_reset_days` (integer): Number of days left until the next credits reset.
- `overage → allowed` (boolean): Returns true if overage is allowed on the account plan.
- `overage → enabled` (boolean): Returns true if overage is enabled on the account.
- `overage → credits_consumed` (integer): Number of overage credits consumed in the current period.
- `overage → max_limit` (integer): Maximum number of overage credits that can be consumed.
- `usage_stats → daily → dates` (array): List of recent days with the credits consumed on each day.
- `usage_stats → daily → dates[n] → date` (string): Date of the usage entry, format is Y-m-d.
- `usage_stats → daily → dates[n] → credits` (integer): Credits consumed on that day.
- `usage_stats → daily → total` (integer): Total credits consumed across the daily entries shown.
- `usage_stats → monthly → dates` (array): List of recent months with the credits consumed on each month.
- `usage_stats → monthly → dates[n] → date` (string): Month of the usage entry, format is Y-m.
- `usage_stats → monthly → dates[n] → credits` (integer): Credits consumed in that month.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/asn-info-api/>

# ASN Info API Reference

Get details about an Autonomous System Number (ASN): organization, country, abuse contacts, allocation date, and the announced IPv4 and IPv6 prefixes.

Service details and pricing: [ASN Info API](https://www.apivoid.com/api/asn-info/)

Endpoint: `POST https://api.apivoid.com/v2/asn-info`

Credit cost: 1 credit per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/asn-info" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"asn": "AS14061"}'
```

The same request in PHP:

```php
$asn = 'AS14061';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/asn-info');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['asn' => $asn]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `asn` (string; Required): ASN to submit, e.g. AS14061.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "asn": "AS14061",
    "asname": "DIGITALOCEAN-ASN",
    "status": "active",
    "org": "DigitalOcean, LLC",
    "country_code": "US",
    "created": "2012-09-25",
    "days_since_created": 4754,
    "months_since_created": 156,
    "years_since_created": 13,
    "updated": "2025-03-04",
    "days_since_updated": 211,
    "months_since_updated": 6,
    "years_since_updated": 0,
    "address": "105 Edgeview Drive, Suite 425, Broomfield, CO, 80021, United States",
    "abuse_email": "abuse@digitalocean.com",
    "domain": "digitalocean.com",
    "type": "hosting",
    "routes": {
        "ipv4": {
            "total_prefixes": 821,
            "total_ips": 3021312,
            "prefixes": [
                "103.253.144.0/22",
                "104.131.0.0/18",
                "104.131.128.0/20",
                ...
            ]
        },
        "ipv6": {
            "total_prefixes": 17,
            "total_ips": "328827822935179135520079872",
            "prefixes": [
                "2400:6180:100::/40",
                "2400:6180:10::/48",
                "2400:6180::/48",
                ...
            ]
        }
    },
    "rir": "ARIN"
}
```

## Response fields

The fields returned in the JSON response:

- `asn` (string): Autonomous System Number (ASN) submitted, e.g. AS14061.
- `asname` (string): Name assigned to the autonomous system.
- `status` (string): Registration status of the ASN, e.g. active.
- `org` (string): Organization that owns the ASN.
- `country_code` (string): Country code (e.g. US) where the ASN is registered.
- `created` (string): Date the ASN was registered, format is Y-m-d.
- `days_since_created` (integer): ASN age shown in number of days.
- `months_since_created` (integer): ASN age shown in number of months.
- `years_since_created` (integer): ASN age shown in number of years.
- `updated` (string): Date the ASN record was last updated, format is Y-m-d.
- `days_since_updated` (integer): Time since the last record update shown in number of days.
- `months_since_updated` (integer): Time since the last record update shown in number of months.
- `years_since_updated` (integer): Time since the last record update shown in number of years.
- `address` (string): Registered postal address of the organization.
- `abuse_email` (string): Email address to report abuse related to the ASN.
- `domain` (string): Website domain of the organization.
- `type` (string): Type of the ASN, e.g. hosting, isp, business.
- `routes → ipv4 → total_prefixes` (integer): Number of IPv4 prefixes announced by the ASN.
- `routes → ipv4 → total_ips` (integer): Total number of IPv4 addresses announced by the ASN.
- `routes → ipv4 → prefixes` (array): List of IPv4 prefixes (CIDR notation) announced by the ASN.
- `routes → ipv6 → total_prefixes` (integer): Number of IPv6 prefixes announced by the ASN.
- `routes → ipv6 → total_ips` (string): Total number of IPv6 addresses announced by the ASN (returned as string due to size).
- `routes → ipv6 → prefixes` (array): List of IPv6 prefixes (CIDR notation) announced by the ASN.
- `rir` (string): Regional Internet Registry that assigned the ASN, e.g. ARIN, RIPE.

---

Source: <https://docs.apivoid.com/bimi-validator-api/>

# BIMI Validator API Reference

Validate a domain's BIMI setup: the BIMI DNS record, the SVG logo (format, size and profile), and the VMC certificate including issuer, validity and trademark details.

Service details and pricing: [BIMI Validator API](https://www.apivoid.com/api/bimi-validator/)

Endpoint: `POST https://api.apivoid.com/v2/bimi-validator`

Credit cost: 5 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/bimi-validator" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"host": "paypal.com"}'
```

The same request in PHP:

```php
$host = 'paypal.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/bimi-validator');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. google.com.

### Optional

- `selector` (string; Default: default): BIMI selector to check. If omitted, the `default` selector is used.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "selector": "default",
    "host": "paypal.com",
    "bimi_host": "default._bimi.paypal.com",
    "cname_target": "",
    "has_bimi_record": true,
    "bimi_record": "v=BIMI1; l=https://www.paypalobjects.com/marketing/web/logos/paypal_ppe.svg; a=https://www.paypalobjects.com/marketing/web/logos/paypal_ppe.pem",
    "bimi_records_count": 1,
    "version": "BIMI1",
    "svg_logo": {
        "url": "https://www.paypalobjects.com/marketing/web/logos/paypal_ppe.svg",
        "status_code": 200,
        "valid": true,
        "file_size_bytes": 1098,
        "version": "1.2",
        "baseprofile": "tiny-ps",
        "title": "PayPal"
    },
    "vmc_certificate": {
        "url": "https://www.paypalobjects.com/marketing/web/logos/paypal_ppe.pem",
        "status_code": 200,
        "expired": false,
        "valid": true,
        "issued_to": {
            "common_name": "PayPal, Inc.",
            "alternative_names": ["paypal.com"],
            "organization": "PayPal, Inc.",
            "country": "US",
            "state": "California",
            "location": "San Jose"
        },
        "issuer": {
            "common_name": "DigiCert Verified Mark RSA4096 SHA256 2021 CA1",
            "organization": "DigiCert, Inc.",
            "country": "US",
            "state": "",
            "location": ""
        },
        "signature": {
            "serial": "6128685724469353749739451239056945761",
            "serial_hex": "049C5789183F8E64D6AE2F39FFEA3261",
            "type": "SHA256-RSA"
        },
        "validity": {
            "days_left": 198,
            "valid_from_timestamp": 1725840000,
            "valid_to_timestamp": 1757375999,
            "valid_from": "Mon, 09 Sep 2024 00:00:00 UTC",
            "valid_to": "Mon, 08 Sep 2025 23:59:59 UTC"
        },
        "trademark": {
            "found": true,
            "country": "US",
            "id": "6275156"
        }
    },
    "issues_found": [],
    "valid": true,
    "elapsed_ms": 92
}
```

## Response fields

The fields returned in the JSON response:

- `selector` (string): The BIMI selector specified or the default selector.
- `host` (string): Host submitted for the BIMI check.
- `bimi_host` (string): The full BIMI host name (selector._bimi.domain).
- `cname_target` (string): The CNAME target for the BIMI record, if any.
- `has_bimi_record` (boolean): Returns true if a BIMI record is found.
- `bimi_record` (string): BIMI record, e.g. `v=BIMI1; l=https://...logo.svg; a=https://...cert.pem`.
- `bimi_records_count` (integer): Returns the number of BIMI records found for the same selector (only one is expected).
- `version` (string): Returns the BIMI version specified in the v= tag (e.g. BIMI1).
- `svg_logo → url` (string): URL of the SVG logo specified in the l= tag.
- `svg_logo → status_code` (integer): HTTP status code returned when fetching the SVG logo.
- `svg_logo → valid` (boolean): Returns true if the SVG logo is valid for BIMI.
- `svg_logo → file_size_bytes` (integer): File size of the SVG logo in bytes.
- `svg_logo → version` (string): SVG version declared in the logo file.
- `svg_logo → baseprofile` (string): SVG base profile declared in the logo file, expected to be tiny-ps.
- `svg_logo → title` (string): Title element found in the SVG logo.
- `vmc_certificate → url` (string): URL of the VMC certificate specified in the a= tag.
- `vmc_certificate → status_code` (integer): HTTP status code returned when fetching the VMC certificate.
- `vmc_certificate → expired` (boolean): Returns true if the VMC certificate is expired.
- `vmc_certificate → valid` (boolean): Returns true if the VMC certificate is valid.
- `vmc_certificate → issued_to → common_name` (string): Common name of the entity the certificate was issued to.
- `vmc_certificate → issued_to → alternative_names` (array): Alternative names (domains) covered by the certificate.
- `vmc_certificate → issued_to → organization` (string): Organization the certificate was issued to.
- `vmc_certificate → issued_to → country` (string): Country of the organization the certificate was issued to.
- `vmc_certificate → issued_to → state` (string): State of the organization the certificate was issued to.
- `vmc_certificate → issued_to → location` (string): City of the organization the certificate was issued to.
- `vmc_certificate → issuer → common_name` (string): Common name of the certificate authority that issued the VMC.
- `vmc_certificate → issuer → organization` (string): Organization of the certificate authority that issued the VMC.
- `vmc_certificate → issuer → country` (string): Country of the certificate authority.
- `vmc_certificate → issuer → state` (string): State of the certificate authority.
- `vmc_certificate → issuer → location` (string): City of the certificate authority.
- `vmc_certificate → signature → serial` (string): Serial number of the certificate.
- `vmc_certificate → signature → serial_hex` (string): Serial number of the certificate, in hexadecimal (same format as `openssl x509 -serial`).
- `vmc_certificate → signature → type` (string): Signature algorithm of the certificate, e.g. SHA256-RSA.
- `vmc_certificate → validity → days_left` (integer): Number of days left before the certificate expires.
- `vmc_certificate → validity → valid_from_timestamp` (integer): Unix timestamp of when the certificate validity starts.
- `vmc_certificate → validity → valid_to_timestamp` (integer): Unix timestamp of when the certificate validity ends.
- `vmc_certificate → validity → valid_from` (string): Date and time of when the certificate validity starts.
- `vmc_certificate → validity → valid_to` (string): Date and time of when the certificate validity ends.
- `vmc_certificate → trademark → found` (boolean): Returns true if trademark details are found in the certificate.
- `vmc_certificate → trademark → country` (string): Country where the logo trademark is registered.
- `vmc_certificate → trademark → id` (string): Registration ID of the logo trademark.
- `issues_found` (array): Array of issues found with the BIMI record, SVG logo or VMC certificate, the "code" field can be BIMI_VIA_CNAME, BIMI_NOT_FOUND, DUPLICATE_BIMI_RECORDS, V_TAG_NOT_FOUND, V_TAG_NOT_FIRST, MISSING_L_TAG, MISSING_A_TAG, INVALID_L_TAG_CHARS, INVALID_A_TAG_CHARS, INVALID_SVG_FILE, INVALID_PEM_CERT_FILE, PEM_CERT_FILE_HAS_NO_TRADEMARK, PEM_CERT_DOMAIN_MISMATCH, VMC_LOGO_MISMATCH, VMC_LOGOTYPE_EXTENSION_NOT_FOUND, INVALID_BIMI_TAG_FOUND, UNKNOWN_BIMI_TAG_FOUND.
- `issues_found[n] → code` (string): Machine-readable issue code, e.g. BIMI_NOT_FOUND.
- `issues_found[n] → type` (string): Issue severity: error, warning or information.
- `issues_found[n] → message` (string): Human-readable description of the issue, e.g. BIMI record not found.
- `valid` (boolean): Returns true if the BIMI record is valid.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/dkim-validator-api/>

# DKIM Validator API Reference

Validate the DKIM record of a domain and selector: check that the public key record exists, is correctly formatted, and detect common configuration issues.

Service details and pricing: [DKIM Validator API](https://www.apivoid.com/api/dkim-validator/)

Endpoint: `POST https://api.apivoid.com/v2/dkim-validator`

Credit cost: 5 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/dkim-validator" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"host": "stripe.com"}'
```

The same request in PHP:

```php
$host = 'stripe.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/dkim-validator');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. google.com.

### Optional

- `selector` (string; Default: auto): DKIM selector to check. If omitted, the API tries 500+ known selectors automatically.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "selector": "s2",
    "host": "stripe.com",
    "dkim_host": "s2._domainkey.stripe.com",
    "cname_target": "s2.domainkey.u2680008.wl009.sendgrid.net",
    "has_dkim_record": true,
    "dkim_record": "k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDR/9Km49dOTJZfnn/mL4N3Pv6RDxVq7VmN+/fYUcy3LUv2Vczz7TQFe071srBQWAOCpEQLAXJbRJYp+ltcW8IGECRGYLabp6un7lWDO4TVTXNwe+YKgCwSnNv8fREDXa44KU2zYp3rkaAmm2EaXrZLCupKQ8hR3ZcIJqzmdl1iUwIDAQAB",
    "dkim_records_count": 1,
    "version": "DKIM1",
    "key_type": "rsa",
    "issues_found": [
        {
            "code": "V_TAG_NOT_FOUND",
            "type": "warning",
            "message": "The v tag is missing"
        },
        {
            "code": "WEAK_PUBLIC_KEY_BITS",
            "type": "warning",
            "message": "Public key uses weak 1024 bits"
        }
    ],
    "valid": true,
    "elapsed_ms": 196
}
```

## Response fields

The fields returned in the JSON response:

- `selector` (string): The DKIM selector specified or automatically discovered.
- `host` (string): Host submitted for the DKIM check.
- `dkim_host` (string): The full DKIM host name (selector._domainkey.domain).
- `cname_target` (string): The CNAME target for the DKIM record.
- `has_dkim_record` (boolean): Returns true if DKIM record is found.
- `dkim_record` (string): DKIM record, e.g. v=DKIM1; k=rsa; t=s; p=MIGfMA0GCSqGSIb...
- `dkim_records_count` (integer): Returns the number of DKIM records found for the same selector (only one is expected).
- `version` (string): Returns the DKIM version specified in the v= tag, defaulting to DKIM1 when absent.
- `key_type` (string): Returns the DKIM key type from the k= tag (e.g. rsa, ed25519).
- `issues_found` (array): Array of issues found, the "code" field can be DKIM_NOT_FOUND, DUPLICATE_DKIM_RECORDS, V_TAG_NOT_FOUND, V_TAG_NOT_FIRST, MISSING_P_TAG, NO_DKIM_TAGS_FOUND, INVALID_DKIM_TAG_FOUND, UNKNOWN_DKIM_TAG_FOUND, INVALID_H_TAG_CHARS, INVALID_K_TAG_CHARS, PUBLIC_KEY_REVOKED, INVALID_P_TAG_CHARS, PUBLIC_KEY_NOT_VALID, WEAK_PUBLIC_KEY_BITS, INVALID_S_TAG_CHARS, INVALID_T_TAG_CHARS.
- `issues_found[n] → code` (string): Machine-readable issue code, e.g. WEAK_PUBLIC_KEY_BITS.
- `issues_found[n] → type` (string): Issue severity: error, warning or information.
- `issues_found[n] → message` (string): Human-readable description of the issue.
- `valid` (boolean): Returns true if the DKIM record is valid.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/dmarc-validator-api/>

# DMARC Validator API Reference

Validate the DMARC record of a domain: check that the record exists, parse its policy tags, and detect common configuration issues, with detailed explanations.

Service details and pricing: [DMARC Validator API](https://www.apivoid.com/api/dmarc-validator/)

Endpoint: `POST https://api.apivoid.com/v2/dmarc-validator`

Credit cost: 5 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/dmarc-validator" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"host": "paypal.com"}'
```

The same request in PHP:

```php
$host = 'paypal.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/dmarc-validator');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. google.com.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "host": "paypal.com",
    "dmarc_host": "_dmarc.paypal.com",
    "cname_target": "",
    "has_dmarc_record": true,
    "dmarc_record": "p=reject; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com",
    "dmarc_records_count": 1,
    "domain_policy": "reject",
    "subdomain_policy": "",
    "dmarc_enforced": true,
    "rua_emails": [
        {
            "email": "d@rua.agari.com",
            "domain": "rua.agari.com",
            "has_mx_records": true
        }
    ],
    "ruf_emails": [
        {
            "email": "d@ruf.agari.com",
            "domain": "ruf.agari.com",
            "has_mx_records": true
        }
    ],
    "version": "DMARC1",
    "issues_found": [
        {
            "code": "V_TAG_NOT_FOUND",
            "type": "warning",
            "message": "The v tag is missing"
        }
    ],
    "valid": true,
    "elapsed_ms": 78
}
```

## Response fields

The fields returned in the JSON response:

- `host` (string): Host submitted for the DMARC check.
- `dmarc_host` (string): The full DMARC host name (_dmarc.domain).
- `cname_target` (string): The CNAME target for the DMARC record.
- `has_dmarc_record` (boolean): Returns true if DMARC record is found.
- `dmarc_record` (string): DMARC record, e.g. v=DMARC1; p=reject; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com.
- `dmarc_records_count` (integer): Returns the number of DMARC records found (there should be only one).
- `domain_policy` (string): Returns the DMARC domain policy (from the p= tag), which can be reject, quarantine, or none.
- `subdomain_policy` (string): Returns the DMARC subdomain policy (from the sp= tag), which can be reject, quarantine, or none.
- `dmarc_enforced` (boolean): Returns true if the DMARC domain policy is set to reject or quarantine.
- `rua_emails` (array): Returns an array containing details for each email address specified in the rua= tag.
- `rua_emails[n] → email` (string): Email address found in the rua tag (aggregate reports recipient).
- `rua_emails[n] → domain` (string): Domain of the rua email address.
- `rua_emails[n] → has_mx_records` (boolean): Returns true if the email domain has MX records configured to receive reports.
- `ruf_emails` (array): Returns an array containing details for each email address specified in the ruf= tag.
- `ruf_emails[n] → email` (string): Email address found in the ruf tag (forensic reports recipient).
- `ruf_emails[n] → domain` (string): Domain of the ruf email address.
- `ruf_emails[n] → has_mx_records` (boolean): Returns true if the email domain has MX records configured to receive reports.
- `version` (string): Returns the DMARC version specified in the v= tag, defaulting to DMARC1 when absent.
- `issues_found` (array): Array of issues found, the "code" field can be DMARC_NOT_FOUND, DUPLICATE_DMARC_RECORDS, V_TAG_NOT_FOUND, V_TAG_NOT_FIRST, MISSING_P_TAG, NO_DMARC_TAGS_FOUND, INVALID_DMARC_TAG_FOUND, UNKNOWN_DMARC_TAG_FOUND, INVALID_P_TAG_CHARS, P_TAG_IS_NONE, INVALID_ADKIM_TAG_CHARS, INVALID_ASPF_TAG_CHARS, INVALID_SP_TAG_CHARS, INVALID_FO_TAG_CHARS, INVALID_RUA_TAG_CHARS, RUA_TAG_INVALID_EMAIL, RUA_TAG_EMAIL_NO_MX, INVALID_RUF_TAG_CHARS, RUF_TAG_INVALID_EMAIL, RUF_TAG_EMAIL_NO_MX, INVALID_RF_TAG_CHARS, INVALID_PCT_TAG_CHARS, INVALID_RI_TAG_CHARS.
- `issues_found[n] → code` (string): Machine-readable issue code, e.g. V_TAG_NOT_FOUND.
- `issues_found[n] → type` (string): Issue severity: error, warning or information.
- `issues_found[n] → message` (string): Human-readable description of the issue.
- `valid` (boolean): Returns true if the DMARC record is valid.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/dns-lookup-api/>

# DNS Lookup API Reference

Resolve DNS records for any host: A, AAAA, MX, NS, TXT, SOA, and modern types like DMARC, BIMI, MTA-STS, TLS-RPT, HTTPS, TLSA, CAA, DNSSEC records and more.

Service details and pricing: [DNS Lookup API](https://www.apivoid.com/api/dns-lookup/)

Endpoint: `POST https://api.apivoid.com/v2/dns-lookup`

Credit cost: 1 credit per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/dns-lookup" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"host": "example.com", "dns_types": "A,AAAA,MX,NS,TXT,SOA,DMARC,BIMI,MTA-STS,TLS-RPT,ACME,HTTPS,TLSA,CAA,SRV,DNSKEY,DS,RRSIG"}'
```

The same request in PHP:

```php
$host = 'example.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/dns-lookup');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode([
    'host' => $host,
    'dns_types' => 'A,AAAA,MX,NS,TXT,SOA,DMARC,BIMI,MTA-STS,TLS-RPT,ACME,HTTPS,TLSA,CAA,SRV,DNSKEY,DS,RRSIG'
]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. google.com.
- `dns_types` (string; Required): DNS types, comma-separated with no spaces, such as: A,AAAA,MX,NS,TXT,SOA,DMARC,BIMI,MTA-STS,TLS-RPT,ACME,HTTPS,TLSA,CAA,SRV,DNSKEY,DS,RRSIG.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "host": "example.com",
    "records": {
        "a": [
            {
                "target": "93.184.215.14",
                "ttl": 3380
            }
        ],
        "aaaa": [
            {
                "target": "2606:2800:21f:cb07:6820:80da:af6b:8b2c",
                "ttl": 3380
            }
        ],
        "caa": [
            {
                "flag": 0,
                "tag": "iodef",
                "ttl": 3600,
                "value": "mailto:caa-violations@stripe.com"
            },
            {
                "flag": 0,
                "tag": "issue",
                "ttl": 3600,
                "value": "amazon.com"
            },
            {
                "flag": 0,
                "tag": "issue",
                "ttl": 3600,
                "value": "digicert.com"
            },
            {
                "flag": 0,
                "tag": "issue",
                "ttl": 3600,
                "value": "visa.com"
            }
        ],
        "dmarc": [
            {
                "target": "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s",
                "ttl": 3390
            }
        ],
        "bimi": [
            {
                "target": "v=BIMI1; l=https://www.example.com/uploads/bimi.svg; a=https://www.example.com/uploads/bimi-cert.pem;",
                "ttl": 3390
            }
        ],
        "acme": [
            {
                "target": "TqufBc_OudO92bJuiVy_VChVELY6t9N990a41ofwkW4",
                "ttl": 300
            },
            {
                "target": "THfu-OTfch3gJMULczPtcIpNlyJ96D5aq6c2ZZ3xh70",
                "ttl": 300
            }
        ],
        "mta-sts": [
            {
                "target": "v=STSv1; id=20251202110430Z",
                "ttl": 290
            }
        ],
        "tls-rpt": [
            {
                "target": "v=TLSRPTv1; rua=mailto:tlsrpt@posteo.de",
                "ttl": 300
            }
        ],
        "https": [
            {
                "params": "h2,h3",
                "priority": 1,
                "target": ".",
                "ttl": 21600
            }
        ],
        "tlsa": [
            {
                "certificate": "b7273310126734f9de62f29eb1f21907bf4e02a0fa1c3feda4594098841139c9",
                "matching_type": 1,
                "selector": 1,
                "ttl": 900,
                "usage": 3
            },
            {
                "certificate": "5ce7c3caf94015db746880a8d937df5674cf539c426990682d5b84c3a3bfeca3",
                "matching_type": 1,
                "selector": 1,
                "ttl": 900,
                "usage": 3
            },
            {
                "certificate": "2cd895dcbc6c9d4e1a267d7d1d75ace8b4b051dff71c7a9fdf0fac1e46a9398f",
                "matching_type": 1,
                "selector": 1,
                "ttl": 900,
                "usage": 3
            },
            {
                "certificate": "604016df5069274948aa519ac9236b70fcf1b455867c97ab856022c8affcc6ea",
                "matching_type": 1,
                "selector": 1,
                "ttl": 900,
                "usage": 3
            },
            {
                "certificate": "8488d4c1d6a4194a0ba962f5f606725c1d2a6eef062743efdb949dbb313c9be9",
                "matching_type": 1,
                "selector": 1,
                "ttl": 900,
                "usage": 3
            }
        ],
        "mx": [
            {
                "pref": 10,
                "target": "alt1.gmail-smtp-in.l.google.com",
                "ttl": 2700
            },
            {
                "pref": 20,
                "target": "alt2.gmail-smtp-in.l.google.com",
                "ttl": 2700
            },
            {
                "pref": 30,
                "target": "alt3.gmail-smtp-in.l.google.com",
                "ttl": 2700
            },
            {
                "pref": 40,
                "target": "alt4.gmail-smtp-in.l.google.com",
                "ttl": 2700
            }
        ],
        "ns": [
            {
                "target": "b.iana-servers.net",
                "ttl": 86180
            },
            {
                "target": "a.iana-servers.net",
                "ttl": 86180
            }
        ],
        "soa": [
            {
                "expire": 1209600,
                "minttl": 3600,
                "mname": "ns.icann.org",
                "refresh": 7200,
                "retry": 3600,
                "rname": "noc@dns.icann.org",
                "serial": 2024081460,
                "ttl": 3380
            }
        ],
        "srv": [
            {
                "port": 5060,
                "priority": 50,
                "target": "ygg2.vp.vc",
                "ttl": 1800,
                "weight": 100
            },
            {
                "port": 5060,
                "priority": 10,
                "target": "ygg1.vp.vc",
                "ttl": 1800,
                "weight": 100
            }
        ],
        "txt": [
            {
                "target": "v=spf1 -all",
                "ttl": 86180
            },
            {
                "target": "wgyf8z8cgvm2qmxpnbnldrcltvk4xqfn",
                "ttl": 86180
            }
        ],
        "dnskey": [
            {
                "algorithm": 13,
                "flags": 256,
                "protocol": 3,
                "public_key": "t7/xPcfCnzUrxKawsmnR+SxQAJSSLABBt+y7eV2/BylpqG6vhGuJRVGSsHeuBt/VjC6IByqVMYGu1J9+/s1QbQ=="
            },
            {
                "algorithm": 13,
                "flags": 257,
                "protocol": 3,
                "public_key": "1NYmUeN/Ens1c5m8lmq5/SiqjpMK+dfGDY+3j8KkDgDSiDQev59JlxpQSIgRV723NGBrM5wyDtORZ20rSVkCqA=="
            }
        ],
        "ds": [
            {
                "algorithm": 13,
                "digest": "9778f2ff96889ebed549795deaa40a6113f1899af7ca8dd7947fddfeca9a190b",
                "digest_type": 2,
                "key_tag": 7037
            }
        ],
        "rrsig": [
            {
                "algorithm": 13,
                "expiration": 1790950700,
                "inception": 1788355413,
                "key_tag": 34374,
                "labels": 2,
                "original_ttl": 300,
                "signature": "wwIv4z1kEQbq5T81t7AydkBil0BaVA+agWJmaCbwXgSE69CYY/AoIgBQOFN3czf1Km9EovQqWFkT8kDoExZ3mw==",
                "signer_name": "example.com",
                "type_covered": "A"
            },
            {
                "algorithm": 13,
                "expiration": 1790932671,
                "inception": 1788339888,
                "key_tag": 34374,
                "labels": 2,
                "original_ttl": 3600,
                "signature": "xJjQH4pTz7ebffMdmkQ1n/IWIHROyh9ql3nNKeHOjPghuAzUiwZ4NDZzJquyEorRwstp6r/gmmYpEL+P2sUkEg==",
                "signer_name": "example.com",
                "type_covered": "MX"
            }
        ]
    },
    "elapsed_ms": 28
}
```

## Response fields

The fields returned in the JSON response:

- `host` (string): Host submitted for the DNS lookup.
- `records` (object): DNS records found for the host, grouped by record type.
- `records → a` (array): A records; each item has target (IPv4 address) and ttl.
- `records → a[n] → target` (string): IPv4 address the A record points to.
- `records → a[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → aaaa` (array): AAAA records; each item has target (IPv6 address) and ttl.
- `records → aaaa[n] → target` (string): IPv6 address the AAAA record points to.
- `records → aaaa[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → caa` (array): CAA records; each item has flag, tag (e.g. issue, iodef), value and ttl.
- `records → caa[n] → flag` (integer): CAA record flag; 0 by default, 128 marks the record as critical.
- `records → caa[n] → tag` (string): CAA property tag, e.g. issue, issuewild or iodef.
- `records → caa[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → caa[n] → value` (string): CAA property value, e.g. the certificate authority allowed to issue certificates.
- `records → dmarc` (array): DMARC records found on _dmarc subdomain; each item has target (record value) and ttl.
- `records → dmarc[n] → target` (string): DMARC record value.
- `records → dmarc[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → bimi` (array): BIMI records found on default._bimi subdomain; each item has target (record value) and ttl.
- `records → bimi[n] → target` (string): BIMI record value.
- `records → bimi[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → acme` (array): ACME challenge records found on _acme-challenge subdomain; each item has target and ttl.
- `records → acme[n] → target` (string): ACME challenge token value.
- `records → acme[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → mta-sts` (array): MTA-STS records found on _mta-sts subdomain; each item has target and ttl.
- `records → mta-sts[n] → target` (string): MTA-STS record value.
- `records → mta-sts[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → tls-rpt` (array): TLS-RPT records found on _smtp._tls subdomain; each item has target and ttl.
- `records → tls-rpt[n] → target` (string): TLS-RPT record value.
- `records → tls-rpt[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → https` (array): HTTPS records; each item has target, params (e.g. h2,h3), priority and ttl.
- `records → https[n] → params` (string): HTTPS record SvcParams, e.g. the alpn values h2,h3.
- `records → https[n] → priority` (integer): HTTPS record priority; 0 indicates alias mode.
- `records → https[n] → target` (string): HTTPS record target name; a dot (.) refers to the record owner itself.
- `records → https[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → tlsa` (array): TLSA records; each item has certificate, usage, selector, matching_type and ttl.
- `records → tlsa[n] → certificate` (string): Certificate association data (hash of the certificate or public key).
- `records → tlsa[n] → matching_type` (integer): TLSA matching type: 0 (exact match), 1 (SHA-256) or 2 (SHA-512).
- `records → tlsa[n] → selector` (integer): TLSA selector: 0 (full certificate) or 1 (public key).
- `records → tlsa[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → tlsa[n] → usage` (integer): TLSA certificate usage, from 0 to 3 (e.g. 3 = domain-issued certificate).
- `records → mx` (array): MX records; each item has target (mail server), pref (preference) and ttl.
- `records → mx[n] → pref` (integer): Preference of the mail server; lower values are tried first.
- `records → mx[n] → target` (string): Mail server hostname.
- `records → mx[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → ns` (array): NS records; each item has target (name server) and ttl.
- `records → ns[n] → target` (string): Name server hostname.
- `records → ns[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → soa` (array): SOA records; each item has mname, rname, serial, refresh, retry, expire, minttl and ttl.
- `records → soa[n] → expire` (integer): Seconds after which secondary name servers stop answering if the primary is unreachable.
- `records → soa[n] → minttl` (integer): Minimum TTL, used for negative caching, in seconds.
- `records → soa[n] → mname` (string): Primary name server for the zone.
- `records → soa[n] → refresh` (integer): Seconds between zone refresh checks by secondary name servers.
- `records → soa[n] → retry` (integer): Seconds before a failed zone refresh is retried.
- `records → soa[n] → rname` (string): Email address of the zone administrator.
- `records → soa[n] → serial` (integer): Serial number of the zone; increases on every zone update.
- `records → soa[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → srv` (array): SRV records; each item has target, port, priority, weight and ttl.
- `records → srv[n] → port` (integer): Port where the service is available.
- `records → srv[n] → priority` (integer): Priority of the target host; lower values are tried first.
- `records → srv[n] → target` (string): Hostname providing the service.
- `records → srv[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → srv[n] → weight` (integer): Relative weight for records with the same priority.
- `records → txt` (array): TXT records; each item has target (record value) and ttl.
- `records → txt[n] → target` (string): TXT record value.
- `records → txt[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `records → dnskey` (array): DNSKEY records; each item has flags, protocol, algorithm and public_key.
- `records → dnskey[n] → flags` (integer): DNSKEY flags: 256 for a Zone Signing Key (ZSK), 257 for a Key Signing Key (KSK).
- `records → dnskey[n] → protocol` (integer): DNSKEY protocol field, always 3.
- `records → dnskey[n] → algorithm` (integer): DNSSEC algorithm number, e.g. 13 (ECDSA P-256 with SHA-256) or 8 (RSA/SHA-256).
- `records → dnskey[n] → public_key` (string): Public key material, base64-encoded.
- `records → ds` (array): DS records; each item has key_tag, algorithm, digest_type and digest.
- `records → ds[n] → key_tag` (integer): Key tag identifying the DNSKEY this DS record refers to.
- `records → ds[n] → algorithm` (integer): DNSSEC algorithm number of the referenced DNSKEY, e.g. 13.
- `records → ds[n] → digest_type` (integer): Digest algorithm: 1 (SHA-1), 2 (SHA-256) or 4 (SHA-384).
- `records → ds[n] → digest` (string): Digest of the referenced DNSKEY record, in hexadecimal.
- `records → rrsig` (array): RRSIG records; each item has type_covered, algorithm, labels, original_ttl, expiration, inception, key_tag, signer_name and signature.
- `records → rrsig[n] → type_covered` (string): DNS record type covered by this signature, e.g. A, MX, SOA.
- `records → rrsig[n] → algorithm` (integer): DNSSEC algorithm number used for the signature, e.g. 13.
- `records → rrsig[n] → labels` (integer): Number of labels in the original owner name (used for wildcard validation).
- `records → rrsig[n] → original_ttl` (integer): Original TTL of the signed record set, in seconds.
- `records → rrsig[n] → expiration` (integer): Unix timestamp after which the signature is no longer valid.
- `records → rrsig[n] → inception` (integer): Unix timestamp from which the signature is valid.
- `records → rrsig[n] → key_tag` (integer): Key tag of the DNSKEY that produced the signature.
- `records → rrsig[n] → signer_name` (string): Zone name that signed the record set, e.g. example.com.
- `records → rrsig[n] → signature` (string): Cryptographic signature, base64-encoded.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

## Bulk domains request

You can also submit multiple domains in a single request on the `/bulk` endpoint. The required JSON field is `hosts` (plural), with comma-separated domains, instead of the `host` field used for the single-domain request:

```bash
curl -X POST "https://api.apivoid.com/v2/dns-lookup/bulk" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"hosts": "google.com,stripe.com,msn.com,amazon.com,yahoo.com", "dns_types": "A,NS"}'
```

The same request in PHP:

```php
$hosts = 'google.com,stripe.com,msn.com,amazon.com,yahoo.com';
$dnsTypes = 'A,NS';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/dns-lookup/bulk');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['hosts' => $hosts, 'dns_types' => $dnsTypes]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

> Each subscription plan has a different limit on the number of domains that can be submitted in one bulk request; for example, the Basic plan allows up to 5. Each domain counts as a separate API request, so submitting 5 domains in bulk consumes the same credits as 5 single requests. You can check the [X-Service-Quota header](https://docs.apivoid.com/service-quota/) (`call-usage`).

### Required

- `hosts` (string; Required): Comma-separated list of hosts to resolve (no spaces), e.g. google.com,stripe.com. The maximum number of hosts per request depends on your plan.
- `dns_types` (string; Required): DNS types, comma-separated with no spaces, same values as the single-domain request.

The JSON output is different from the single-domain request: each host is returned as an entry with its own `records` object (same record structure as documented above):

```json
{
    "entries": [
        {
            "host": "google.com",
            "records": {
                "a": [
                    {
                        "target": "173.194.212.102",
                        "ttl": 300
                    },
                    {
                        "target": "173.194.212.138",
                        "ttl": 300
                    },
                    {
                        "target": "173.194.212.139",
                        "ttl": 300
                    },
                    {
                        "target": "173.194.212.100",
                        "ttl": 300
                    },
                    {
                        "target": "173.194.212.101",
                        "ttl": 300
                    },
                    {
                        "target": "173.194.212.113",
                        "ttl": 300
                    }
                ],
                "ns": [
                    {
                        "target": "ns1.google.com",
                        "ttl": 86400
                    },
                    {
                        "target": "ns3.google.com",
                        "ttl": 86400
                    },
                    {
                        "target": "ns4.google.com",
                        "ttl": 86400
                    },
                    {
                        "target": "ns2.google.com",
                        "ttl": 86400
                    }
                ]
            }
        },
        {
            "host": "stripe.com",
            "records": {
                "a": [
                    {
                        "target": "3.229.145.172",
                        "ttl": 60
                    },
                    {
                        "target": "54.162.8.126",
                        "ttl": 60
                    },
                    {
                        "target": "3.90.98.12",
                        "ttl": 60
                    }
                ],
                "ns": [
                    {
                        "target": "ns-1087.awsdns-07.org",
                        "ttl": 43200
                    },
                    {
                        "target": "ns-1882.awsdns-43.co.uk",
                        "ttl": 43200
                    },
                    {
                        "target": "ns-423.awsdns-52.com",
                        "ttl": 43200
                    },
                    {
                        "target": "ns-705.awsdns-24.net",
                        "ttl": 43200
                    }
                ]
            }
        },
        {
            "host": "msn.com",
            "records": {
                "a": [
                    {
                        "target": "204.79.197.219",
                        "ttl": 3600
                    }
                ],
                "ns": [
                    {
                        "target": "ns4-204.azure-dns.info",
                        "ttl": 86400
                    },
                    {
                        "target": "dns1.p08.nsone.net",
                        "ttl": 86400
                    },
                    {
                        "target": "dns2.p08.nsone.net",
                        "ttl": 86400
                    },
                    {
                        "target": "dns3.p08.nsone.net",
                        "ttl": 86400
                    },
                    {
                        "target": "dns4.p08.nsone.net",
                        "ttl": 86400
                    },
                    {
                        "target": "ns1-204.azure-dns.com",
                        "ttl": 86400
                    },
                    {
                        "target": "ns2-204.azure-dns.net",
                        "ttl": 86400
                    },
                    {
                        "target": "ns3-204.azure-dns.org",
                        "ttl": 86400
                    }
                ]
            }
        },
        {
            "host": "amazon.com",
            "records": {
                "a": [
                    {
                        "target": "205.251.242.103",
                        "ttl": 900
                    },
                    {
                        "target": "52.94.236.248",
                        "ttl": 900
                    },
                    {
                        "target": "54.239.28.85",
                        "ttl": 900
                    }
                ],
                "ns": [
                    {
                        "target": "ns1.amzndns.org",
                        "ttl": 7200
                    },
                    {
                        "target": "ns2.amzndns.co.uk",
                        "ttl": 7200
                    },
                    {
                        "target": "ns2.amzndns.com",
                        "ttl": 7200
                    },
                    {
                        "target": "ns2.amzndns.net",
                        "ttl": 7200
                    },
                    {
                        "target": "ns2.amzndns.org",
                        "ttl": 7200
                    },
                    {
                        "target": "ns1.amzndns.co.uk",
                        "ttl": 7200
                    },
                    {
                        "target": "ns1.amzndns.com",
                        "ttl": 7200
                    },
                    {
                        "target": "ns1.amzndns.net",
                        "ttl": 7200
                    }
                ]
            }
        },
        {
            "host": "yahoo.com",
            "records": {
                "a": [
                    {
                        "target": "98.137.11.163",
                        "ttl": 1800
                    },
                    {
                        "target": "98.137.11.164",
                        "ttl": 1800
                    },
                    {
                        "target": "74.6.143.26",
                        "ttl": 1800
                    },
                    {
                        "target": "74.6.143.25",
                        "ttl": 1800
                    },
                    {
                        "target": "74.6.231.20",
                        "ttl": 1800
                    },
                    {
                        "target": "74.6.231.21",
                        "ttl": 1800
                    }
                ],
                "ns": [
                    {
                        "target": "ns1.yahoo.com",
                        "ttl": 86400
                    },
                    {
                        "target": "ns5.yahoo.com",
                        "ttl": 86400
                    },
                    {
                        "target": "ns4.yahoo.com",
                        "ttl": 86400
                    },
                    {
                        "target": "ns2.yahoo.com",
                        "ttl": 86400
                    },
                    {
                        "target": "ns3.yahoo.com",
                        "ttl": 86400
                    }
                ]
            }
        }
    ],
    "elapsed_ms": 313
}
```

---

Source: <https://docs.apivoid.com/dns-propagation-api/>

# DNS Propagation API Reference

Check if DNS records of a domain have propagated globally by performing DNS lookups from multiple locations across America, Europe and Asia.

Service details and pricing: [DNS Propagation API](https://www.apivoid.com/api/dns-propagation/)

Endpoint: `POST https://api.apivoid.com/v2/dns-propagation`

Credit cost: 5 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/dns-propagation" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{
           "host": "example.com",
           "dns_types": "A,AAAA,MX,NS,TXT,SOA,SRV,CAA"
         }'
```

The same request in PHP:

```php
$host = 'example.com';
$dnsTypes = 'A,AAAA,MX,NS,TXT,SOA,SRV,CAA';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/dns-propagation');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host, 'dns_types' => $dnsTypes]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. google.com.
- `dns_types` (string; Required): DNS types comma-separated (no spaces), such as: A,AAAA,MX,NS,TXT,SOA,SRV,CAA.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "host": "example.com",
    "propagation": [
        {
            "continent_code": "NA",
            "continent_name": "North America",
            "country_code": "US",
            "country_name": "United States",
            "city_name": "New York City",
            "response": [
                {
                    "dns_type": "A",
                    "records": [
                        "96.7.128.198",
                        "23.215.0.136",
                        "23.192.228.80",
                        "23.192.228.84",
                        "23.215.0.138",
                        "96.7.128.175"
                    ]
                },
                {
                    "dns_type": "AAAA",
                    "records": [
                        "2600:1406:3a00:21::173e:2e66",
                        "2600:1406:bc00:53::b81e:94c8",
                        "2600:1406:3a00:21::173e:2e65",
                        "2600:1406:bc00:53::b81e:94ce",
                        "2600:1408:ec00:36::1736:7f24",
                        "2600:1408:ec00:36::1736:7f31"
                    ]
                },
                {
                    "dns_type": "MX",
                    "records": [
                        "gmail-smtp-in.l.google.com",
                        "alt1.gmail-smtp-in.l.google.com",
                        "alt4.gmail-smtp-in.l.google.com",
                        "alt2.gmail-smtp-in.l.google.com",
                        "alt3.gmail-smtp-in.l.google.com"
                    ]
                },
                {
                    "dns_type": "NS",
                    "records": [
                        "a.iana-servers.net",
                        "b.iana-servers.net"
                    ]
                },
                {
                    "dns_type": "TXT",
                    "records": [
                        "v=spf1 -all",
                        "_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9"
                    ]
                },
                {
                    "dns_type": "SRV",
                    "records": [
                        {
                            "port": 5060,
                            "priority": 10,
                            "target": "ygg1.vp.vc",
                            "weight": 100
                        },
                        {
                            "port": 5060,
                            "priority": 50,
                            "target": "ygg2.vp.vc",
                            "weight": 100
                        }
                    ]
                },
                {
                    "dns_type": "SOA",
                    "records": [
                        {
                            "expire": 1209600,
                            "minttl": 3600,
                            "mname": "ns.icann.org",
                            "refresh": 7200,
                            "retry": 3600,
                            "rname": "noc@dns.icann.org",
                            "serial": 2025011515
                        }
                    ]
                },
                {
                    "dns_type": "CAA",
                    "records": [
                        {
                            "flag": 0,
                            "tag": "issue",
                            "value": "visa.com"
                        },
                        {
                            "flag": 0,
                            "tag": "issue",
                            "value": "digicert.com"
                        },
                        {
                            "flag": 0,
                            "tag": "issue",
                            "value": "quovadisglobal.com"
                        }
                    ]
                }
            ]
        },
        {
            "continent_code": "NA",
            "continent_name": "North America",
            "country_code": "US",
            "country_name": "United States",
            "city_name": "San Francisco",
            "response": [
                {
                    "dns_type": "A",
                    "records": [
                        "23.192.228.80",
                        "23.192.228.84",
                        "23.215.0.136",
                        "23.215.0.138",
                        "96.7.128.175",
                        "96.7.128.198"
                    ]
                },
                {
                    "dns_type": "AAAA",
                    "records": [
                        "2600:1406:3a00:21::173e:2e66",
                        "2600:1406:bc00:53::b81e:94c8",
                        "2600:1406:bc00:53::b81e:94ce",
                        "2600:1408:ec00:36::1736:7f24",
                        "2600:1408:ec00:36::1736:7f31",
                        "2600:1406:3a00:21::173e:2e65"
                    ]
                },
                {
                    "dns_type": "MX",
                    "records": [
                        "gmail-smtp-in.l.google.com",
                        "alt1.gmail-smtp-in.l.google.com",
                        "alt4.gmail-smtp-in.l.google.com",
                        "alt2.gmail-smtp-in.l.google.com",
                        "alt3.gmail-smtp-in.l.google.com"
                    ]
                },
                {
                    "dns_type": "NS",
                    "records": [
                        "b.iana-servers.net",
                        "a.iana-servers.net"
                    ]
                },
                {
                    "dns_type": "TXT",
                    "records": [
                        "v=spf1 -all",
                        "_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9"
                    ]
                },
                {
                    "dns_type": "SRV",
                    "records": [
                        {
                            "port": 5060,
                            "priority": 10,
                            "target": "ygg1.vp.vc",
                            "weight": 100
                        },
                        {
                            "port": 5060,
                            "priority": 50,
                            "target": "ygg2.vp.vc",
                            "weight": 100
                        }
                    ]
                },
                {
                    "dns_type": "SOA",
                    "records": [
                        {
                            "expire": 1209600,
                            "minttl": 3600,
                            "mname": "ns.icann.org",
                            "refresh": 7200,
                            "retry": 3600,
                            "rname": "noc@dns.icann.org",
                            "serial": 2025011515
                        }
                    ]
                },
                {
                    "dns_type": "CAA",
                    "records": [
                        {
                            "flag": 0,
                            "tag": "issue",
                            "value": "visa.com"
                        },
                        {
                            "flag": 0,
                            "tag": "issue",
                            "value": "digicert.com"
                        },
                        {
                            "flag": 0,
                            "tag": "issue",
                            "value": "quovadisglobal.com"
                        }
                    ]
                }
            ]
        },
        ...
    ],
    "elapsed_ms": 155
}
```

## Response fields

The fields returned in the JSON response:

- `host` (string): Host submitted for the DNS propagation check.
- `propagation` (array): List of geographic locations with the DNS records seen from each location.
- `propagation[n] → continent_code` (string): Continent code (e.g. NA) of the checking location.
- `propagation[n] → continent_name` (string): Continent name of the checking location.
- `propagation[n] → country_code` (string): Country code (e.g. US) of the checking location.
- `propagation[n] → country_name` (string): Country name of the checking location.
- `propagation[n] → city_name` (string): City name of the checking location.
- `propagation[n] → response` (array): DNS responses seen from this location, one entry per DNS record type.
- `propagation[n] → response[n] → dns_type` (string): DNS record type queried, e.g. A, AAAA, MX, NS, TXT, SRV, SOA.
- `propagation[n] → response[n] → records` (array): Records returned for this DNS type from this location. A, AAAA, MX, NS and TXT records are returned as plain strings (IP address, hostname or text value); SRV, SOA and CAA records are returned as objects with the fields below.
- `propagation[n] → response[n] → records[n] → port` (integer): SRV record: port where the service is available.
- `propagation[n] → response[n] → records[n] → priority` (integer): SRV record: priority of the target host; lower values are tried first.
- `propagation[n] → response[n] → records[n] → weight` (integer): SRV record: relative weight for records with the same priority.
- `propagation[n] → response[n] → records[n] → target` (string): SRV record: hostname providing the service.
- `propagation[n] → response[n] → records[n] → mname` (string): SOA record: primary name server for the zone.
- `propagation[n] → response[n] → records[n] → rname` (string): SOA record: email address of the zone administrator.
- `propagation[n] → response[n] → records[n] → serial` (integer): SOA record: serial number of the zone; increases on every zone update.
- `propagation[n] → response[n] → records[n] → refresh` (integer): SOA record: seconds between zone refresh checks by secondary name servers.
- `propagation[n] → response[n] → records[n] → retry` (integer): SOA record: seconds before a failed zone refresh is retried.
- `propagation[n] → response[n] → records[n] → expire` (integer): SOA record: seconds after which secondary name servers stop answering if the primary is unreachable.
- `propagation[n] → response[n] → records[n] → minttl` (integer): SOA record: minimum TTL, used for negative caching, in seconds.
- `propagation[n] → response[n] → records[n] → flag` (integer): CAA record: flag, 0 by default, 128 marks the record as critical.
- `propagation[n] → response[n] → records[n] → tag` (string): CAA record: property tag, e.g. issue, issuewild or iodef.
- `propagation[n] → response[n] → records[n] → value` (string): CAA record: property value, e.g. the allowed certificate authority.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/dnssec-status-api/>

# DNSSEC Status API Reference

Check if the DNS records of a host are fully DNSSEC-signed and validated, with the full DNS answer, RRSIG and DNSKEY records and CNAME redirects.

Service details and pricing: [DNSSEC Status API](https://www.apivoid.com/api/dnssec-status/)

Endpoint: `POST https://api.apivoid.com/v2/dnssec-status`

Credit cost: 1 credit per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/dnssec-status" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{
           "host": "www.paypal.com",
           "dns_type": "A"
         }'
```

The same request in PHP:

```php
$host = 'www.paypal.com';
$dnsType = 'A';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/dnssec-status');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host, 'dns_type' => $dnsType]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. google.com.

### Optional

- `dns_type` (string; Default: A): DNS type, can be one of the following: A, AAAA, MX, NS, TXT, SOA, CAA, CNAME, SRV.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "host": "www.paypal.com",
    "dns_type": "A",
    "dnssec_enabled": true,
    "dnssec_signed": false,
    "rrsig_records": [
        {
            "name": "www.paypal.com",
            "type": "RRSIG",
            "ttl": 3417,
            "data": "CNAME 13 3 3600 1744928484 1742333294 paypal.com f5l9SOGnbgf8H23QOu+uunwLwMgxt7jAYHvuW8d9KNPnQf3FMX80Lxhqzdla6K/f6AOjIyCaBuk2RFKlrTe9iA=="
        },
        {
            "name": "www.glb.paypal.com",
            "type": "RRSIG",
            "ttl": 117,
            "data": "CNAME 13 4 300 1742907859 1742735059 glb.paypal.com 1Ue0053RPP/8+PbTQP1kGQ9QsSzhR8ecKgSvMSZiEyZ/S++1qso9ZFNRnkVMbxlOvUCrmS9szcuvWB1b4Px4Ow=="
        },
        {
            "name": "www.paypal.com",
            "type": "RRSIG",
            "ttl": 3600,
            "data": "CNAME 13 3 3600 1744928484 1742333294 paypal.com f5l9SOGnbgf8H23QOu+uunwLwMgxt7jAYHvuW8d9KNPnQf3FMX80Lxhqzdla6K/f6AOjIyCaBuk2RFKlrTe9iA=="
        },
        {
            "name": "www.glb.paypal.com",
            "type": "RRSIG",
            "ttl": 300,
            "data": "CNAME 13 4 300 1742908055 1742735255 glb.paypal.com UBLdB8tJpzF/WMeV370JjeNo2nDMeflysiKeI34GOC2Dw7g8HtbgMvc5FkfL/jmxglwcLrsnb1x7kFfmkBOReA=="
        },
        {
            "name": "www.paypal.com",
            "type": "RRSIG",
            "ttl": 3600,
            "data": "CNAME 13 3 3600 1744928484 1742333294 paypal.com f5l9SOGnbgf8H23QOu+uunwLwMgxt7jAYHvuW8d9KNPnQf3FMX80Lxhqzdla6K/f6AOjIyCaBuk2RFKlrTe9iA=="
        },
        {
            "name": "www.glb.paypal.com",
            "type": "RRSIG",
            "ttl": 300,
            "data": "CNAME 13 4 300 1742908056 1742735256 glb.paypal.com 6Fx9cnpencNHlQiPy3m66tGymPvuCQ19fBQNebQTLJSEYv60p9likEjDISpJ+sI0GX/0fu3bdEwCU0VJk4ledw=="
        },
        {
            "name": "www.paypal.com",
            "type": "RRSIG",
            "ttl": 3600,
            "data": "CNAME 13 3 3600 1744928484 1742333294 paypal.com f5l9SOGnbgf8H23QOu+uunwLwMgxt7jAYHvuW8d9KNPnQf3FMX80Lxhqzdla6K/f6AOjIyCaBuk2RFKlrTe9iA=="
        },
        {
            "name": "www.glb.paypal.com",
            "type": "RRSIG",
            "ttl": 300,
            "data": "CNAME 13 4 300 1742908056 1742735256 glb.paypal.com imTdzyhprpa8RdHiR7UNGnzDWMPmWcLsbXuDr5x5OMOUws923pMQCLsAViQ01BaFL7UlazxNPdszb9QuXsGoDA=="
        },
        {
            "name": "paypal.com",
            "type": "RRSIG",
            "ttl": 59,
            "data": "A 13 2 300 1744930569 1742335033 paypal.com lJWZJ+jrUFF1YK0VNdbQv/SCCNcGgs1VHAeGnzl/ch7FoZ7Ij0iFAxcj2Lx0lrC/EqzcKg/Ow40ZM4YzMZSZcQ=="
        },
        {
            "name": "paypal.com",
            "type": "RRSIG",
            "ttl": 2189,
            "data": "MX 13 2 3600 1744911592 1742316283 paypal.com hMLziyfQZNgBumBMCs/hOVJbiBu7hmN+cqDz/y2U919BIuxOFa5ASnmy+uPSTfGxMYuMS8Sc8sO79w9qjBmykw=="
        },
        {
            "name": "paypal.com",
            "type": "RRSIG",
            "ttl": 57,
            "data": "NS 13 2 300 1744922379 1742329900 paypal.com YoHzfPnxMZiDe/c/GJuznmW7VoMGi/+RtwgPjcFZcjo6UIlj3Yc4OeciTg+VroPS0GNiNw/mAwMhPmqQNSUEog=="
        }
    ],
    "dnskey_records": [
        {
            "name": "paypal.com",
            "type": "DNSKEY",
            "ttl": 37,
            "data": "256 3 13 P82aHv27vjeEDMJUhvU8f02W9/WeblsvfMCL+ywMEJgD/9xsRStpOJhZC9EwZ4nQBsP8rlA5rhyXZfBcgc877g=="
        },
        {
            "name": "paypal.com",
            "type": "DNSKEY",
            "ttl": 37,
            "data": "256 3 13 t7/xPcfCnzUrxKawsmnR+SxQAJSSLABBt+y7eV2/BylpqG6vhGuJRVGSsHeuBt/VjC6IByqVMYGu1J9+/s1QbQ=="
        },
        {
            "name": "paypal.com",
            "type": "DNSKEY",
            "ttl": 37,
            "data": "256 3 13 zJFO6JcpeZIZXwqycK0s1dx2o2WscPt3mltjObZe2pfHRGeBROSwdseufTJyQSyfNn+3ZgvcJZq4foKZfXT/WA=="
        },
        {
            "name": "paypal.com",
            "type": "DNSKEY",
            "ttl": 37,
            "data": "257 3 13 UfWINtfVS/tASNWSjcw5K3jSqovFZ6saO8xTwAL3QniwgHkBzBUQHh1Xh4s5eIuEcPZFJ3YY1cem5yQo2Lsq1w=="
        },
        {
            "name": "paypal.com",
            "type": "DNSKEY",
            "ttl": 37,
            "data": "257 3 13 1NYmUeN/Ens1c5m8lmq5/SiqjpMK+dfGDY+3j8KkDgDSiDQev59JlxpQSIgRV723NGBrM5wyDtORZ20rSVkCqA=="
        }
    ],
    "ds_records": [
        {
            "name": "paypal.com",
            "type": "DS",
            "ttl": 76862,
            "data": "7037 13 2 9778f2ff96889ebed549795deaa40a6113f1899af7ca8dd7947fddfeca9a190b"
        },
        {
            "name": "paypal.com",
            "type": "DS",
            "ttl": 76862,
            "data": "34800 13 2 d9e64ba8c8718fd93b596f9d109d9dac47c3f557312201dfcce5dd4128c08f50"
        }
    ],
    "answer": [
        {
            "name": "www.paypal.com",
            "type": "CNAME",
            "ttl": 3357,
            "data": "www.glb.paypal.com"
        },
        {
            "name": "www.paypal.com",
            "type": "RRSIG",
            "ttl": 3357,
            "data": "CNAME 13 3 3600 1744928484 1742333294 paypal.com f5l9SOGnbgf8H23QOu+uunwLwMgxt7jAYHvuW8d9KNPnQf3FMX80Lxhqzdla6K/f6AOjIyCaBuk2RFKlrTe9iA=="
        },
        {
            "name": "www.glb.paypal.com",
            "type": "CNAME",
            "ttl": 57,
            "data": "paypal-dynamic.map.fastly.net"
        },
        {
            "name": "www.glb.paypal.com",
            "type": "RRSIG",
            "ttl": 57,
            "data": "CNAME 13 4 300 1742907789 1742734989 glb.paypal.com Uf7VXZU5DE6knhXR8QqQQiuaQMFhqOtWfYk+duF8tPQaZQ2In04/fimFy6Z3PjDo7CCSkiAmEK36HYY4hF4Dow=="
        },
        {
            "name": "paypal-dynamic.map.fastly.net",
            "type": "A",
            "ttl": 57,
            "data": "151.101.129.21"
        },
        {
            "name": "paypal-dynamic.map.fastly.net",
            "type": "A",
            "ttl": 57,
            "data": "151.101.193.21"
        },
        {
            "name": "paypal-dynamic.map.fastly.net",
            "type": "A",
            "ttl": 57,
            "data": "151.101.65.21"
        },
        {
            "name": "paypal-dynamic.map.fastly.net",
            "type": "A",
            "ttl": 57,
            "data": "151.101.1.21"
        }
    ],
    "elapsed_ms": 169
}
```

## Response fields

The fields returned in the JSON response:

- `host` (string): Host submitted for the DNSSEC check.
- `dns_type` (string): DNS record type queried, e.g. A.
- `dnssec_enabled` (boolean): Returns true if DNSSEC is enabled for the domain.
- `dnssec_signed` (boolean): Returns true if the DNS response is signed with DNSSEC.
- `rrsig_records` (array): RRSIG records found; each item has name, type, ttl and data.
- `rrsig_records[n] → name` (string): Host name the record belongs to.
- `rrsig_records[n] → type` (string): DNS record type, always RRSIG for this array.
- `rrsig_records[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `rrsig_records[n] → data` (string): Raw RRSIG record data (covered type, algorithm, expiration and signature).
- `dnskey_records` (array): DNSKEY records found; each item has name, type, ttl and data.
- `dnskey_records[n] → name` (string): Host name the record belongs to.
- `dnskey_records[n] → type` (string): DNS record type, always DNSKEY for this array.
- `dnskey_records[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `dnskey_records[n] → data` (string): Raw DNSKEY record data (flags, protocol, algorithm and public key).
- `ds_records` (array): DS records found; each item has name, type, ttl and data.
- `ds_records[n] → name` (string): Host name the record belongs to.
- `ds_records[n] → type` (string): DNS record type, always DS for this array.
- `ds_records[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `ds_records[n] → data` (string): Raw DS record data (key tag, algorithm, digest type and digest).
- `answer` (array): DNS answer records for the queried type; each item has name, type, ttl and data.
- `answer[n] → name` (string): Host name the record belongs to.
- `answer[n] → type` (string): DNS record type of the answer, e.g. A.
- `answer[n] → ttl` (integer): Time-to-live (TTL) of the record, in seconds.
- `answer[n] → data` (string): Record value, e.g. the IPv4 address for an A record.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/domain-age-api/>

# Domain Age API Reference

Get the age of a domain: creation date and age in days, months and years. Useful to detect newly (and potentially suspicious) registered domains in threat analysis.

Service details and pricing: [Domain Age API](https://www.apivoid.com/api/domain-age/)

Endpoint: `POST https://api.apivoid.com/v2/domain-age`

Credit cost: 1 credit per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/domain-age" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"host": "example.com"}'
```

The same request in PHP:

```php
$host = 'example.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/domain-age');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. google.com.

### Optional

- `timeout` (integer; Default: 25): Set a custom timeout in seconds, can be from 5 to 30 seconds.
- `cache_only` (boolean; Default: false): Get data only from the cache (if present) for a faster response.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "host": "example.com",
    "debug_message": "",
    "domain_age_found": true,
    "domain_registered": "yes",
    "domain_creation_date": "1995-08-14",
    "domain_age_in_days": 10700,
    "domain_age_in_months": 345,
    "domain_age_in_years": 29,
    "elapsed_ms": 310
}
```

## Response fields

The fields returned in the JSON response:

- `host` (string): Host submitted for the domain age check.
- `debug_message` (string): Debug or error details about the request, if any. Empty string if none.
- `domain_age_found` (boolean): Returns true if domain age was successfully retrieved.
- `domain_registered` (string): Returns "yes" if domain is registered, can be yes/no/unknown.
- `domain_creation_date` (string): Domain registration date, format is Y-m-d (empty if unknown).
- `domain_age_in_days` (integer): Age of the domain in days (0 if unknown).
- `domain_age_in_months` (integer): Age of the domain in months (0 if unknown).
- `domain_age_in_years` (integer): Age of the domain in years (0 if unknown).
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/domain-info-api/>

# Domain Info API Reference

Get whois-like domain information: registrar, abuse email, owner organization and country, creation date, nameservers and DNSSEC status.

Service details and pricing: [Domain Info API](https://www.apivoid.com/api/domain-info/)

Endpoint: `POST https://api.apivoid.com/v2/domain-info`

Credit cost: 2 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/domain-info" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"host": "google.com"}'
```

The same request in PHP:

```php
$host = 'google.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/domain-info');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. google.com.

### Optional

- `timeout` (integer; Default: 25): Set a custom timeout in seconds, can be from 5 to 30 seconds.
- `cache_only` (boolean; Default: false): Get data only from the cache (if present) for a faster response.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "host": "google.com",
    "debug_message": "",
    "domain_age_found": true,
    "domain_registered": "yes",
    "domain_creation_date": "1997-09-15",
    "domain_age_in_days": 9970,
    "domain_age_in_months": 321,
    "domain_age_in_years": 27,
    "registrar": "MarkMonitor Inc.",
    "registrar_url": "markmonitor.com",
    "registrar_abuse_email": "abusecomplaints@markmonitor.com",
    "registrar_abuse_form": "",
    "registrar_twitter": "markmonitor",
    "owner_organization": "Google LLC",
    "owner_country": "US",
    "owner_state_province": "CA",
    "owner_email_hash": "",
    "owner_email_domain": "",
    "owner_free_email": false,
    "owner_private_person": false,
    "whois_data_hidden": false,
    "dnssec": "unsigned",
    "nameservers": [
        {
            "name": "ns1.google.com",
            "ipv4": "216.239.32.10",
            "ipv6": "2001:4860:4802:32::a"
        },
        {
            "name": "ns4.google.com",
            "ipv4": "216.239.38.10",
            "ipv6": "2001:4860:4802:38::a"
        },
        {
            "name": "ns3.google.com",
            "ipv4": "216.239.36.10",
            "ipv6": "2001:4860:4802:36::a"
        },
        {
            "name": "ns2.google.com",
            "ipv4": "216.239.34.10",
            "ipv6": "2001:4860:4802:34::a"
        }
    ],
    "elapsed_ms": 524
}
```

## Response fields

The fields returned in the JSON response:

- `host` (string): Host submitted for the domain info lookup.
- `debug_message` (string): Debug or error details about the request, if any. Empty string if none.
- `domain_age_found` (boolean): Returns true if domain age was successfully retrieved.
- `domain_registered` (string): Returns "yes" if domain is registered, can be yes/no/unknown.
- `domain_creation_date` (string): Domain registration date, format is Y-m-d (empty if unknown).
- `domain_age_in_days` (integer): Age of the domain in days (0 if unknown).
- `domain_age_in_months` (integer): Age of the domain in months (0 if unknown).
- `domain_age_in_years` (integer): Age of the domain in years (0 if unknown).
- `registrar` (string): Domain registrar such as NameCheap Inc. or GoDaddy.com, LLC.
- `registrar_url` (string): Domain registrar url, such as namecheap.com.
- `registrar_abuse_email` (string): Domain registrar abuse email address.
- `registrar_abuse_form` (string): URL of the registrar abuse form, such as `https://supportcenter.godaddy.com/AbuseReport`.
- `registrar_twitter` (string): Twitter username of domain registrar, such as GoDaddy.
- `owner_organization` (string): Domain owner organization, such as Google LLC.
- `owner_country` (string): Domain owner country code, such as US.
- `owner_state_province` (string): State or province of the domain owner, from WHOIS data. Empty string if not available.
- `owner_email_hash` (string): Domain owner email (hashed for privacy reasons).
- `owner_email_domain` (string): Domain owner email domain, such as gmail.com.
- `owner_free_email` (boolean): Returns true if owner email is a free email.
- `owner_private_person` (boolean): Returns true if domain owner is a potential private person.
- `whois_data_hidden` (boolean): Returns true if domain whois data is hidden/masked.
- `dnssec` (string): Check DNSSEC records, can be signed/unsigned/unknown.
- `nameservers` (array): Returns an array with nameservers with their IPv4 and IPv6 addresses.
- `nameservers[n] → name` (string): Name server hostname.
- `nameservers[n] → ipv4` (string): IPv4 address of the name server. Empty string if none.
- `nameservers[n] → ipv6` (string): IPv6 address of the name server. Empty string if none.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/domain-reputation-api/>

# Domain Reputation API Reference

Check a domain's reputation across multiple trusted blacklist services, with an overall risk score, per-engine detection details, and additional security checks.

Service details and pricing: [Domain Reputation API](https://www.apivoid.com/api/domain-reputation/)

Endpoint: `POST https://api.apivoid.com/v2/domain-reputation`

Credit cost: 1 credit per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/domain-reputation" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"host": "google.com"}'
```

The same request in PHP:

```php
$host = 'google.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/domain-reputation');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. google.com.

### Optional

- `exclude_engines` (string): List of comma-separated engines to exclude, e.g. Malc0de,Spam404.
- `spamhaus_key` (string): Your [Spamhaus DBL DQS key](https://www.spamhaus.com/product/data-query-service/), this will enable the Spamhaus engine.
- `include_domain_age` (boolean; Default: false; +1 Credit): Include domain age as risk factor and detect recently created domains. New response fields (when enabled): `is_domain_recent`, `is_domain_very_recent`, `domain_creation_date`, `domain_age_in_days`, `domain_age_in_months`, `domain_age_in_years`. These new response fields are inside `security_checks`. Note: ⚠ Enabling this option costs 1 additional credit per successful request.
- `domain_age_cache_only` (boolean; Default: false): Get data only from the cache (if present) for a faster response. Requires `"include_domain_age": true`.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "host": "google.com",
    "blacklists": {
        "engines": {
            "0": {
                "name": "ANJ Blocked Sites",
                "detected": false,
                "reference": "https://anj.fr/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "1": {
                "name": "AntiSocial Blacklist",
                "detected": false,
                "reference": "https://theantisocialengineer.com/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "2": {
                "name": "APVA",
                "detected": false,
                "reference": "https://www.antiphish.org/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "3": {
                "name": "Artists Against 419",
                "detected": false,
                "reference": "https://wiki.aa419.org/index.php/Main_Page",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "4": {
                "name": "AZORult Tracker",
                "detected": false,
                "reference": "https://azorult-tracker.net/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "5": {
                "name": "Badbitcoin",
                "detected": false,
                "reference": "https://badbitcoin.org/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "6": {
                "name": "Bambenek Consulting",
                "detected": false,
                "reference": "https://www.bambenekconsulting.com/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "7": {
                "name": "CERT Polska",
                "detected": false,
                "reference": "https://www.cert.pl/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "8": {
                "name": "COI CZ",
                "detected": false,
                "reference": "https://coi.gov.cz/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "9": {
                "name": "CryptoScamDB",
                "detected": false,
                "reference": "https://cryptoscamdb.org/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "10": {
                "name": "EtherAddressLookup",
                "detected": false,
                "reference": "https://github.com/409H/EtherAddressLookup/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            ...
        },
        "detections": 0,
        "engines_count": 42,
        "detection_rate": "0%",
        "scan_time_ms": 139
    },
    "server_details": {
        "ip": "192.178.219.139",
        "reverse_dns": "ux-in-f139.1e100.net",
        "continent_code": "NA",
        "continent_name": "North America",
        "country_code": "US",
        "country_name": "United States of America",
        "region_name": "California",
        "city_name": "Mountain View",
        "latitude": 37.38605,
        "longitude": -122.08385,
        "isp": "Google LLC",
        "asn": "AS15169"
    },
    "category": {
        "is_free_hosting": false,
        "is_anonymizer": false,
        "is_url_shortener": false,
        "is_free_dynamic_dns": false,
        "is_code_sandbox": false,
        "is_form_builder": false,
        "is_free_file_sharing": false,
        "is_pastebin": false,
        "is_qrcode_service": false
    },
    "security_checks": {
        "is_most_abused_tld": false,
        "is_domain_ipv4_assigned": true,
        "is_domain_ipv4_private": false,
        "is_domain_ipv4_loopback": false,
        "is_domain_ipv4_reserved": false,
        "is_domain_ipv4_valid": true,
        "is_domain_blacklisted": false,
        "detections_count": 0,
        "is_uncommon_host_length": false,
        "is_uncommon_dash_char_count": false,
        "is_uncommon_dot_char_count": false,
        "is_suspicious_homoglyph": false,
        "is_possible_typosquatting": false,
        "website_popularity": "high",
        "is_uncommon_clickable_domain": false,
        "is_risky_category": false
    },
    "domain_parts": {
        "root_domain": "google.com",
        "subdomain": "",
        "tld": "com"
    },
    "risk_score": {
        "result": 0
    },
    "elapsed_ms": 140
}
```

If you enable the `include_domain_age` parameter, you will get more data on `security_checks`:

```json
"security_checks": {
    ...
    "is_domain_recent": "no",
    "is_domain_very_recent": "no",
    "domain_creation_date": "2021-03-11",
    "domain_age_in_days": 1413,
    "domain_age_in_months": 45,
    "domain_age_in_years": 3
}
```

## Response fields

The fields returned in the JSON response:

- `host` (string): Host submitted for scanning.
- `blacklists → engines` (object): List of scanning engines with detection status and reference link.
- `blacklists → engines → [index] → name` (string): Name of the scanning engine.
- `blacklists → engines → [index] → detected` (boolean): Returns true if this engine flagged the submitted domain.
- `blacklists → engines → [index] → reference` (string): Link to the engine's website or listing details.
- `blacklists → engines → [index] → confidence` (string): Confidence level of this engine detection. Can be high or low.
- `blacklists → engines → [index] → elapsed_ms` (integer): Time taken by this engine to complete its check, in milliseconds.
- `blacklists → detections` (integer): Number of scanning engines that detected the submitted host.
- `blacklists → engines_count` (integer): Number of scanning engines used to scan the host.
- `blacklists → detection_rate` (string): Percentage of engines that detected the domain, e.g. 5%.
- `blacklists → scan_time_ms` (integer): Time taken to scan the domain across all engines, in milliseconds.
- `server_details → ip` (string): IP address of the submitted host.
- `server_details → reverse_dns` (string): Hostname (reverse DNS) assigned to the host's IP address.
- `server_details → continent_code` (string): Continent code (e.g. NA) of where the host's IP address is located.
- `server_details → continent_name` (string): Continent name (e.g. North America) of where the host's IP address is located.
- `server_details → country_code` (string): Country code (e.g. CN) of where the host's IP address is located.
- `server_details → country_name` (string): Country name of where the host's IP address is located.
- `server_details → region_name` (string): Region or state name of where the host's IP address is located.
- `server_details → city_name` (string): City name of where the host's IP address is located.
- `server_details → latitude` (float): Approximate latitude of the host's IP address.
- `server_details → longitude` (float): Approximate longitude of the host's IP address.
- `server_details → isp` (string): Internet Service Provider (ISP) of host's IP address.
- `server_details → asn` (string): IP Autonomous System Number (ASN), such as AS16509.
- `category → is_free_hosting` (boolean): Returns true if host is a free hosting provider, e.g. 000webhostapp.com.
- `category → is_anonymizer` (boolean): Returns true if host is an anonymizer service, e.g. a web proxy.
- `category → is_url_shortener` (boolean): Returns true if host is a URL shortening service, e.g. rebrand.ly.
- `category → is_free_dynamic_dns` (boolean): Returns true if host is a free dynamic DNS provider, e.g. dns-cloud.net.
- `category → is_code_sandbox` (boolean): Returns true if website is a code sandbox service, e.g. repl.co.
- `category → is_form_builder` (boolean): Returns true if website is a form builder service, e.g. forms.gle.
- `category → is_free_file_sharing` (boolean): Returns true if website is a free file hosting service, e.g. wetransfer.com.
- `category → is_pastebin` (boolean): Returns true if website is a pastebin service, e.g. pastebin.com.
- `category → is_qrcode_service` (boolean): Returns true if website is a QRCode service, e.g. uqr.to.
- `security_checks → is_most_abused_tld` (boolean): Returns true if host TLD is risky, e.g. .tk or .top.
- `security_checks → is_domain_ipv4_assigned` (boolean): Returns true if the domain resolves to an assigned IPv4 address.
- `security_checks → is_domain_ipv4_private` (boolean): Returns true if the domain resolves to a private IPv4 address.
- `security_checks → is_domain_ipv4_loopback` (boolean): Returns true if the domain resolves to a loopback (e.g. 127.0.0.1) IPv4 address.
- `security_checks → is_domain_ipv4_reserved` (boolean): Returns true if the domain resolves to a reserved IPv4 address.
- `security_checks → is_domain_ipv4_valid` (boolean): Returns true if the domain resolves to a valid public IPv4 address.
- `security_checks → is_domain_blacklisted` (boolean): Returns true if domain is detected by at least 1 blacklist engine.
- `security_checks → detections_count` (integer): Number of security checks that returned true.
- `security_checks → is_uncommon_host_length` (boolean): Returns true if the host length is uncommon (such as, a very long domain).
- `security_checks → is_uncommon_dash_char_count` (boolean): Returns true if the host contains too many dash "-" characters.
- `security_checks → is_uncommon_dot_char_count` (boolean): Returns true if the host contains too many dot "." characters.
- `security_checks → is_suspicious_homoglyph` (boolean): Returns true if the domain contains suspicious homoglyph characters.
- `security_checks → is_possible_typosquatting` (boolean): Returns true if the domain is potentially a typosquatted variant of a known domain.
- `security_checks → website_popularity` (string): Estimated website popularity, can be: low, medium, high.
- `security_checks → is_uncommon_clickable_domain` (boolean): Returns true if the domain is considered unusual as a clickable link.
- `security_checks → is_risky_category` (boolean): Returns true if domain is a free DNS provider, free hosting provider or URL shortener.
- `security_checks → is_domain_recent` (string; With: include_domain_age): Returns "yes" if domain was created less than 6 months ago, can be yes/no/unknown.
- `security_checks → is_domain_very_recent` (string; With: include_domain_age): Returns "yes" if domain was created less than 30 days ago, can be yes/no/unknown.
- `security_checks → domain_creation_date` (string; With: include_domain_age): Domain registration date, format is Y-m-d (empty if unknown).
- `security_checks → domain_age_in_days` (integer; With: include_domain_age): Age of the domain in days (0 if unknown).
- `security_checks → domain_age_in_months` (integer; With: include_domain_age): Age of the domain in months (0 if unknown).
- `security_checks → domain_age_in_years` (integer; With: include_domain_age): Age of the domain in years (0 if unknown).
- `domain_parts → root_domain` (string): Registered root domain (e.g. `example.com`), excluding subdomains.
- `domain_parts → subdomain` (string): Subdomain portion of the host (e.g. `www`). Empty string if none.
- `domain_parts → tld` (string): Top-level domain (e.g. `com`, `org`, `co.uk`).
- `risk_score → result` (integer): Returns risk score, a number between 0 (safe) and 100 (dangerous).
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/email-verify-api/>

# Email Verify API Reference

Verify an email address: syntax checks, disposable and free provider detection, presence of MX records, TXT and SPF records, and a suspicious email score.

Service details and pricing: [Email Verify API](https://www.apivoid.com/api/email-verify/)

Endpoint: `POST https://api.apivoid.com/v2/email-verify`

Credit cost: 1 credit per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/email-verify" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"email": "a1k5z0a3@yopmail.com"}'
```

The same request in PHP:

```php
$email = 'a1k5z0a3@yopmail.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/email-verify');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['email' => $email]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `email` (string; Required): Email to submit, e.g. a1k5z0a3@yopmail.com.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "email": "a1k5z0a3@yopmail.com",
    "canonical_email": "a1k5z0a3@yopmail.com",
    "valid_format": true,
    "username": "a1k5z0a3",
    "role_address": false,
    "system_address": false,
    "noreply_address": false,
    "suspicious_username": false,
    "dirty_words_username": false,
    "suspicious_email": false,
    "email_length": 20,
    "username_length": 8,
    "domain_length": 11,
    "username_has_only_digits": false,
    "username_has_celebrity_name": false,
    "username_dots_count": 0,
    "username_underscores_count": 0,
    "username_hyphens_count": 0,
    "username_digits_count": 4,
    "username_letters_count": 4,
    "domain": "yopmail.com",
    "root_domain": "yopmail.com",
    "subdomain": "",
    "tld": "com",
    "valid_tld": true,
    "public_domain": true,
    "disposable": true,
    "email_forwarder": false,
    "has_a_records": true,
    "has_mx_records": true,
    "has_txt_records": true,
    "has_spf_records": true,
    "spf_qualifier": "fail",
    "spf_strict": true,
    "dmarc_configured": true,
    "dmarc_enforced": true,
    "is_spoofable": false,
    "free_email": false,
    "russian_free_email": false,
    "china_free_email": false,
    "did_you_mean": "",
    "suspicious_domain": false,
    "dirty_words_domain": false,
    "domain_popular": false,
    "risky_tld": false,
    "police_domain": false,
    "government_domain": false,
    "educational_domain": false,
    "student_email": false,
    "should_block": true,
    "score": 0,
    "elapsed_ms": 3
}
```

## Response fields

The fields returned in the JSON response:

- `email` (string): Email address submitted for verification.
- `canonical_email` (string): Returns the canonical form of the email address after normalization (e.g. a.b.c.d@gmail.com → abcd@gmail.com).
- `valid_format` (boolean): Returns true if the email has a valid format.
- `username` (string): Returns the email username (e.g. user1@gmail.com → user1).
- `role_address` (boolean): Returns true if email is a role address, e.g. admin@website.com.
- `system_address` (boolean): Returns true if email is a system-generated address, e.g. mailer-daemon@website.com.
- `noreply_address` (boolean): Returns true if email is a "noreply" address, e.g. no-reply@website.com.
- `suspicious_username` (boolean): Returns true if username is suspicious, e.g. only numbers.
- `dirty_words_username` (boolean): Returns true if username contains "dirty" or bad words.
- `suspicious_email` (boolean): Returns true if the email address is suspicious and involved in signup abuse or spam.
- `email_length` (integer): Returns the total length of the email address, including the @ symbol.
- `username_length` (integer): Returns the length of the email username (the part before @).
- `domain_length` (integer): Returns the length of the email domain (the part after @).
- `username_has_only_digits` (boolean): Returns true if the email username consists only of digits (e.g. 1234567890@gmail.com).
- `username_has_celebrity_name` (boolean): Returns true if the email username contains a celebrity name (e.g. tony.stark1@gmail.com).
- `username_dots_count` (integer): Returns the number of dot (.) characters in the email username.
- `username_underscores_count` (integer): Returns the number of underscore (_) characters in the email username.
- `username_hyphens_count` (integer): Returns the number of hyphen (-) characters in the email username.
- `username_digits_count` (integer): Returns the number of numeric characters in the email username.
- `username_letters_count` (integer): Returns the number of alphabetic characters in the email username.
- `domain` (string): Returns the email domain (e.g. user1@gmail.com → gmail.com).
- `root_domain` (string): Returns the root domain (e.g. gmail.com).
- `subdomain` (string): Returns the subdomain, such as www.
- `tld` (string): Returns the TLD of the domain, such as com.
- `valid_tld` (boolean): Returns true if domain TLD is valid, e.g. .com or .co.uk.
- `public_domain` (boolean): Returns true if domain is public and not internal or reserved.
- `disposable` (boolean): Returns true if email is a disposable or temporary email address.
- `email_forwarder` (boolean): Returns true if the email address is a forwarding address (e.g. from the SimpleLogin service).
- `has_a_records` (boolean): Returns true if domain has DNS A records configured.
- `has_mx_records` (boolean): Returns true if domain has DNS MX records configured.
- `has_txt_records` (boolean): Returns true if domain has DNS TXT records configured.
- `has_spf_records` (boolean): Returns true if domain has DNS SPF records configured.
- `spf_qualifier` (string): Returns the SPF qualifier (e.g. pass, fail, softfail, neutral).
- `spf_strict` (boolean): Returns true if the SPF policy is strictly enforced (i.e. a -all mechanism is present).
- `dmarc_configured` (boolean): Returns true if domain has DNS DMARC records configured.
- `dmarc_enforced` (boolean): Returns true if domain is configured for DMARC and set to an enforcement policy (reject or quarantine).
- `is_spoofable` (boolean): Returns true if the email address is potentially spoofable (e.g. SPF or DMARC are not strictly enforced).
- `free_email` (boolean): Returns true if email is a free email, e.g. gmail.com.
- `russian_free_email` (boolean): Returns true if email is a free Russian email, e.g. mail.ru.
- `china_free_email` (boolean): Returns true if email is a free China email, e.g. 163.com.
- `did_you_mean` (string): Returns the corrected email address, e.g. abc@gmal.com → abc@gmail.com.
- `suspicious_domain` (boolean): Returns true if the domain is suspicious (e.g. known for spam or signup abuse).
- `dirty_words_domain` (boolean): Returns true if domain contains "dirty" or bad words.
- `domain_popular` (boolean): Returns true if domain is a known popular domain.
- `risky_tld` (boolean): Returns true if domain TLD is risky, e.g. .top or .pro.
- `police_domain` (boolean): Returns true if domain is a police-related domain.
- `government_domain` (boolean): Returns true if domain is a government domain, e.g. .gov.
- `educational_domain` (boolean): Returns true if domain is an educational domain, e.g. .edu.
- `student_email` (boolean): Returns true if the email address matches common student email patterns.
- `should_block` (boolean): Returns true if the score is bad (<= 70) and thus it should be blocked.
- `score` (integer): Returns a number between 0 (bad) and 100 (good).
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/eml-insights-api/>

# EML Insights API Reference

Analyze an EML email file: extract and parse headers, sender and recipient details, SPF and DMARC authentication results, URLs, attachments and security signals.

Service details and pricing: [EML Insights API](https://www.apivoid.com/api/eml-insights/)

Endpoint: `POST https://api.apivoid.com/v2/eml-insights`

Credit cost: 2 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/eml-insights" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"eml_base64": "RW5jb2RlIGFuZCBkZWNv..."}'
```

The same request in PHP:

```php
$emlBase64 = 'RW5jb2RlIGFuZCBkZWNv...';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/eml-insights');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['eml_base64' => $emlBase64]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `eml_base64` (string; Required): Base64-encoded EML file content (max 5 MB).

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "metadata": {
        "message_id": "03302025091220980F708C98$443242D40E@hmlca.com",
        "message_sha256_hash": "cd4e43afb13eef0e381d814ef1ac9d7d91086227131d69477d285d37d411e11b",
        "date_time": "Thu, 04 Sep 2025 03:19:11 +0000 (UTC)",
        "date_time_normalized": "2025-09-04T03:19:11Z"
    },
    "headers": {
        "subject": "Attention: Access Re-activation \"receiver@gmail.com\": 03 September 2025",
        "from_name": "Gmail Message Center",
        "from_email": "rachelle@hmlca.com",
        "return_path": "bounces+45627169-2aff-receiver=gmail.com@em8374.hmlca.com",
        "reply_to": "",
        "delivered_to": "receiver@gmail.com",
        "to": [
            "receiver@gmail.com"
        ],
        "cc": [],
        "bcc": [],
        "content_type": "multipart/alternative",
        "user_agent": "",
        "x_mailer": "",
        "x_library": "",
        "list_unsubscribe": [],
        "received_spf": "pass (google.com: domain of bounces+45627169-2aff-receiver=gmail.com@em8374.hmlca.com designates 50.31.49.42 as permitted sender) client-ip=50.31.49.42;",
        "authentication_results": "mx.google.com; dkim=pass header.i=@hmlca.com header.s=s1 header.b=ZODWUU6W; dkim=pass header.i=@sendgrid.info header.s=smtpapi header.b=TObU1x+p; spf=pass (google.com: domain of bounces+45627169-2aff-receiver=gmail.com@em8374.hmlca.com designates 50.31.49.42 as permitted sender) smtp.mailfrom=\"bounces+45627169-2aff-receiver=gmail.com@em8374.hmlca.com\"",
        "dkim_signatures": [
            {
                "signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=hmlca.com; h=from:subject:content-type:mime-version:date:to:cc:content-type:date: feedback-id:from:subject:to; s=s1; bh=HJ8h3pw+by1D2B7wJ1CO124/fwcuPkzoSMMdSbprGHM=; b=ZODWUU6WGZ+c6NCsyBNIceOX8FH62ZNR8yKgIPKq7O/Qm154ukSRXGy5FHkMeASDXN60 1LOg0VRKKBYXQmtgFTt1a1UFmr5KDE8dK9qLII5iRJ2lyQ7xhVy4qEF3csuCkHO63Uhv3M VEcP8kojPTtQDEC+3p3iIhS6aXOAz4YJ6rSPZga1KyJ/OF9rCBaq925JdAGZw2cnyORkhA ZlWoQIosQI7mIimf28Lj9idAPXXaCIJaf0CeG0/sAfTEexTHm7QrE3kUxZmoKTwyfUB824 QZV2a0YuIu4dKC9mLDkS7sRs+pcAk9dhsRMrUp33JUREhFKBvh9flfVDL4Rx+ocA==",
                "selector": "s1",
                "domain": "hmlca.com",
                "algo": "rsa-sha256",
                "key_type": "rsa",
                "canon": "relaxed/relaxed",
                "hash": "HJ8h3pw+by1D2B7wJ1CO124/fwcuPkzoSMMdSbprGHM=",
                "key_bits": 2048,
                "dnssec": false
            },
            {
                "signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=sendgrid.info; h=from:subject:content-type:mime-version:date:to:cc:content-type:date: feedback-id:from:subject:to; s=smtpapi; bh=HJ8h3pw+by1D2B7wJ1CO124/fwcuPkzoSMMdSbprGHM=; b=TObU1x+puLv0hicu+Mpsh0MdJOZZ53xPGSytO8RVzZxUkCerEHT7xodzIiwjVTeDiFZ8 AU09HqWfE+Czdox4CpFTB0qBd0xENHcM0rS3P2SQbgWKWA2vaZ6dMm2MIAZVxOf49T20Zf vwSCIPHuPqV/dF2mTM7reRxF11XJP6428=",
                "selector": "smtpapi",
                "domain": "sendgrid.info",
                "algo": "rsa-sha256",
                "key_type": "rsa",
                "canon": "relaxed/relaxed",
                "hash": "HJ8h3pw+by1D2B7wJ1CO124/fwcuPkzoSMMdSbprGHM=",
                "key_bits": 1024,
                "dnssec": false
            }
        ]
    },
    "body": {
        "body_text": "Webmail\n\nDear User, receiver@gmail.com\n\nOur system indicates that your password has expired as part of our regular security maintenance. To continue accessing your webmail account without interruption, please take a moment to verify or update your password.\n\nKeep or Update Password https://u45627169.ct.sendgrid.net/ls/click?upn=u001.ilzQdWVrM538qTJ1Qrct2U7gPpD0uoiQECwlDuMspitwulZl7U-2FY3vakOIItSIS1XybaLMtdZ8kaccaNGzDgJl-2BToMxJ70rUoLmY-2BOC8PLL0c-2BbFqtEXLRZwr1fTYBGE4GK8_s0lTyPdoyuzn-2FJTE9fjR8gd4LnXMu4OKG3YpbxosU77i-2FfG4C2MUtEIoCJlrCv4kYhNLpFkGAbHAHEur7tKY3BDYlNZ-2BPfxo0M8IB5fyCQzRQA3YpmmqcpZY3xE1ZWT8ippFzgvcPAn1RCDWmrJUM-2B-2BMsAKXQT8fMw1snmBQJtoed9kNb8hvoZBHFaP3MV0uwsrhx-2FTGxvGGACZrGEwN6g-3D-3D\n\n© 2025 Gmail Webmail. All rights reserved.\n\nThis email was sent to you as a registered user for Gmail Webmail services."
    },
    "attachments": {
        "files": [
            {
                "name": "invoice.zip",
                "extension": ".zip",
                "is_risky_extension": false,
                "content_type": "application/zip",
                "size": 4042,
                "md5_hash": "d7b44bedb42ca39681c32cda0678af11",
                "is_inline": false,
                "content_id": "",
                "disposition": "attachment",
                "cid_referenced": false,
                "is_document": false,
                "is_archive": true,
                "is_archive_encrypted": false,
                "extracted_files": [
                    {
                        "name": "Invoice_N10092025.bat",
                        "extension": ".bat",
                        "is_risky_extension": true,
                        "is_document": false,
                        "is_archive": false,
                        "is_archive_encrypted": false,
                        "last_modified_at": "2025-10-23T21:57:18Z",
                        "size": 10494,
                        "md5_hash": "10d47269e0872ef218701703722d67d9"
                    }
                ]
            }
        ],
        "file_extensions": [
            ".zip",
            ".bat"
        ],
        "md5_hashes": [
            "d7b44bedb42ca39681c32cda0678af11",
            "10d47269e0872ef218701703722d67d9"
        ]
    },
    "ioc": {
        "urls": {
            "urls": [
                "https://u45627169.ct.sendgrid.net/ls/click?upn=u001.ilzQdWVrM538qTJ1Qrct2U7gPpD0uoiQECwlDuMspitwulZl7U-2FY3vakOIItSIS1XybaLMtdZ8kaccaNGzDgJl-2BToMxJ70rUoLmY-2BOC8PLL0c-2BbFqtEXLRZwr1fTYBGE4GK8_s0lTyPdoyuzn-2FJTE9fjR8gd4LnXMu4OKG3YpbxosU77i-2FfG4C2MUtEIoCJlrCv4kYhNLpFkGAbHAHEur7tKY3BDYlNZ-2BPfxo0M8IB5fyCQzRQA3YpmmqcpZY3xE1ZWT8ippFzgvcPAn1RCDWmrJUM-2B-2BMsAKXQT8fMw1snmBQJtoed9kNb8hvoZBHFaP3MV0uwsrhx-2FTGxvGGACZrGEwN6g-3D-3D",
                "https://u45627169.ct.sendgrid.net/ls/click?upn=u001.ilzQdWVrM538qTJ1Qrct2U7gPpD0uoiQECwlDuMspitwulZl7U-2FY3vakOIItSIS1XybaLMtdZ8kaccaNGzDgJl-2BToMxJ70rUoLmY-2BOC8PLL0c-2BbFqtEXLRZwr1fTYBGEss7q_s0lTyPdoyuzn-2FJTE9fjR8gd4LnXMu4OKG3YpbxosU77i-2FfG4C2MUtEIoCJlrCv4kYhNLpFkGAbHAHEur7tKY3F-2FD5IvO2YiTDo-2FzLySkdPDOf5vAvMnJ-2BOrn7sm3lqiymM-2FOaZ4HgVbc7zC0ofWQJS39zRgu577y715r7QFnLA7WRSM8BjNM9dxCWxewBaVs1C5v32uEs6TuG4yZ4VATsg-3D-3D",
                "https://u45627169.ct.sendgrid.net/wf/open?upn=u001.XFGmjoWdSYLGbF2-2B-2B1O-2F8nE80NrNtyU8ZMdTu2BP-2FZRTyD4PEuraAR9MERxO5qS-2FDx2o-2BBEM7SMpl99PzpPvLgvkmWCq7tYo8dnfKyMkLo-2Bhe8sfZ34j-2BF6DXfFpV8wMX6JIvbuqLpoS8iahL-2FvGO7bSCoH37gpRuT1HchqBaZKb3tBsuZKMPEr4fLjwpt7USWnFswkKA8yfCAOlSCsitDkvS411Nmxy1dzGYibBxNY-3D"
            ],
            "redirects": [
                "https://vvtrt.b-cdn.net/cubggg%20(2)%20-%20Copy.html"
            ],
            "direct_downloads": [],
            "with_ip_host": [],
            "domains": [
                "u45627169.ct.sendgrid.net",
                "vvtrt.b-cdn.net"
            ],
            "root_domains": [
                "sendgrid.net",
                "b-cdn.net"
            ],
            "tlds": [
                "net"
            ]
        },
        "emails": {
            "emails": [
                "receiver@gmail.com",
                "rachelle@hmlca.com"
            ],
            "domains": [
                "gmail.com",
                "hmlca.com"
            ],
            "root_domains": [
                "gmail.com",
                "hmlca.com"
            ],
            "tlds": [
                "com"
            ]
        },
        "received_from": {
            "domains": [
                "s.pnkfpknx.outbound-mail.sendgrid.net",
                "mx.google.com",
                "whm002.searchcontrol.com"
            ],
            "root_domains": [
                "sendgrid.net",
                "google.com",
                "searchcontrol.com"
            ],
            "tlds": [
                "net",
                "com"
            ]
        },
        "dkim_domains": {
            "domains": [
                "hmlca.com",
                "sendgrid.info"
            ],
            "root_domains": [
                "hmlca.com",
                "sendgrid.info"
            ],
            "tlds": [
                "com",
                "info"
            ]
        },
        "bitcoin_addresses": [],
        "phone_numbers": []
    },
    "sender_details": {
        "email": "rachelle@hmlca.com",
        "domain": "hmlca.com",
        "root_domain": "hmlca.com",
        "tld": "com",
        "ip_address": "50.31.49.42",
        "hostname": "s.pnkfpknx.outbound-mail.sendgrid.net",
        "hostname_root_domain": "sendgrid.net",
        "hostname_tld": "net",
        "helo": "",
        "helo_root_domain": "",
        "helo_tld": ""
    },
    "security_details": {
        "spf_status": "pass",
        "dkim_status": "pass",
        "dmarc_status": "",
        "compauth_status": "",
        "dara_status": "",
        "tls_status": "",
        "dmarc_policy": "",
        "dmarc_subdomain_policy": "",
        "dmarc_disposition": "",
        "total_to_emails": 1,
        "total_cc_emails": 0,
        "total_bcc_emails": 0,
        "is_mime_html_only": false,
        "has_undisclosed_recipients": false,
        "is_detected_by_server_antispam": false,
        "sender_is_recipient": false,
        "sender_and_reply_to_different_domain": false,
        "sender_and_reply_to_different_email": false,
        "sender_and_message_id_mismatch": false,
        "sender_rdns_empty": false,
        "reply_to_free_email": false,
        "has_unsubscribe_link": false,
        "high_value_money_found": false,
        "has_urls_with_ip_host": false,
        "is_body_text_empty": false,
        "sent_outside_business_hours": true,
        "sent_on_night_hours": true,
        "sent_at_time": "3:19 AM",
        "total_attachments": 1,
        "has_risky_file_extensions": true,
        "has_document_files": false,
        "has_archive_files": true,
        "has_encrypted_archive_files": false,
        "urgency": "high"
    },
    "elapsed_ms": 551
}
```

## Response fields

The fields returned in the JSON response:

- `metadata → message_id` (string): Message-ID header of the email.
- `metadata → message_sha256_hash` (string): SHA-256 hash of the email message.
- `metadata → date_time` (string): Date header of the email as found in the message.
- `metadata → date_time_normalized` (string): Date of the email normalized to ISO 8601 UTC format.
- `headers → subject` (string): Subject of the email.
- `headers → from_name` (string): Display name of the sender.
- `headers → from_email` (string): Email address of the sender.
- `headers → return_path` (string): Return-Path header of the email.
- `headers → reply_to` (string): Reply-To header of the email.
- `headers → delivered_to` (string): Delivered-To header of the email.
- `headers → to` (array): List of recipient email addresses in the To header.
- `headers → cc` (array): List of recipient email addresses in the Cc header.
- `headers → bcc` (array): List of recipient email addresses in the Bcc header.
- `headers → content_type` (string): Content-Type of the email, e.g. multipart/alternative.
- `headers → user_agent` (string): User-Agent header of the email client, if present.
- `headers → x_mailer` (string): X-Mailer header of the email client, if present.
- `headers → x_library` (string): X-Library header identifying the sending library, if present.
- `headers → list_unsubscribe` (array): List-Unsubscribe URLs or email addresses, if present.
- `headers → received_spf` (string): Received-SPF header with the SPF evaluation result.
- `headers → authentication_results` (string): Authentication-Results header with SPF, DKIM and DMARC results.
- `headers → dkim_signatures` (array): DKIM signatures found in the email headers.
- `headers → dkim_signatures[n] → signature` (string): Raw DKIM-Signature header value.
- `headers → dkim_signatures[n] → selector` (string): DKIM selector used by the signature (s= tag).
- `headers → dkim_signatures[n] → domain` (string): Domain that signed the email (d= tag).
- `headers → dkim_signatures[n] → algo` (string): Signing algorithm, e.g. rsa-sha256.
- `headers → dkim_signatures[n] → key_type` (string): Key type of the signature, e.g. rsa.
- `headers → dkim_signatures[n] → canon` (string): Canonicalization method, e.g. relaxed/relaxed.
- `headers → dkim_signatures[n] → hash` (string): Body hash of the signature (bh= tag).
- `headers → dkim_signatures[n] → key_bits` (integer): Size of the signing key in bits.
- `headers → dkim_signatures[n] → dnssec` (boolean): Returns true if the DKIM DNS record is protected by DNSSEC.
- `body → body_text` (string): Plain text content of the email body.
- `attachments → files` (array): List of files attached to the email.
- `attachments → files[n] → name` (string): File name of the attachment.
- `attachments → files[n] → extension` (string): File extension of the attachment.
- `attachments → files[n] → is_risky_extension` (boolean): Returns true if the file extension is considered risky.
- `attachments → files[n] → content_type` (string): MIME content type of the attachment.
- `attachments → files[n] → size` (integer): File size of the attachment in bytes.
- `attachments → files[n] → md5_hash` (string): MD5 hash of the attachment.
- `attachments → files[n] → is_inline` (boolean): Returns true if the attachment is inline (e.g. embedded image).
- `attachments → files[n] → content_id` (string): Content-ID of the attachment, if present.
- `attachments → files[n] → disposition` (string): Content disposition of the attachment, e.g. attachment, inline.
- `attachments → files[n] → cid_referenced` (boolean): Returns true if the attachment Content-ID is referenced in the email body.
- `attachments → files[n] → is_document` (boolean): Returns true if the attachment is a document file.
- `attachments → files[n] → is_archive` (boolean): Returns true if the attachment is an archive file.
- `attachments → files[n] → is_archive_encrypted` (boolean): Returns true if the attachment is a password-protected archive.
- `attachments → files[n] → extracted_files` (array): Files extracted from the archive, with name, extension, size, md5_hash and risk flags.
- `attachments → files[n] → extracted_files[n] → name` (string): File name of the file extracted from the archive.
- `attachments → files[n] → extracted_files[n] → extension` (string): File extension of the extracted file, e.g. .bat.
- `attachments → files[n] → extracted_files[n] → is_risky_extension` (boolean): Returns true if the extracted file has a commonly abused extension (e.g. .bat, .exe, .js).
- `attachments → files[n] → extracted_files[n] → is_document` (boolean): Returns true if the extracted file is a document (e.g. PDF or Office file).
- `attachments → files[n] → extracted_files[n] → is_archive` (boolean): Returns true if the extracted file is itself an archive.
- `attachments → files[n] → extracted_files[n] → is_archive_encrypted` (boolean): Returns true if the extracted archive is password-protected.
- `attachments → files[n] → extracted_files[n] → last_modified_at` (string): Last modified timestamp of the extracted file (UTC).
- `attachments → files[n] → extracted_files[n] → size` (integer): Size of the extracted file, in bytes.
- `attachments → files[n] → extracted_files[n] → md5_hash` (string): MD5 hash of the extracted file.
- `attachments → file_extensions` (array): List of unique file extensions found in the attachments.
- `attachments → md5_hashes` (array): List of MD5 hashes of the attachments.
- `ioc → urls → urls` (array): URLs found in the email body.
- `ioc → urls → redirects` (array): URLs identified as redirects.
- `ioc → urls → direct_downloads` (array): URLs identified as direct file downloads.
- `ioc → urls → with_ip_host` (array): URLs that use an IP address as host.
- `ioc → urls → domains` (array): Domains extracted from the URLs found.
- `ioc → urls → root_domains` (array): Root domains extracted from the URLs found.
- `ioc → urls → tlds` (array): TLDs extracted from the URLs found.
- `ioc → emails → emails` (array): Email addresses found in the email.
- `ioc → emails → domains` (array): Domains extracted from the email addresses found.
- `ioc → emails → root_domains` (array): Root domains extracted from the email addresses found.
- `ioc → emails → tlds` (array): TLDs extracted from the email addresses found.
- `ioc → received_from → domains` (array): Domains found in the Received headers.
- `ioc → received_from → root_domains` (array): Root domains found in the Received headers.
- `ioc → received_from → tlds` (array): TLDs found in the Received headers.
- `ioc → dkim_domains → domains` (array): Domains found in the DKIM signatures.
- `ioc → dkim_domains → root_domains` (array): Root domains found in the DKIM signatures.
- `ioc → dkim_domains → tlds` (array): TLDs found in the DKIM signatures.
- `ioc → bitcoin_addresses` (array): Bitcoin addresses found in the email.
- `ioc → phone_numbers` (array): Phone numbers found in the email.
- `sender_details → email` (string): Email address of the sender.
- `sender_details → domain` (string): Domain of the sender email address.
- `sender_details → root_domain` (string): Root domain of the sender email address.
- `sender_details → tld` (string): TLD of the sender email address.
- `sender_details → ip_address` (string): IP address of the sending mail server.
- `sender_details → hostname` (string): Hostname (reverse DNS) of the sending mail server.
- `sender_details → hostname_root_domain` (string): Root domain of the sending mail server hostname.
- `sender_details → hostname_tld` (string): TLD of the sending mail server hostname.
- `sender_details → helo` (string): HELO/EHLO identity used by the sending mail server.
- `sender_details → helo_root_domain` (string): Root domain of the HELO identity.
- `sender_details → helo_tld` (string): TLD of the HELO identity.
- `security_details → spf_status` (string): SPF evaluation result, e.g. pass, fail, softfail, none.
- `security_details → dkim_status` (string): DKIM evaluation result, e.g. pass, fail, none.
- `security_details → dmarc_status` (string): DMARC evaluation result, e.g. pass, fail, none.
- `security_details → compauth_status` (string): Microsoft composite authentication result, if present.
- `security_details → dara_status` (string): DARA evaluation result, if present.
- `security_details → tls_status` (string): TLS status of the delivery, if reported by the receiving server.
- `security_details → dmarc_policy` (string): DMARC policy of the sender domain, e.g. none, quarantine, reject.
- `security_details → dmarc_subdomain_policy` (string): DMARC subdomain policy of the sender domain.
- `security_details → dmarc_disposition` (string): DMARC disposition applied to the message.
- `security_details → total_to_emails` (integer): Number of recipients in the To header.
- `security_details → total_cc_emails` (integer): Number of recipients in the Cc header.
- `security_details → total_bcc_emails` (integer): Number of recipients in the Bcc header.
- `security_details → is_mime_html_only` (boolean): Returns true if the email body is HTML only, without a plain text part.
- `security_details → has_undisclosed_recipients` (boolean): Returns true if recipients are undisclosed.
- `security_details → is_detected_by_server_antispam` (boolean): Returns true if the receiving server anti-spam flagged the email.
- `security_details → sender_is_recipient` (boolean): Returns true if the sender is also a recipient of the email.
- `security_details → sender_and_reply_to_different_domain` (boolean): Returns true if sender and Reply-To use different domains.
- `security_details → sender_and_reply_to_different_email` (boolean): Returns true if sender and Reply-To use different email addresses.
- `security_details → sender_and_message_id_mismatch` (boolean): Returns true if the sender domain does not match the Message-ID domain.
- `security_details → sender_rdns_empty` (boolean): Returns true if the sending mail server has no reverse DNS.
- `security_details → reply_to_free_email` (boolean): Returns true if the Reply-To address uses a free email provider.
- `security_details → has_unsubscribe_link` (boolean): Returns true if the email contains an unsubscribe link.
- `security_details → high_value_money_found` (boolean): Returns true if high-value money amounts are mentioned in the email.
- `security_details → has_urls_with_ip_host` (boolean): Returns true if the email contains URLs with an IP address as host.
- `security_details → is_body_text_empty` (boolean): Returns true if the email body text is empty.
- `security_details → sent_outside_business_hours` (boolean): Returns true if the email was sent outside typical business hours.
- `security_details → sent_on_night_hours` (boolean): Returns true if the email was sent during night hours.
- `security_details → sent_at_time` (string): Time of day the email was sent, e.g. morning, afternoon, night.
- `security_details → total_attachments` (integer): Number of attachments found in the email.
- `security_details → has_risky_file_extensions` (boolean): Returns true if attachments with risky file extensions are found.
- `security_details → has_document_files` (boolean): Returns true if document attachments are found.
- `security_details → has_archive_files` (boolean): Returns true if archive attachments are found.
- `security_details → has_encrypted_archive_files` (boolean): Returns true if password-protected archive attachments are found.
- `security_details → urgency` (string): Urgency level detected from the email content, e.g. low, medium, high.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/geo-request-api/>

# Geo Request API Reference

Perform an HTTP request to a URL from multiple geographic locations (such as Canada and Germany) and get the response details for each country.

Service details and pricing: [Geo Request API](https://www.apivoid.com/api/geo-request/)

Endpoint: `POST https://api.apivoid.com/v2/geo-request`

Credit cost: 5 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/geo-request" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"url": "https://www.yahoo.com/"}'
```

The same request in PHP:

```php
$url = 'https://www.yahoo.com/';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/geo-request');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['url' => $url]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `url` (string; Required): URL to submit, e.g. `https://www.yahoo.com/`. Note: ⚠ Government and educational domains are blocked.

### Optional

- `use_ipv6` (boolean; Default: false): Set to true to use IPv6 for web requests.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "url": "https://www.yahoo.com/",
    "locations": [
        {
            "continent_code": "NA",
            "continent_name": "North America",
            "country_code": "CA",
            "country_name": "Canada",
            "city_name": "Toronto",
            "request_output": {
                "status_code": 302,
                "status_message": "302 Found",
                "response_headers": {
                    "age": [
                        "0"
                    ],
                    "cache-control": [
                        "no-store"
                    ],
                    "connection": [
                        "keep-alive"
                    ],
                    "content-language": [
                        "en"
                    ],
                    "content-length": [
                        "17"
                    ],
                    "content-security-policy": [
                        "frame-ancestors 'self' https://*.builtbygirls.com https://*.rivals.com https://*.engadget.com https://*.intheknow.com https://*.autoblog.com https://*.techcrunch.com https://*.yahoo.com https://*.aol.com https://*.huffingtonpost.com https://*.oath.com https://*.search.yahoo.com https://*.pnr.ouryahoo.com https://pnr.ouryahoo.com https://*.search.aol.com https://*.search.huffpost.com https://*.onesearch.com https://*.verizonmedia.com https://*.publishing.oath.com https://*.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=2a1aachkl2j7m&partner=;"
                    ],
                    "content-type": [
                        "text/html"
                    ],
                    "date": [
                        "Sun, 28 Dec 2025 15:29:58 GMT"
                    ],
                    "location": [
                        "https://ca.yahoo.com/?p=us"
                    ],
                    "referrer-policy": [
                        "no-referrer-when-downgrade"
                    ],
                    "server": [
                        "ATS"
                    ],
                    "set-cookie": [
                        "RRC=st=1766935798.3485&cnt=1; expires=Sun, 28-Dec-2025 15:30:28 GMT; path=/; domain=.www.yahoo.com; HttpOnly"
                    ],
                    "strict-transport-security": [
                        "max-age=31536000"
                    ],
                    "x-content-type-options": [
                        "nosniff"
                    ],
                    "x-frame-options": [
                        "SAMEORIGIN"
                    ],
                    "x-xss-protection": [
                        "1; mode=block"
                    ]
                },
                "redirects_to": "https://ca.yahoo.com/?p=us",
                "timings": {
                    "dns_ms": 2,
                    "connect_ms": 6,
                    "tls_ms": 6,
                    "ttfb_ms": 37,
                    "total_ms": 52
                },
                "remote_addr": "66.218.84.42",
                "network": "tcp4",
                "http_version": "HTTP/1.1",
                "tls_version": "TLS1.3",
                "cipher_suite": "TLS_AES_128_GCM_SHA256",
                "error_message": "",
                "elapsed_ms": 91
            },
            "error": ""
        },
        {
            "continent_code": "EU",
            "continent_name": "Europe",
            "country_code": "DE",
            "country_name": "Germany",
            "city_name": "Frankfurt",
            "request_output": {
                "status_code": 302,
                "status_message": "302 Found",
                "response_headers": {
                    "age": [
                        "0"
                    ],
                    "cache-control": [
                        "no-store"
                    ],
                    "connection": [
                        "keep-alive"
                    ],
                    "content-language": [
                        "en"
                    ],
                    "content-length": [
                        "17"
                    ],
                    "content-security-policy": [
                        "frame-ancestors 'self' https://*.builtbygirls.com https://*.rivals.com https://*.engadget.com https://*.intheknow.com https://*.autoblog.com https://*.techcrunch.com https://*.yahoo.com https://*.aol.com https://*.huffingtonpost.com https://*.oath.com https://*.search.yahoo.com https://*.pnr.ouryahoo.com https://pnr.ouryahoo.com https://*.search.aol.com https://*.search.huffpost.com https://*.onesearch.com https://*.verizonmedia.com https://*.publishing.oath.com https://*.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=39iu909kl2j7m&partner=;"
                    ],
                    "content-type": [
                        "text/html"
                    ],
                    "date": [
                        "Sun, 28 Dec 2025 15:29:58 GMT"
                    ],
                    "location": [
                        "https://de.yahoo.com/?p=us"
                    ],
                    "referrer-policy": [
                        "no-referrer-when-downgrade"
                    ],
                    "server": [
                        "ATS"
                    ],
                    "set-cookie": [
                        "RRC=st=1766935798.5121&cnt=1; expires=Sun, 28-Dec-2025 15:30:28 GMT; path=/; domain=.www.yahoo.com; HttpOnly"
                    ],
                    "strict-transport-security": [
                        "max-age=31536000"
                    ],
                    "x-content-type-options": [
                        "nosniff"
                    ],
                    "x-frame-options": [
                        "SAMEORIGIN"
                    ],
                    "x-xss-protection": [
                        "1; mode=block"
                    ]
                },
                "redirects_to": "https://de.yahoo.com/?p=us",
                "timings": {
                    "dns_ms": 6,
                    "connect_ms": 1,
                    "tls_ms": 8,
                    "ttfb_ms": 89,
                    "total_ms": 100
                },
                "remote_addr": "87.248.119.252",
                "network": "tcp4",
                "http_version": "HTTP/1.1",
                "tls_version": "TLS1.3",
                "cipher_suite": "TLS_AES_128_GCM_SHA256",
                "error_message": "",
                "elapsed_ms": 100
            },
            "error": ""
        },
        ...
    ],
    "elapsed_ms": 1223
}
```

## Response fields

The fields returned in the JSON response:

- `url` (string): URL submitted for the geo request.
- `locations` (array): List of geographic locations with the HTTP request output from each location.
- `locations[n] → continent_code` (string): Continent code (e.g. NA) of the requesting location.
- `locations[n] → continent_name` (string): Continent name of the requesting location.
- `locations[n] → country_code` (string): Country code (e.g. US) of the requesting location.
- `locations[n] → country_name` (string): Country name of the requesting location.
- `locations[n] → city_name` (string): City name of the requesting location.
- `locations[n] → request_output → status_code` (integer): HTTP status code returned by the server.
- `locations[n] → request_output → status_message` (string): HTTP status message returned by the server, e.g. 302 Found.
- `locations[n] → request_output → response_headers` (object): HTTP response headers returned by the server, keyed by lowercase header name.
- `locations[n] → request_output → redirects_to` (string): URL the server redirects to, if any.
- `locations[n] → request_output → timings → dns_ms` (integer): Time spent on DNS resolution in milliseconds.
- `locations[n] → request_output → timings → connect_ms` (integer): Time spent on TCP connection in milliseconds.
- `locations[n] → request_output → timings → tls_ms` (integer): Time spent on TLS handshake in milliseconds.
- `locations[n] → request_output → timings → ttfb_ms` (integer): Time to first byte in milliseconds.
- `locations[n] → request_output → timings → total_ms` (integer): Total request time in milliseconds.
- `locations[n] → request_output → remote_addr` (string): IP address of the server that handled the request.
- `locations[n] → request_output → network` (string): Network protocol used for the connection, e.g. tcp.
- `locations[n] → request_output → http_version` (string): HTTP version used for the request, e.g. HTTP/2.0.
- `locations[n] → request_output → tls_version` (string): TLS version used for the connection, e.g. TLS 1.3.
- `locations[n] → request_output → cipher_suite` (string): TLS cipher suite used for the connection.
- `locations[n] → request_output → elapsed_ms` (integer): Time taken by the request from this location, in milliseconds.
- `locations[n] → request_output → error_message` (string): Error message if the request from this location failed.
- `locations[n] → error` (string): Error message if the check from this location could not be performed.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/html-to-pdf-api/>

# HTML to PDF API Reference

Convert custom HTML code, such as an invoice or a newsletter template, into a PDF.

Service details and pricing: [HTML to PDF API](https://www.apivoid.com/api/html-to-pdf/)

Endpoint: `POST https://api.apivoid.com/v2/html-to-pdf`

Credit cost: 20 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/html-to-pdf" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"html_base64": "PGh0bWw+PGJvZHk+PGgxPlRlc3RpbmcgSFRNTCB0byBQREYgQVBJPC9oMT48L2JvZHk+PC9odG1sPg=="}'
```

The same request in PHP:

```php
$html = '<html><body><h1>Testing</h1><p>Example text...</p></body></html>';
$htmlBase64 = base64_encode($html);

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/html-to-pdf');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['html_base64' => $htmlBase64]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);

    // Save the "base64_file" data as PDF file
    if (isset($responseData['rendered_file']['base64_file'])) {
        $saveAs = __DIR__ . '/document.pdf';

        file_put_contents($saveAs, base64_decode($responseData['rendered_file']['base64_file']));

        if (file_exists($saveAs)) {
            echo '<p>File document.pdf saved successfully!</p>';
        } else {
            echo '<p>Failed to create document.pdf file.</p>';
        }
    }
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `html_base64` (string; Required): HTML data encoded in base64.

### Optional

- `pdf_papersize_width` (integer; Default: 0): Change PDF paper width in pixels (max 5000).
- `pdf_papersize_height` (integer; Default: 0): Change PDF paper height in pixels (max 10000).
- `pdf_format` (string; Default: A4): Change PDF format, can be Letter, Legal, Tabloid, Ledger, A0, A1, A2, A3, A4, A5, A6.
- `pdf_margin` (integer; Default: 0): Change PDF margin.
- `pdf_show_background` (boolean; Default: true): Show the background of the web page.
- `pdf_landscape` (boolean; Default: false): Change the PDF orientation to landscape.
- `pdf_page_ranges` (string): Select page ranges, can be 1 or 1-3 (for example).
- `pdf_scale` (float): Scale the PDF, must be between 0.1 and 2.
- `pdf_one_page` (boolean; Default: false): Try to fit the web page into a single PDF page.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "rendered_file": {
        "format": "PDF",
        "date_time_utc": "2024-11-29 19:05:01",
        "base64_file": "JVBERi0xLjcKJeLjz9MKMSAwIG9iago8PC9UeXBlL0NhdGFsb2cvUGFnZXMgMiAwIFI+PgplbmRvYmoKMiAwIG9iago8PC9U...",
        "file_size_readable": "14.73 KB",
        "file_size_bytes": 15080
    },
    "elapsed_ms": 5485
}
```

## Response fields

The fields returned in the JSON response:

- `rendered_file → format` (string): Format of the rendered file, e.g. PDF.
- `rendered_file → date_time_utc` (string): Date and time (UTC) of when the file was rendered.
- `rendered_file → base64_file` (string): The rendered PDF file encoded in base64.
- `rendered_file → file_size_readable` (string): File size in human-readable format, e.g. 14.73 KB.
- `rendered_file → file_size_bytes` (integer): File size in bytes.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/html-to-png-api/>

# HTML to PNG API Reference

Convert custom HTML code into a PNG image rendered by a real browser.

Service details and pricing: [HTML to PNG API](https://www.apivoid.com/api/html-to-png/)

Endpoint: `POST https://api.apivoid.com/v2/html-to-png`

Credit cost: 20 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/html-to-png" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"html_base64": "PGh0bWw+PGJvZHk+PGgxPlRlc3RpbmcgSFRNTCB0byBQTkcgQVBJPC9oMT48L2JvZHk+PC9odG1sPg=="}'
```

The same request in PHP:

```php
$html = '<html><body><h1>Testing</h1><p>Example text...</p></body></html>';
$htmlBase64 = base64_encode($html);

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/html-to-png');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['html_base64' => $htmlBase64]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);

    // Save the "base64_file" data as PNG file
    if (isset($responseData['rendered_file']['base64_file'])) {
        $saveAs = __DIR__ . '/screenshot.png';

        file_put_contents($saveAs, base64_decode($responseData['rendered_file']['base64_file']));

        if (file_exists($saveAs)) {
            echo '<p><img src="screenshot.png" alt="screenshot" class="img-responsive" /></p>';
        } else {
            echo '<p>Failed to create screenshot.png file.</p>';
        }
    }
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `html_base64` (string; Required): HTML data encoded in base64.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "rendered_file": {
        "format": "PNG",
        "date_time_utc": "2024-11-29 19:05:01",
        "base64_file": "iVBORw0KGgoAAAANSUhEUgAAB4AAAAQ4CAIAAABnsVYUAAAAAXNSR0IArs4c6QAAIABJREFUeJzs3WmYVOWd8OFqa...",
        "image_width": 1920,
        "image_height": 1080,
        "file_size_readable": "14.73 KB",
        "file_size_bytes": 15080
    },
    "elapsed_ms": 5485
}
```

## Response fields

The fields returned in the JSON response:

- `rendered_file → format` (string): Format of the rendered file, e.g. PNG.
- `rendered_file → date_time_utc` (string): Date and time (UTC) of when the file was rendered.
- `rendered_file → base64_file` (string): The rendered PNG image encoded in base64.
- `rendered_file → image_width` (integer): Width of the rendered image in pixels.
- `rendered_file → image_height` (integer): Height of the rendered image in pixels.
- `rendered_file → file_size_readable` (string): File size in human-readable format, e.g. 14.73 KB.
- `rendered_file → file_size_bytes` (integer): File size in bytes.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/http-tracker-api/>

# HTTP Tracker API Reference

Track all HTTP requests made by a URL when loaded in a real browser: requests to third-party domains, IP addresses contacted, and response details.

Service details and pricing: [HTTP Tracker API](https://www.apivoid.com/api/http-tracker/)

Endpoint: `POST https://api.apivoid.com/v2/http-tracker`

Credit cost: 20 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/http-tracker" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"url": "https://www.apivoid.com/"}'
```

The same request in PHP:

```php
$url = 'https://www.apivoid.com/';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/http-tracker');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['url' => $url]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `url` (string; Required): URL to submit, e.g. `https://www.apivoid.com/`. Note: ⚠ Government and educational domains are blocked.

### Optional

- `user_agent` (string; Default: desktop): Can be `desktop` (default, a random desktop user agent) or `mobile`.
- `accept_language` (string; Default: en-US): Change the Accept-Language HTTP header, format like `en-US`.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "url": "https://www.apivoid.com/",
    "http_requests": [
        {
            "url": "https://www.apivoid.com/",
            "status_code": 200,
            "content_type": "text/html",
            "content_length": 30266,
            "elapsed_ms": 199,
            "ip_address": "159.69.124.48"
        },
        {
            "url": "https://www.apivoid.com/styles/main.css",
            "status_code": 200,
            "content_type": "text/css",
            "content_length": 192605,
            "elapsed_ms": 87,
            "ip_address": "159.69.124.48"
        },
        {
            "url": "https://www.apivoid.com/images/email-support.png",
            "status_code": 200,
            "content_type": "image/png",
            "content_length": 867,
            "elapsed_ms": 100,
            "ip_address": "159.69.124.48"
        },
        {
            "url": "https://www.apivoid.com/scripts/jquery-3.1.1.min.js",
            "status_code": 200,
            "content_type": "application/javascript",
            "content_length": 86709,
            "elapsed_ms": 107,
            "ip_address": "159.69.124.48"
        },
        {
            "url": "https://cdnjs.cloudflare.com/ajax/libs/flag-icon-css/3.5.0/css/flag-icon.min.css",
            "status_code": 200,
            "content_type": "text/css",
            "content_length": 1482,
            "elapsed_ms": 157,
            "ip_address": "104.17.25.14"
        },
        {
            "url": "https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css",
            "status_code": 200,
            "content_type": "text/css",
            "content_length": 31000,
            "elapsed_ms": 172,
            "ip_address": "104.18.11.207"
        },
        ...
    ],
    "hosts_list": [
        "cdn.usefathom.com",
        "cdnjs.cloudflare.com",
        "fonts.googleapis.com",
        "maxcdn.bootstrapcdn.com",
        "www.apivoid.com",
        "www.google.com",
        "www.gstatic.com"
    ],
    "ips_list": [
        "104.17.25.14",
        "104.18.11.207",
        "142.250.185.227",
        "142.250.185.74",
        "142.250.186.164",
        "159.69.124.48",
        "169.150.247.37"
    ],
    "stats": {
        "total_requests": 27,
        "unsecure_requests": 0,
        "same_origin_requests": 16,
        "cross_origin_requests": 11,
        "unique_hosts": 7,
        "external_hosts": 6,
        "unique_ips": 7,
        "2xx_status_codes": 27,
        "3xx_status_codes": 0,
        "4xx_status_codes": 0,
        "5xx_status_codes": 0,
        "transferred_bytes": 926446,
        "html_files": 1,
        "html_files_bytes": 30266,
        "image_files": 8,
        "image_files_bytes": 63463,
        "javascript_files": 11,
        "javascript_files_bytes": 525055,
        "css_files": 5,
        "css_files_bytes": 230459,
        "font_files": 1,
        "font_files_bytes": 77160
    },
    "elapsed_ms": 1828
}
```

## Response fields

The fields returned in the JSON response:

- `url` (string): URL submitted for HTTP requests tracking.
- `http_requests` (array): List of HTTP requests made while loading the page.
- `http_requests[n] → url` (string): URL of the requested resource.
- `http_requests[n] → status_code` (integer): HTTP status code returned for the request.
- `http_requests[n] → content_type` (string): Content type of the requested resource, e.g. text/html.
- `http_requests[n] → content_length` (integer): Size of the requested resource in bytes.
- `http_requests[n] → elapsed_ms` (integer): Time taken by the request in milliseconds.
- `http_requests[n] → ip_address` (string): IP address of the server that served the resource.
- `hosts_list` (array): List of unique hosts contacted while loading the page.
- `ips_list` (array): List of unique IP addresses contacted while loading the page.
- `stats → total_requests` (integer): Total number of HTTP requests made.
- `stats → unsecure_requests` (integer): Number of requests made over unsecure HTTP.
- `stats → same_origin_requests` (integer): Number of requests made to the same origin.
- `stats → cross_origin_requests` (integer): Number of requests made to a different origin.
- `stats → unique_hosts` (integer): Number of unique hosts contacted.
- `stats → external_hosts` (integer): Number of external hosts contacted.
- `stats → unique_ips` (integer): Number of unique IP addresses contacted.
- `stats → 2xx_status_codes` (integer): Number of requests that returned a 2xx status code.
- `stats → 3xx_status_codes` (integer): Number of requests that returned a 3xx status code.
- `stats → 4xx_status_codes` (integer): Number of requests that returned a 4xx status code.
- `stats → 5xx_status_codes` (integer): Number of requests that returned a 5xx status code.
- `stats → transferred_bytes` (integer): Total bytes transferred while loading the page.
- `stats → html_files` (integer): Number of HTML files loaded.
- `stats → html_files_bytes` (integer): Total bytes of HTML files loaded.
- `stats → image_files` (integer): Number of image files loaded.
- `stats → image_files_bytes` (integer): Total bytes of image files loaded.
- `stats → javascript_files` (integer): Number of JavaScript files loaded.
- `stats → javascript_files_bytes` (integer): Total bytes of JavaScript files loaded.
- `stats → css_files` (integer): Number of CSS files loaded.
- `stats → css_files_bytes` (integer): Total bytes of CSS files loaded.
- `stats → font_files` (integer): Number of font files loaded.
- `stats → font_files_bytes` (integer): Total bytes of font files loaded.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/http3-status-api/>

# HTTP3 Status API Reference

Check if a website supports the HTTP/3 protocol, with details about the negotiated protocol and Alt-Svc header.

Service details and pricing: [HTTP3 Status API](https://www.apivoid.com/api/http3-status/)

Endpoint: `POST https://api.apivoid.com/v2/http3-status`

Credit cost: 1 credit per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/http3-status" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"url": "https://www.google.com/"}'
```

The same request in PHP:

```php
$url = 'https://www.google.com/';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/http3-status');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['url' => $url]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `url` (string; Required): URL to submit, e.g. `https://www.google.com/`.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "url": "https://www.google.com/",
    "status_code": 200,
    "status_message": "OK",
    "http3_supported": true,
    "protocol": "HTTP/3.0",
    "response_headers": {
        "accept-ch": [
            "Sec-CH-Prefers-Color-Scheme"
        ],
        "alt-svc": [
            "h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"
        ],
        "cache-control": [
            "private, max-age=0"
        ],
        "content-security-policy-report-only": [
            "object-src 'none';base-uri 'self';script-src 'nonce-B0aSTNNTysfKPA7d8BAOdA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp"
        ],
        "content-type": [
            "text/html; charset=UTF-8"
        ],
        "cross-origin-opener-policy": [
            "same-origin-allow-popups; report-to=\"gws\""
        ],
        "date": [
            "Fri, 03 Oct 2025 15:35:55 GMT"
        ],
        "expires": [
            "-1"
        ],
        "p3p": [
            "CP=\"This is not a P3P policy! See g.co/p3phelp for more info.\""
        ],
        "report-to": [
            "{\"group\":\"gws\",\"max_age\":2592000,\"endpoints\":[{\"url\":\"https://csp.withgoogle.com/csp/report-to/gws/other\"}]}"
        ],
        "server": [
            "gws"
        ],
        "set-cookie": [
            "AEC=AaJma5uUxjd8HNsGvWJdYQa7DYFnfSWk9yZxU6KnTGd6CMJfoADGMaryeWo; expires=Wed, 01-Apr-2026 15:35:55 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax",
            "NID=525=gXVZloTgRJJTjXftI0Red_LcofkT_At9KtmE4YgmpyUjYPNvkhzIxbkNyH4BYU6u1VSt_z9O6yKXn3XPpctAdAW0mW7tICtkgub0tKrB8WtBhYxt2zAmbnzlkP7EHCms07uFEcSoO1on0i8C9K-cMqd0QvjuBC39u6sp9LCa-i4Eg2EHZmNGeARlKf5vfhqpliVCP6MFi_j7Bn8ND3AkEUg; expires=Sat, 04-Apr-2026 15:35:55 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none"
        ],
        "x-frame-options": [
            "SAMEORIGIN"
        ],
        "x-xss-protection": [
            "0"
        ]
    },
    "alpn_identifiers": [
        "h3",
        "h3-29"
    ],
    "elapsed_ms": 90
}
```

## Response fields

The fields returned in the JSON response:

- `url` (string): URL submitted for the HTTP/3 check.
- `status_code` (integer): HTTP status code returned by the server.
- `status_message` (string): HTTP status message returned by the server, e.g. OK.
- `http3_supported` (boolean): Returns true if the server supports HTTP/3.
- `protocol` (string): HTTP protocol version used for the response, e.g. HTTP/3.0.
- `response_headers` (object): HTTP response headers returned by the server, keyed by lowercase header name.
- `alpn_identifiers` (array): ALPN identifiers advertised by the server, e.g. h3, h3-29.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/ip-reputation-api/>

# IP Reputation API Reference

Check the reputation of an IPv4 or IPv6 address using multiple IP blacklist services, with detection details, risk score and IP information.

Service details and pricing: [IP Reputation API](https://www.apivoid.com/api/ip-reputation/)

Endpoint: `POST https://api.apivoid.com/v2/ip-reputation`

Credit cost: 1 credit per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/ip-reputation" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"ip": "80.82.77.139"}'
```

The same request in PHP:

```php
$ip = '80.82.77.139';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/ip-reputation');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['ip' => $ip]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `ip` (string; Required): Public IPv4 or IPv6 address to scan. Note: ⚠ Private or internal IP addresses (e.g. 127.0.0.1) are not allowed.

### Optional

- `exclude_engines` (string): List of comma-separated engines to exclude, e.g. BlockedServersRBL,NordSpam.
- `spamhaus_key` (string): Your [Spamhaus DBL DQS key](https://www.spamhaus.com/product/data-query-service/), this will enable the Spamhaus engine.
- `disable_reverse_dns` (boolean; Default: false): Disable reverse DNS lookup to reduce the response time.

## Bonus Tip: How to reduce response time

If you require a response in less than 500ms you can use these parameters:

```json
{"ip":"1.2.3.4","disable_reverse_dns":true,"exclude_engines":"0spam,RealtimeBLACKLIST,IBM_Cobion,JustSpam_org,S5hbl,BlockedServersRBL,EFnet_RBL"}
```

This disables the reverse DNS lookup and excludes the engines that are occasionally slow to respond.

This way the response time should always be less than 500ms.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "ip": "80.82.77.139",
    "version": "IPv4",
    "blacklists": {
        "engines": {
            "0": {
                "name": "0spam",
                "detected": false,
                "reference": "https://0spam.org/",
                "elapsed_ms": 0
            },
            "1": {
                "name": "Anti-Attacks BL",
                "detected": false,
                "reference": "https://www.anti-attacks.com/",
                "elapsed_ms": 0
            },
            "2": {
                "name": "AntiSpam_by_CleanTalk",
                "detected": false,
                "reference": "https://cleantalk.org/",
                "elapsed_ms": 0
            },
            "3": {
                "name": "APEWS-L2",
                "detected": false,
                "reference": "http://www.apews.org/",
                "elapsed_ms": 0
            },
            "4": {
                "name": "AZORult Tracker",
                "detected": false,
                "reference": "https://azorult-tracker.net/",
                "elapsed_ms": 0
            },
            "5": {
                "name": "Backscatterer",
                "detected": true,
                "reference": "https://www.backscatterer.org/",
                "elapsed_ms": 0
            },
            "6": {
                "name": "Barracuda_Reputation_BL",
                "detected": false,
                "reference": "https://barracudacentral.org/lookups",
                "elapsed_ms": 0
            },
            "7": {
                "name": "BitNinja",
                "detected": true,
                "reference": "https://bitninja.com/",
                "elapsed_ms": 0
            },
            "8": {
                "name": "BlockedServersRBL",
                "detected": true,
                "reference": "https://www.blockedservers.com/",
                "elapsed_ms": 0
            },
            ...
        },
        "detections": 27,
        "engines_count": 80,
        "detection_rate": "33%",
        "scan_time_ms": 5
    },
    "information": {
        "reverse_dns": "dojo.census.shodan.io",
        "is_eu": true,
        "continent_code": "EU",
        "continent_name": "Europe",
        "country_code": "NL",
        "country_name": "Netherlands (Kingdom of the)",
        "currency": "EUR",
        "currency_name": "Euro",
        "currency_name_plural": "euros",
        "currency_symbol": "€",
        "currency_symbol_native": "€",
        "calling_code": "31",
        "emoji_flag": "🇳🇱",
        "emoji_flag_unicode": "U+1F1F3 U+1F1F1",
        "region_name": "Noord-Holland",
        "city_name": "Amsterdam",
        "latitude": 52.378502,
        "longitude": 4.89998,
        "isp": "FiberXpress BV",
        "asn": "AS202425",
        "is_bogon": false,
        "is_spamhaus_drop": false,
        "is_fake_bot": false,
        "is_google_bot": false,
        "is_search_engine_bot": false,
        "related_service_name": "",
        "related_service_domain": "",
        "related_service_type": "",
        "is_major_provider_spf_ip": false,
        "is_public_dns": false,
        "cloud_provider": "",
        "cloud_provider_domain": "",
        "aws_service": "",
        "is_google_service": false,
        "edge_service": "",
        "edge_service_domain": "",
        "is_satellite": false
    },
    "asn": {
        "asn": "AS202425",
        "asname": "INT-NETWORK",
        "route": "80.82.77.0/24",
        "status": "active",
        "org": "IP Volume inc",
        "country_code": "SC",
        "created": "2018-05-17",
        "days_since_created": 2773,
        "updated": "2024-01-25",
        "days_since_updated": 694,
        "address": "Seychelles",
        "abuse_email": "abuse@ipvolume.net",
        "domain": "ipvolume.net",
        "total_ipv4_prefixes": 55,
        "total_ipv4_ips": 14848,
        "total_ipv6_prefixes": 1,
        "type": "hosting",
        "rir": "RIPE"
    },
    "anonymity": {
        "is_proxy": false,
        "is_webproxy": false,
        "is_residential_proxy": false,
        "is_vpn": false,
        "is_hosting": true,
        "is_relay": false,
        "is_tor": false
    },
    "risk_score": {
        "result": 100
    },
    "elapsed_ms": 98
}
```

## Response fields

The fields returned in the JSON response:

- `ip` (string): IP address submitted for scanning.
- `version` (string): IP version of the submitted address: IPv4 or IPv6.
- `blacklists → engines` (object): List of scanning engines with detection status and reference link.
- `blacklists → engines → [index] → name` (string): Name of the scanning engine.
- `blacklists → engines → [index] → detected` (boolean): Returns true if this engine flagged the submitted IP address.
- `blacklists → engines → [index] → reference` (string): Link to the engine's website or listing details.
- `blacklists → engines → [index] → elapsed_ms` (integer): Time taken by this engine to complete its check, in milliseconds.
- `blacklists → detections` (integer): Number of scanning engines that detected the submitted IP.
- `blacklists → engines_count` (integer): Number of scanning engines used to scan the IP.
- `blacklists → detection_rate` (string): Percentage of engines that detected the IP address, e.g. 33%.
- `blacklists → scan_time_ms` (integer): Time taken to scan the IP address across all engines, in milliseconds.
- `information → reverse_dns` (string): Hostname (reverse DNS) assigned to the IP address.
- `information → is_eu` (boolean): Returns true if the IP address is located in the EU (Europe).
- `information → continent_code` (string): Continent code (e.g. AS) of where the IP address is located.
- `information → continent_name` (string): Continent name (e.g. Asia) of where the IP address is located.
- `information → country_code` (string): Country code (e.g. CN) of where the IP address is located.
- `information → country_name` (string): Country name of where the IP address is located.
- `information → currency` (string): The local currency code (ISO 4217), e.g. EUR.
- `information → currency_name` (string): Name of the currency used in the country, e.g. Euro.
- `information → currency_name_plural` (string): Plural name of the currency, e.g. euros.
- `information → currency_symbol` (string): The symbol of the local currency, e.g. € for Euro.
- `information → currency_symbol_native` (string): Native symbol of the currency, e.g. €.
- `information → calling_code` (string): The international calling code of the country, e.g. 1 for US.
- `information → emoji_flag` (string): The country flag emoji.
- `information → emoji_flag_unicode` (string): The Unicode code points of the country flag emoji.
- `information → region_name` (string): The region or state associated with the IP.
- `information → city_name` (string): The city associated with the IP.
- `information → latitude` (float): The estimated latitude of the city.
- `information → longitude` (float): The estimated longitude of the city.
- `information → isp` (string): Internet Service Provider (ISP) of the IP address.
- `information → asn` (string): IP Autonomous System Number (ASN), such as AS16509.
- `information → is_bogon` (boolean): Returns true if the IP is a bogon address.
- `information → is_spamhaus_drop` (boolean): Returns true if the IP is listed in the Spamhaus DROP list.
- `information → is_fake_bot` (boolean): Returns true if the IP claims to be a search engine bot but is not verified.
- `information → is_google_bot` (boolean): Returns true if the IP belongs to a verified Google bot.
- `information → is_search_engine_bot` (boolean): Returns true if the IP belongs to a known and verified search engine bot.
- `information → related_service_name` (string): The name of the service associated with the IP, e.g. AhrefBot.
- `information → related_service_domain` (string): The domain name associated with the related service, e.g. ahrefs.com.
- `information → related_service_type` (string): The service category, can be Crawler, Search Engine Bot, SaaS, Payments, Monitoring, Identity or Marketing.
- `information → is_major_provider_spf_ip` (boolean): Returns true if the IP belongs to a major email provider SPF range.
- `information → is_public_dns` (boolean): Returns true if the IP is a public DNS resolver (e.g. 8.8.8.8).
- `information → cloud_provider` (string): The name of the major cloud service provider, e.g. Amazon AWS.
- `information → cloud_provider_domain` (string): The primary domain name of the cloud service provider, e.g. amazonaws.com.
- `information → aws_service` (string): The AWS service associated with the IP (e.g. EC2, S3, CloudFront, Route53, API Gateway).
- `information → is_google_service` (boolean): Returns true if the IP belongs to a Google service.
- `information → edge_service` (string): The edge or CDN service associated with the IP, e.g. Fastly.
- `information → edge_service_domain` (string): The domain name associated with the edge or CDN service, e.g. fastly.com.
- `information → is_satellite` (boolean): Returns true if the IP is associated with satellite connectivity.
- `asn → asn` (string): The AS number, e.g. AS202425.
- `asn → asname` (string): The AS name, e.g. INT-NETWORK.
- `asn → route` (string): The IP prefix announced by the AS (CIDR notation), e.g. 80.82.77.0/24.
- `asn → status` (string): The current registration status of the AS (e.g. active).
- `asn → org` (string): The organization that owns or operates the AS, e.g. IP Volume inc.
- `asn → country_code` (string): The country code of the AS (ISO 3166-1 alpha-2).
- `asn → created` (string): The date in format Y-m-d (e.g. 2018-05-17) the AS was registered.
- `asn → days_since_created` (integer): The number of days since the AS was created.
- `asn → updated` (string): The date in format Y-m-d (e.g. 2024-01-25) the AS information was last updated.
- `asn → days_since_updated` (integer): The number of days since the AS information was last updated.
- `asn → address` (string): The registered address or location associated with the AS.
- `asn → abuse_email` (string): The abuse contact email address for the AS.
- `asn → domain` (string): The primary domain name associated with the AS.
- `asn → total_ipv4_prefixes` (integer): The total number of IPv4 prefixes announced by the AS.
- `asn → total_ipv4_ips` (integer): The total number of IPv4 addresses announced by the AS.
- `asn → total_ipv6_prefixes` (integer): The total number of IPv6 prefixes announced by the AS.
- `asn → type` (string): The AS classification, can be hosting, isp, business (default), education, government or banking.
- `asn → rir` (string): The Regional Internet Registry responsible for the AS, can be RIPE, APNIC, ARIN, JPNIC, LACNIC or AFRINIC.
- `anonymity → is_proxy` (boolean): Returns true if IP is an open proxy (HTTP/SOCKS).
- `anonymity → is_webproxy` (boolean): Returns true if IP is a web proxy.
- `anonymity → is_residential_proxy` (boolean): Returns true if IP is a residential proxy.
- `anonymity → is_vpn` (boolean): Returns true if IP is a VPN service, e.g. NordVPN.
- `anonymity → is_hosting` (boolean): Returns true if IP is a hosting provider, e.g. DigitalOcean.
- `anonymity → is_relay` (boolean): Returns true if the IP address belongs to a relay service (e.g. Apple Private Relay).
- `anonymity → is_tor` (boolean): Returns true if IP is a Tor node.
- `risk_score → result` (integer): Returns risk score, a number between 0 (safe) and 100 (dangerous).
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/parked-domain-api/>

# Parked Domain API Reference

Check if a domain is parked, inactive, or for sale, which is useful for filtering out domains that are currently not in use and therefore do not host real content.

Service details and pricing: [Parked Domain API](https://www.apivoid.com/api/parked-domain/)

Endpoint: `POST https://api.apivoid.com/v2/parked-domain`

Credit cost: 2 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/parked-domain" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"host": "example.com"}'
```

The same request in PHP:

```php
$host = 'example.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/parked-domain');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. google.com.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "host": "example.com",
    "parked_domain": false,
    "a_records_found": true,
    "ns_records_found": true,
    "mx_records_found": true,
    "txt_records_found": true,
    "elapsed_ms": 162
}
```

## Response fields

The fields returned in the JSON response:

- `host` (string): Host submitted for the parked domain check.
- `parked_domain` (boolean): Returns true if domain is classified as parked.
- `a_records_found` (boolean): Returns true if domain has DNS A records.
- `ns_records_found` (boolean): Returns true if domain has DNS NS records.
- `mx_records_found` (boolean): Returns true if domain has DNS MX records.
- `txt_records_found` (boolean): Returns true if domain has DNS TXT records.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/phone-validator-api/>

# Phone Validator API Reference

Check and validate a phone number: get country code, carrier and estimated line type, detect invalid, disposable (commonly used on signups) and abusive numbers.

Service details and pricing: [Phone Validator API](https://www.apivoid.com/api/phone-validator/)

Endpoint: `POST https://api.apivoid.com/v2/phone-validator`

Credit cost: 1 credit per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/phone-validator" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"number": "+12024746243"}'
```

The same request in PHP:

```php
$number = '+12024746243';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/phone-validator');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['number' => $number]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `number` (string; Required): Phone number to submit, e.g. +12024746243 or 12024746243.

### Optional

- `country_code` (string): Country code of the phone number (e.g. US), not needed if the number has the prefix.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "valid": true,
    "number": "+12024746243",
    "local_format": "(202) 474-6243",
    "international_format": "+1 202-474-6243",
    "e164_format": "+12024746243",
    "uri": "tel:+12024746243",
    "country_prefix": "+1",
    "country_code": "US",
    "country_name": "United States",
    "location": "Washington D.C.",
    "carrier": "",
    "line_type": "Fixed Line or Mobile",
    "disposable": true,
    "abusive": true,
    "elapsed_ms": 1
}
```

## Response fields

The fields returned in the JSON response:

- `valid` (boolean): Returns true if the phone number format is valid.
- `number` (string): Returns the submitted phone number.
- `local_format` (string): Returns the phone number in local format, such as (202) 474-6243.
- `international_format` (string): Returns the phone number in international format (e.g. +1 202-474-6243).
- `e164_format` (string): Returns the phone number in E.164 format (e.g. +12024746243).
- `uri` (string): Returns the phone number in URI format suitable for HTML tags (e.g. tel:+12024746243).
- `country_prefix` (string): Returns the phone number country prefix (e.g. +1 for the US).
- `country_code` (string): Returns the phone number country code in ISO 3166-1 alpha-2 format (e.g. US).
- `country_name` (string): Returns the phone number country name (e.g. United States).
- `location` (string): Returns the estimated geographic location of the phone number based on its numbering plan.
- `carrier` (string): Returns the name of the phone number carrier (e.g. Vodafone).
- `line_type` (string): Returns the phone line type, such as Fixed Line, Mobile, Fixed Line or Mobile, VoIP, Toll-Free, Premium Rate, Shared Cost, Personal Number, Pager, UAN, Voicemail, or Unknown.
- `disposable` (boolean): Returns true if the phone number is disposable (temporary).
- `abusive` (boolean): Returns true if the phone number is disposable (temporary), spam or fake.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/ping-test-api/>

# Ping Test API Reference

Perform a ping test to a host from multiple geographic locations.

Service details and pricing: [Ping Test API](https://www.apivoid.com/api/ping-test/)

Endpoint: `POST https://api.apivoid.com/v2/ping-test`

Credit cost: 5 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/ping-test" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"host": "google.com"}'
```

The same request in PHP:

```php
$host = 'google.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/ping-test');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. google.com. Note: ⚠ Government and educational domains are blocked.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "host": "google.com",
    "locations": [
        {
            "continent_code": "NA",
            "continent_name": "North America",
            "country_code": "US",
            "country_name": "United States",
            "city_name": "San Francisco",
            "ping_output": {
                "host": "google.com",
                "ip_address": "142.251.46.238",
                "ip_hostname": "sfo03s27-in-f14.1e100.net",
                "is_valid_ip": true,
                "is_private_ip": false,
                "is_loopback_ip": false,
                "is_reserved_ip": false,
                "packets_sent": 3,
                "packets_received": 3,
                "percent_packet_loss": 0,
                "icmp_requests": [
                    {
                        "bytes": 64,
                        "icmp_seq": 1,
                        "ttl": 117,
                        "time_ms": 0.977
                    },
                    {
                        "bytes": 64,
                        "icmp_seq": 2,
                        "ttl": 117,
                        "time_ms": 0.689
                    },
                    {
                        "bytes": 64,
                        "icmp_seq": 3,
                        "ttl": 117,
                        "time_ms": 0.454
                    }
                ],
                "rtt": {
                    "min": 0.454,
                    "avg": 0.706,
                    "max": 0.977,
                    "mdev": 0.213
                },
                "elapsed_ms": 2018
            },
            "error": ""
        },
        {
            "continent_code": "AS",
            "continent_name": "Asia",
            "country_code": "IN",
            "country_name": "India",
            "city_name": "Bangalore",
            "ping_output": {
                "host": "google.com",
                "ip_address": "142.250.70.110",
                "ip_hostname": "pnbomb-ac-in-f14.1e100.net",
                "is_valid_ip": true,
                "is_private_ip": false,
                "is_loopback_ip": false,
                "is_reserved_ip": false,
                "packets_sent": 3,
                "packets_received": 3,
                "percent_packet_loss": 0,
                "icmp_requests": [
                    {
                        "bytes": 64,
                        "icmp_seq": 1,
                        "ttl": 118,
                        "time_ms": 18
                    },
                    {
                        "bytes": 64,
                        "icmp_seq": 2,
                        "ttl": 118,
                        "time_ms": 17.5
                    },
                    {
                        "bytes": 64,
                        "icmp_seq": 3,
                        "ttl": 118,
                        "time_ms": 17.3
                    }
                ],
                "rtt": {
                    "min": 17.262,
                    "avg": 17.594,
                    "max": 17.999,
                    "mdev": 0.305
                },
                "elapsed_ms": 2022
            },
            "error": ""
        },
        ...
    ],
    "elapsed_ms": 3279
}
```

## Response fields

The fields returned in the JSON response:

- `host` (string): Host submitted for the ping test.
- `locations` (array): List of geographic locations with the ping output from each location.
- `locations[n] → continent_code` (string): Continent code (e.g. NA) of the pinging location.
- `locations[n] → continent_name` (string): Continent name of the pinging location.
- `locations[n] → country_code` (string): Country code (e.g. US) of the pinging location.
- `locations[n] → country_name` (string): Country name of the pinging location.
- `locations[n] → city_name` (string): City name of the pinging location.
- `locations[n] → ping_output → host` (string): Host that was pinged.
- `locations[n] → ping_output → ip_address` (string): IP address the host resolved to from this location.
- `locations[n] → ping_output → ip_hostname` (string): Hostname (reverse DNS) of the resolved IP address.
- `locations[n] → ping_output → is_valid_ip` (boolean): Returns true if the resolved IP address is valid.
- `locations[n] → ping_output → is_private_ip` (boolean): Returns true if the resolved IP address is private.
- `locations[n] → ping_output → is_loopback_ip` (boolean): Returns true if the resolved IP address is a loopback address.
- `locations[n] → ping_output → is_reserved_ip` (boolean): Returns true if the resolved IP address is reserved.
- `locations[n] → ping_output → packets_sent` (integer): Number of ICMP packets sent.
- `locations[n] → ping_output → packets_received` (integer): Number of ICMP packets received.
- `locations[n] → ping_output → percent_packet_loss` (integer): Percentage of packets lost.
- `locations[n] → ping_output → icmp_requests` (array): List of ICMP requests; each item has bytes, icmp_seq, ttl and time_ms.
- `locations[n] → ping_output → icmp_requests[n] → bytes` (integer): Number of bytes in the ICMP echo reply.
- `locations[n] → ping_output → icmp_requests[n] → icmp_seq` (integer): Sequence number of the ICMP request.
- `locations[n] → ping_output → icmp_requests[n] → ttl` (integer): Time-to-live (TTL) value in the ICMP reply.
- `locations[n] → ping_output → icmp_requests[n] → time_ms` (float): Round-trip time of the ICMP request, in milliseconds.
- `locations[n] → ping_output → rtt → min` (float): Minimum round-trip time in milliseconds.
- `locations[n] → ping_output → rtt → avg` (float): Average round-trip time in milliseconds.
- `locations[n] → ping_output → rtt → max` (float): Maximum round-trip time in milliseconds.
- `locations[n] → ping_output → rtt → mdev` (float): Round-trip time standard deviation in milliseconds.
- `locations[n] → ping_output → elapsed_ms` (integer): Time taken by the ping test from this location, in milliseconds.
- `locations[n] → error` (string): Error message if the ping from this location failed.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/port-scan-api/>

# Port Scan API Reference

Scan common TCP ports of an IP and get the open/closed status for each port.

Service details and pricing: [Port Scan API](https://www.apivoid.com/api/port-scan/)

Endpoint: `POST https://api.apivoid.com/v2/port-scan`

Credit cost: 5 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/port-scan" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"ip": "1.2.3.4"}'
```

The same request in PHP:

```php
$ip = '1.2.3.4';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/port-scan');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['ip' => $ip]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `ip` (string; Required): IPv4 or IPv6 address to scan.

### Optional

- `top_ports` (integer; Default: 20): Can be 20 or 100: scan the top 20 or the top 100 most common ports.
- `custom_ports` (string): Set custom ports to scan, e.g. 21,22,23,53,80,443 (no spaces).

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "ip": "1.2.3.4",
    "open_ports": 4,
    "scanned_ports": 20,
    "ports": [
        {
            "port": 21,
            "proto": "tcp",
            "status": "open",
            "service": "ftp"
        },
        {
            "port": 22,
            "proto": "tcp",
            "status": "open",
            "service": "ssh"
        },
        {
            "port": 23,
            "proto": "tcp",
            "status": "closed",
            "service": "telnet"
        },
        {
            "port": 25,
            "proto": "tcp",
            "status": "closed",
            "service": "smtp"
        },
        {
            "port": 53,
            "proto": "tcp",
            "status": "closed",
            "service": "domain"
        },
        {
            "port": 80,
            "proto": "tcp",
            "status": "open",
            "service": "http"
        },
        {
            "port": 110,
            "proto": "tcp",
            "status": "closed",
            "service": "pop3"
        },
        {
            "port": 111,
            "proto": "tcp",
            "status": "closed",
            "service": "rpcbind"
        },
        {
            "port": 135,
            "proto": "tcp",
            "status": "closed",
            "service": "msrpc"
        },
        {
            "port": 139,
            "proto": "tcp",
            "status": "closed",
            "service": "netbios-ssn"
        },
        {
            "port": 143,
            "proto": "tcp",
            "status": "closed",
            "service": "imap"
        },
        {
            "port": 443,
            "proto": "tcp",
            "status": "open",
            "service": "https"
        },
        {
            "port": 445,
            "proto": "tcp",
            "status": "closed",
            "service": "microsoft-ds"
        },
        {
            "port": 993,
            "proto": "tcp",
            "status": "closed",
            "service": "imaps"
        },
        {
            "port": 995,
            "proto": "tcp",
            "status": "closed",
            "service": "pop3s"
        },
        {
            "port": 1723,
            "proto": "tcp",
            "status": "closed",
            "service": "pptp"
        },
        {
            "port": 3306,
            "proto": "tcp",
            "status": "closed",
            "service": "mysql"
        },
        {
            "port": 3389,
            "proto": "tcp",
            "status": "closed",
            "service": "ms-wbt-server"
        },
        {
            "port": 5900,
            "proto": "tcp",
            "status": "closed",
            "service": "vnc"
        },
        {
            "port": 8080,
            "proto": "tcp",
            "status": "closed",
            "service": "http-proxy"
        }
    ],
    "elapsed_ms": 185
}
```

## Response fields

The fields returned in the JSON response:

- `ip` (string): IP address submitted for the port scan.
- `open_ports` (integer): Number of open ports found.
- `scanned_ports` (integer): Number of ports scanned.
- `ports` (array): List of scanned ports with their status.
- `ports[n] → port` (integer): Port number scanned.
- `ports[n] → proto` (string): Protocol of the scanned port, e.g. tcp.
- `ports[n] → status` (string): Status of the port, can be open/closed.
- `ports[n] → service` (string): Common service associated with the port, e.g. ftp, ssh, https.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/qr-scan-api/>

# QR Scan API Reference

Scan a QR code image (submitted as base64) and extract its decoded content.

Service details and pricing: [QR Scan API](https://www.apivoid.com/api/qr-scan/)

Endpoint: `POST https://api.apivoid.com/v2/qr-scan`

Credit cost: 2 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/qr-scan" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"image_base64": "RW5jb2RlIGFuZCBkZWNv..."}'
```

The same request in PHP:

```php
$imageBase64 = 'RW5jb2RlIGFuZCBkZWNv...';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/qr-scan');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['image_base64' => $imageBase64]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `image_base64` (string; Required): Base64-encoded image file content (max 2.5 MB).

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "qrcode_found": true,
    "extracted_data": "https://www.possible-phishing-url.com/bank/login",
    "action_type": "URL",
    "ioc": {
        "urls": [
            "https://www.possible-phishing-url.com/bank/login"
        ],
        "emails": [],
        "phone_numbers": [],
        "bitcoin_addresses": []
    },
    "elapsed_ms": 63
}
```

## Response fields

The fields returned in the JSON response:

- `qrcode_found` (boolean): Returns true if a QR code was found in the image.
- `extracted_data` (string): Data extracted from the QR code.
- `action_type` (string): Type of action encoded in the QR code, e.g. URL, EMAIL, PHONE, TEXT.
- `ioc → urls` (array): URLs found in the QR code data.
- `ioc → emails` (array): Email addresses found in the QR code data.
- `ioc → phone_numbers` (array): Phone numbers found in the QR code data.
- `ioc → bitcoin_addresses` (array): Bitcoin addresses found in the QR code data.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/reverse-ip-api/>

# Reverse IP API Reference

Find domains that share the same IPv4 address (DNS A record).

Service details and pricing: [Reverse IP API](https://www.apivoid.com/api/reverse-ip/)

Endpoint: `POST https://api.apivoid.com/v2/reverse-ip`

Credit cost: 50 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/reverse-ip" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"ip": "46.105.204.23"}'
```

The same request in PHP:

```php
$ip = '46.105.204.23';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/reverse-ip');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['ip' => $ip]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

Results are paginated. By default the first page is returned; to request another page, pass `page_num`:

```bash
curl -X POST "https://api.apivoid.com/v2/reverse-ip" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{
           "ip": "46.105.204.23",
           "page_num": 2
         }'
```

## Request parameters

### Required

- `ip` (string; Required): IPv4 address to submit, e.g. 46.105.204.23.

### Optional

- `page_num` (integer; Default: 1): Page of results to return; each page contains up to 500 domains. If `records_num` in the response is 500, request the next page to get more domains.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "ip": "46.105.204.23",
    "page_num": 1,
    "records_num": 176,
    "domains": [
        {
            "name": "maevadigitalactive.com",
            "updated": "2025-01-22 11:48:31"
        },
        {
            "name": "textileblue.be",
            "updated": "2025-01-22 10:42:55"
        },
        {
            "name": "testdeqigratuit.com",
            "updated": "2025-01-20 10:52:51"
        },
        {
            "name": "consorcioserrano.es",
            "updated": "2025-01-20 09:58:51"
        },
        {
            "name": "occitanie-films.fr",
            "updated": "2025-01-19 10:47:44"
        },
        {
            "name": "fisheyestudio.it",
            "updated": "2025-01-17 08:23:30"
        },
        {
            "name": "blogfrenchfluent.com",
            "updated": "2025-01-16 13:11:28"
        },
        {
            "name": "shop.movensee.com",
            "updated": "2025-01-15 12:20:23"
        },
        {
            "name": "monsuivilogement.fr",
            "updated": "2025-01-15 12:12:59"
        },
        {
            "name": "larchebologna.it",
            "updated": "2025-01-13 12:23:50"
        },
        {
            "name": "reliablecounter.com",
            "updated": "2025-01-13 12:20:38"
        },
        {
            "name": "egliseverte.org",
            "updated": "2025-01-13 10:48:20"
        },
        {
            "name": "canada-culture.org",
            "updated": "2025-01-12 10:26:23"
        },
        {
            "name": "pizz-arco.fr",
            "updated": "2025-01-11 11:46:12"
        },
        {
            "name": "dsavocats.com",
            "updated": "2025-01-10 10:32:48"
        },
        ...
    ],
    "elapsed_ms": 620
}
```

## Response fields

The fields returned in the JSON response:

- `ip` (string): IP address submitted for the reverse IP lookup.
- `page_num` (integer): Page number of the results returned.
- `records_num` (integer): Number of domains returned on the current page (max 500). If it is 500, there may be more domains on the next page; a lower value means this is the last page.
- `domains` (array): List of domains hosted on the IP address.
- `domains[n] → name` (string): Domain name hosted on the IP address.
- `domains[n] → updated` (string): Date and time of when the domain record was last seen on the IP.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/screenshot-api/>

# Screenshot API Reference

Capture a screenshot of any web page in a real browser, with full-page capture, device emulation, dark mode, custom viewport and headers, and many other options.

Service details and pricing: [Screenshot API](https://www.apivoid.com/api/screenshot/)

Endpoint: `POST https://api.apivoid.com/v2/screenshot`

Credit cost: 20 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/screenshot" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"url": "https://apple.com/"}'
```

The same request in PHP:

```php
$url = 'https://apple.com/';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/screenshot');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['url' => $url]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);

    // Save the "base64_file" data as a PNG file
    if (isset($responseData['rendered_file']['base64_file'])) {
        $saveAs = __DIR__ . '/screenshot.png';
        file_put_contents($saveAs, base64_decode($responseData['rendered_file']['base64_file']));
    }
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `url` (string; Required): URL to submit, e.g. `https://apple.com/`.

### Optional

- `image_type` (string; Default: png): Screenshot image type: `png`, `jpeg`, `webp`, `avif`.
- `full_page` (boolean; Default: false): Take a full page screenshot (max 15000px height).
- `viewport_width` (integer; Default: 1920): Browser viewport width in pixels (max 5000).
- `viewport_height` (integer; Default: 1080): Browser viewport height in pixels (max 10000).
- `image_width` (integer): Thumbnail image width in pixels (max 5000).
- `image_height` (integer): Thumbnail image height in pixels (max 10000).
- `add_url_bar` (boolean; Default: false; New): Include the browser's address bar in the screenshot.
- `user_agent` (string; Default: desktop): Can be `desktop` (default, a random desktop user agent) or `mobile`.
- `accept_language` (string; Default: en-US): Change the Accept-Language HTTP header, format like `en-US`.
- `basic_auth_username` (string): Set username for Basic Authentication.
- `basic_auth_password` (string): Set password for Basic Authentication.
- `authorization_bearer` (string): Set the authorization bearer token.
- `custom_header` (string): A custom header, e.g. `X-key: 690d1f9e-5a53-45ad-997d-a23143a0d068`.
- `disable_js` (boolean; Default: false): Disable JavaScript.
- `disable_popups` (boolean; Default: true): Disable alerts, cookie consents and confirmation dialogs.
- `disable_images` (boolean; Default: false): Disable loading of images.
- `disable_ads` (boolean; Default: true): Disable advertisements.
- `disable_fonts` (boolean; Default: false): Disable loading of custom fonts.
- `omit_background` (boolean; Default: false): Omit the page background.
- `grayscale` (boolean; Default: false): The screenshot image will be grayscaled.
- `emulate_device` (string): Can be `ipad`, `ipad_landscape`, `iphone5`, `iphone5_landscape`, `iphone8`, `iphone8_landscape`, `iphone13`, `iphone13_landscape`.
- `dark_mode` (boolean; Default: false): Enable dark mode, if available on the web page.
- `delay` (integer; Default: 0): Wait N seconds (max 10) before taking the screenshot.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "url": "https://apple.com/",
    "rendered_file": {
        "format": "PNG",
        "date_time_utc": "2024-11-29 19:00:32",
        "base64_file": "iVBORw0KGgoAAAANSUhEUgAAB4AAAAQ4CAIAAABnsVYUAAAAAXNSR0IArs4c6QAAIABJREFUeJzs3XdUFNfbB/C7dJbeu4ICQUERBLEgWLA37KKoEbFrrKiINbH3rlhQsWHABhqxgQiKCg...",
        "image_width": 1920,
        "image_height": 1080,
        "file_size_readable": "344.53 KB",
        "file_size_bytes": 352795
    },
    "http_response": {
        "final_url": "https://www.apple.com/",
        "status_code": 200,
        "content_type": "text/html",
        "page_content_empty": false,
        "ip": "69.192.160.210"
    },
    "html_info": {
        "title": "Apple",
        "description": "Discover the innovative world of Apple and shop everything iPhone, iPad, Apple Watch, Mac, and Apple TV, plus explore accessories, entertainment, and expert device support.",
        "og_image": "https://www.apple.com/ac/structured-data/images/open_graph_logo.png?202110180743",
        "icon": "",
        "og_site_name": "Apple",
        "ld_organization": "Apple",
        "canonical": "https://www.apple.com/",
        "robots": "",
        "twitter_site": "",
        "lang": "en-US"
    },
    "elapsed_ms": 5763
}
```

## Response fields

The fields returned in the JSON response:

- `url` (string): URL submitted for the screenshot.
- `rendered_file → format` (string): Format of the rendered file, e.g. PNG.
- `rendered_file → date_time_utc` (string): Date and time (UTC) of when the screenshot was captured.
- `rendered_file → base64_file` (string): The screenshot image encoded in base64.
- `rendered_file → image_width` (integer): Width of the screenshot in pixels.
- `rendered_file → image_height` (integer): Height of the screenshot in pixels.
- `rendered_file → file_size_readable` (string): File size in human-readable format, e.g. 344.53 KB.
- `rendered_file → file_size_bytes` (integer): File size in bytes.
- `http_response → final_url` (string): Final URL after following redirects.
- `http_response → status_code` (integer): HTTP status code returned by the server.
- `http_response → content_type` (string): Content type of the page, e.g. text/html.
- `http_response → page_content_empty` (boolean): Returns true if the page content is empty.
- `http_response → ip` (string): IP address of the server that served the page.
- `html_info → title` (string): Title of the page.
- `html_info → description` (string): Meta description of the page.
- `html_info → og_image` (string): Open Graph image URL of the page.
- `html_info → icon` (string): Favicon URL of the page.
- `html_info → og_site_name` (string): Open Graph site name of the page.
- `html_info → ld_organization` (string): Organization name found in JSON-LD structured data.
- `html_info → canonical` (string): Canonical URL of the page.
- `html_info → robots` (string): Robots meta tag of the page.
- `html_info → twitter_site` (string): Twitter site handle of the page.
- `html_info → lang` (string): Language declared by the page, e.g. en-US.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/security-headers-api/>

# Security Headers API Reference

Analyze the HTTP security headers of a URL: check which security headers are present, missing, or misconfigured, with details for each header, and get a security score.

Service details and pricing: [Security Headers API](https://www.apivoid.com/api/security-headers/)

Endpoint: `POST https://api.apivoid.com/v2/security-headers`

Credit cost: 2 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/security-headers" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"url": "https://stripe.com/"}'
```

The same request in PHP:

```php
$url = 'https://stripe.com/';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/security-headers');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['url' => $url]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `url` (string; Required): URL to submit, e.g. `https://stripe.com/`.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "url": "https://stripe.com/",
    "final_url": "https://stripe.com/en-fi",
    "ip": "54.76.53.164",
    "status_code": 200,
    "response_note": "",
    "connection_error": false,
    "access_restricted": false,
    "response_headers": {
        "content-security-policy": [
            "base-uri 'none'; child-src 'none'; connect-src https://c.increment.com https://c.stripe.dev https://c.stripe.global https://c.stripe.partners blob: https://b.stripecdn.com https://errors.stripe.com https://ext.stripe.com https://r.stripe.com https://stripe-images.s3.us-west-1.amazonaws.com https://stripe.com 'self'; default-src 'none'; font-src https://b.stripecdn.com 'self'; form-action https://stripe.com 'self'; frame-ancestors https://app.contentful.com 'self'; frame-src https://b.stripecdn.com https://js.stripe.com https://support-conversations.stripe.com 'self'; img-src data: https://assets.ctfassets.net https://assets.stripeassets.com https://b.stripecdn.com https://images.ctfassets.net https://images.stripeassets.com https://q.stripe.com 'self'; manifest-src 'none'; media-src https://assets.ctfassets.net https://assets.stripeassets.com https://b.stripecdn.com https://videos.ctfassets.net https://videos.stripeassets.com 'self'; object-src 'none'; script-src https://b.stripecdn.com https://js.stripe.com 'self' 'sha256-3aWvb9tRBjmz1OjR3n7mwiTm94+s4iki4mMZF82asmc=' 'sha256-5LtzXhT7UFn+GqP5pKEMGL08UNZsrzANHFEBW/mQHGw=' 'sha256-beLzNcen8LrazzSCRjAapoIMTgJI0osPWGNSX7aK6lc=' 'sha256-cCM0Z4lzGkzQnmbdVw+ouz0JRawyaKcZ4yiqzqYS7ek=' 'sha256-vTifGUJH6hJYTvstw4xJ4xfr/vE0ELkOV4GpCumyqfg=' 'sha256-KxhSaxKB5RFTQsqfRwp+zG7iLjvMrTAySqnSvWlqct0=' 'sha256-tMuJ8c00j54yuxogrdIJeGhNVB350dc56i969XRz/Mc=' 'sha256-aEFSvCaVnb2wNwuO3IzA8J44RdTKt6vms9beA7BcCYg=' 'sha256-0SWEc2BfR2o77i2vUiNNIrFKQkjc2Ujsr2hlfZ6oUek=' 'report-sample'; style-src https://b.stripecdn.com 'self' 'unsafe-inline'; worker-src https://b.stripecdn.com 'self'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=s19Fnq91o9H4NDVx-N7qNHjvHjJd5CM9iCDBgcEd6Ky75-HIBDtVZY0Veb2cUyQ%3D"
        ],
        "content-type": [
            "text/html; charset=utf-8"
        ],
        "cross-origin-opener-policy": [
            "same-origin-allow-popups; report-to=\"wsp_coop\""
        ],
        "cross-origin-opener-policy-report-only": [
            "same-origin-allow-popups; report-to=\"wsp_coop\""
        ],
        "date": [
            "Tue, 17 Mar 2026 15:46:41 GMT"
        ],
        "referrer-policy": [
            "no-referrer-when-downgrade"
        ],
        "report-to": [
            "{\"group\":\"wsp_coop\",\"max_age\":8640,\"endpoints\":[{\"url\":\"https://q.stripe.com/coop-report?s=s19Fnq91o9H4NDVx-N7qNHjvHjJd5CM9iCDBgcEd6Ky75-HIBDtVZY0Veb2cUyQ=\"}],\"include_subdomains\":true},{\"group\":\"wsp_coep\",\"max_age\":8640,\"endpoints\":[{\"url\":\"https://q.stripe.com/coep-report?s=s19Fnq91o9H4NDVx-N7qNHjvHjJd5CM9iCDBgcEd6Ky75-HIBDtVZY0Veb2cUyQ=\"}],\"include_subdomains\":true}"
        ],
        "reporting-endpoints": [
            "coop=\"https://q.stripe.com/coop-report\", wsp_coop=\"https://q.stripe.com/coop-report?s=s19Fnq91o9H4NDVx-N7qNHjvHjJd5CM9iCDBgcEd6Ky75-HIBDtVZY0Veb2cUyQ=\",wsp_coep=\"https://q.stripe.com/coep-report?s=s19Fnq91o9H4NDVx-N7qNHjvHjJd5CM9iCDBgcEd6Ky75-HIBDtVZY0Veb2cUyQ=\""
        ],
        "server": [
            "nginx"
        ],
        "strict-transport-security": [
            "max-age=63072000; includeSubDomains; preload"
        ],
        "x-content-type-options": [
            "nosniff"
        ],
        "x-frame-options": [
            "SAMEORIGIN"
        ],
        "x-mkt-cache": [
            "HIT"
        ],
        "x-stripe-proxy-response": [
            "upstream"
        ],
        "x-stripe-server-rpc-duration-micros": [
            "44130"
        ],
        "x-wc": [
            "ABCDEFGHIJ"
        ]
    },
    "security_headers": [
        {
            "name": "strict-transport-security",
            "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security",
            "found": true,
            "value": [
                "max-age=63072000; includeSubDomains; preload"
            ],
            "issues": []
        },
        {
            "name": "content-security-policy",
            "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",
            "found": true,
            "value": [
                "base-uri 'none'; child-src 'none'; connect-src https://c.increment.com https://c.stripe.dev https://c.stripe.global https://c.stripe.partners blob: https://b.stripecdn.com https://errors.stripe.com https://ext.stripe.com https://r.stripe.com https://stripe-images.s3.us-west-1.amazonaws.com https://stripe.com 'self'; default-src 'none'; font-src https://b.stripecdn.com 'self'; form-action https://stripe.com 'self'; frame-ancestors https://app.contentful.com 'self'; frame-src https://b.stripecdn.com https://js.stripe.com https://support-conversations.stripe.com 'self'; img-src data: https://assets.ctfassets.net https://assets.stripeassets.com https://b.stripecdn.com https://images.ctfassets.net https://images.stripeassets.com https://q.stripe.com 'self'; manifest-src 'none'; media-src https://assets.ctfassets.net https://assets.stripeassets.com https://b.stripecdn.com https://videos.ctfassets.net https://videos.stripeassets.com 'self'; object-src 'none'; script-src https://b.stripecdn.com https://js.stripe.com 'self' 'sha256-3aWvb9tRBjmz1OjR3n7mwiTm94+s4iki4mMZF82asmc=' 'sha256-5LtzXhT7UFn+GqP5pKEMGL08UNZsrzANHFEBW/mQHGw=' 'sha256-beLzNcen8LrazzSCRjAapoIMTgJI0osPWGNSX7aK6lc=' 'sha256-cCM0Z4lzGkzQnmbdVw+ouz0JRawyaKcZ4yiqzqYS7ek=' 'sha256-vTifGUJH6hJYTvstw4xJ4xfr/vE0ELkOV4GpCumyqfg=' 'sha256-KxhSaxKB5RFTQsqfRwp+zG7iLjvMrTAySqnSvWlqct0=' 'sha256-tMuJ8c00j54yuxogrdIJeGhNVB350dc56i969XRz/Mc=' 'sha256-aEFSvCaVnb2wNwuO3IzA8J44RdTKt6vms9beA7BcCYg=' 'sha256-0SWEc2BfR2o77i2vUiNNIrFKQkjc2Ujsr2hlfZ6oUek=' 'report-sample'; style-src https://b.stripecdn.com 'self' 'unsafe-inline'; worker-src https://b.stripecdn.com 'self'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=s19Fnq91o9H4NDVx-N7qNHjvHjJd5CM9iCDBgcEd6Ky75-HIBDtVZY0Veb2cUyQ%3D"
            ],
            "issues": []
        },
        {
            "name": "x-content-type-options",
            "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options",
            "found": true,
            "value": [
                "nosniff"
            ],
            "issues": []
        },
        {
            "name": "x-xss-protection",
            "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection",
            "found": false,
            "value": [],
            "issues": [
                {
                    "code": "MISSING_X_XSS_PROTECTION",
                    "message": "X-XSS-Protection header is missing. This is acceptable as the header is deprecated.",
                    "type": "information"
                }
            ]
        },
        {
            "name": "referrer-policy",
            "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy",
            "found": true,
            "value": [
                "no-referrer-when-downgrade"
            ],
            "issues": [
                {
                    "code": "REFERRER_POLICY_WEAK",
                    "message": "Referrer-Policy 'no-referrer-when-downgrade' may leak referrer to third-party origins over HTTPS.",
                    "type": "information"
                }
            ]
        },
        {
            "name": "permissions-policy",
            "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy",
            "found": false,
            "value": [],
            "issues": [
                {
                    "code": "MISSING_PERMISSIONS_POLICY",
                    "message": "Permissions-Policy header is missing.",
                    "type": "error"
                }
            ]
        },
        {
            "name": "x-frame-options",
            "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options",
            "found": true,
            "value": [
                "SAMEORIGIN"
            ],
            "issues": []
        },
        {
            "name": "cross-origin-opener-policy",
            "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy",
            "found": true,
            "value": [
                "same-origin-allow-popups; report-to=\"wsp_coop\""
            ],
            "issues": []
        },
        {
            "name": "cross-origin-embedder-policy",
            "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy",
            "found": false,
            "value": [],
            "issues": [
                {
                    "code": "MISSING_COEP",
                    "message": "Cross-Origin-Embedder-Policy header is missing.",
                    "type": "information"
                }
            ]
        },
        {
            "name": "cross-origin-resource-policy",
            "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy",
            "found": false,
            "value": [],
            "issues": [
                {
                    "code": "MISSING_CORP",
                    "message": "Cross-Origin-Resource-Policy header is missing.",
                    "type": "information"
                }
            ]
        }
    ],
    "cors": {
        "present": false,
        "configuration": {
            "allow_origin": "",
            "allow_credentials": false,
            "allow_methods": [],
            "allow_headers": [],
            "expose_headers": [],
            "max_age": 0
        },
        "issues": []
    },
    "information_leakage": [
        {
            "name": "server",
            "found": true,
            "value": [
                "nginx"
            ],
            "issues": []
        }
    ],
    "duplicate_headers": [],
    "cookies": [],
    "summary": {
        "security_headers": {
            "checked": 10,
            "found": 6,
            "missing": 4
        },
        "issues": {
            "errors": 1,
            "warnings": 0,
            "information": 4
        }
    },
    "score": 94,
    "max_score": 100,
    "grade": "A",
    "elapsed_ms": 524
}
```

## Response fields

The fields returned in the JSON response:

- `url` (string): URL submitted for the security headers check.
- `final_url` (string): Final URL after following redirects.
- `ip` (string): IP address of the server that served the page.
- `status_code` (integer): HTTP status code returned by the server.
- `response_note` (string): Additional note about the HTTP response, if any.
- `connection_error` (boolean): Returns true if the connection to the server failed.
- `access_restricted` (boolean): Returns true if access to the page is restricted (e.g. by a firewall or captcha).
- `response_headers` (object): HTTP response headers returned by the server, keyed by lowercase header name.
- `security_headers` (array): List of security headers checked with their status and issues.
- `security_headers[n] → name` (string): Name of the security header, lowercase, e.g. content-security-policy.
- `security_headers[n] → reference` (string): Reference URL with documentation about the header.
- `security_headers[n] → found` (boolean): Returns true if the security header is present.
- `security_headers[n] → value` (array): Values of the security header, if present.
- `security_headers[n] → issues` (array): Issues found with the header configuration; each item has code, message and type.
- `security_headers[n] → issues[n] → code` (string): Machine-readable issue code, e.g. MISSING_CORP.
- `security_headers[n] → issues[n] → message` (string): Human-readable description of the issue.
- `security_headers[n] → issues[n] → type` (string): Issue severity: error, warning or information.
- `cors → present` (boolean): Returns true if CORS headers are present.
- `cors → configuration → allow_origin` (string): Value of the Access-Control-Allow-Origin header.
- `cors → configuration → allow_credentials` (boolean): Returns true if Access-Control-Allow-Credentials is enabled.
- `cors → configuration → allow_methods` (array): HTTP methods allowed by the CORS configuration.
- `cors → configuration → allow_headers` (array): Headers allowed by the CORS configuration.
- `cors → configuration → expose_headers` (array): Headers exposed by the CORS configuration.
- `cors → configuration → max_age` (integer): Max age of the CORS preflight cache in seconds.
- `cors → issues` (array): Issues found with the CORS configuration.
- `information_leakage` (array): Headers that may leak information about the server or technology stack.
- `information_leakage[n] → name` (string): Name of the header, lowercase, e.g. server, x-powered-by.
- `information_leakage[n] → found` (boolean): Returns true if the header is present.
- `information_leakage[n] → value` (array): Values of the header, if present.
- `information_leakage[n] → issues` (array): Issues found related to the information disclosed.
- `duplicate_headers` (array): Headers that appear more than once in the response.
- `cookies` (array): Cookies set by the server with their security attributes.
- `summary → security_headers → checked` (integer): Number of security headers checked.
- `summary → security_headers → found` (integer): Number of security headers found.
- `summary → security_headers → missing` (integer): Number of security headers missing.
- `summary → issues → errors` (integer): Number of issues with error severity.
- `summary → issues → warnings` (integer): Number of issues with warning severity.
- `summary → issues → information` (integer): Number of issues with informational severity.
- `score` (integer): Security headers score of the page (0 bad, 100 good).
- `max_score` (integer): Maximum achievable score, e.g. 100.
- `grade` (string): Grade assigned based on the score, e.g. A+, A, A-, B+, B, B-, C+, C, C-, D+, D, D-, F.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/site-trustworthiness-api/>

# Site Trustworthiness API Reference

Get a trust score of a website, useful to spot potentially fraudulent and insecure web shops, with detailed security and content checks.

Service details and pricing: [Site Trustworthiness API](https://www.apivoid.com/api/site-trustworthiness/)

Endpoint: `POST https://api.apivoid.com/v2/site-trust`

Credit cost: 10 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/site-trust" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"host": "amazon.com"}'
```

The same request in PHP:

```php
$host = 'amazon.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/site-trust');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. amazon.com (without the www). Note: ⚠ Government and educational domains are blocked.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "host": "amazon.com",
    "dns_records": {
        "ns": [
            {
                "target": "ns1.amzndns.org",
                "ip": "156.154.66.10",
                "country_code": "US",
                "country_name": "United States of America",
                "isp": "Vercara LLC"
            },
            {
                "target": "ns2.amzndns.co.uk",
                "ip": "204.74.120.1",
                "country_code": "US",
                "country_name": "United States of America",
                "isp": "Vercara LLC"
            },
            {
                "target": "ns2.amzndns.com",
                "ip": "156.154.68.10",
                "country_code": "US",
                "country_name": "United States of America",
                "isp": "Vercara LLC"
            },
            {
                "target": "ns2.amzndns.net",
                "ip": "156.154.69.10",
                "country_code": "US",
                "country_name": "United States of America",
                "isp": "Vercara LLC"
            },
            {
                "target": "ns2.amzndns.org",
                "ip": "156.154.150.1",
                "country_code": "US",
                "country_name": "United States of America",
                "isp": "Vercara LLC"
            },
            {
                "target": "ns1.amzndns.co.uk",
                "ip": "156.154.67.10",
                "country_code": "US",
                "country_name": "United States of America",
                "isp": "Vercara LLC"
            },
            {
                "target": "ns1.amzndns.com",
                "ip": "156.154.64.10",
                "country_code": "US",
                "country_name": "United States of America",
                "isp": "Vercara LLC"
            }
        ],
        "mx": [
            {
                "target": "amazon-smtp.amazon.com",
                "ip": "52.28.202.117",
                "country_code": "DE",
                "country_name": "Germany",
                "isp": "A100 ROW GmbH"
            }
        ],
        "cname": ""
    },
    "domain_blacklist": {
        "engines": {
            "0": {
                "name": "ANJ Blocked Sites",
                "detected": false,
                "reference": "https://anj.fr/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "1": {
                "name": "AntiSocial Blacklist",
                "detected": false,
                "reference": "https://theantisocialengineer.com/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "2": {
                "name": "APVA",
                "detected": false,
                "reference": "https://www.antiphish.org/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "3": {
                "name": "Artists Against 419",
                "detected": false,
                "reference": "https://wiki.aa419.org/index.php/Main_Page",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "4": {
                "name": "AZORult Tracker",
                "detected": false,
                "reference": "https://azorult-tracker.net/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "5": {
                "name": "Badbitcoin",
                "detected": false,
                "reference": "https://badbitcoin.org/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "6": {
                "name": "Bambenek Consulting",
                "detected": false,
                "reference": "https://www.bambenekconsulting.com/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "7": {
                "name": "CERT Polska",
                "detected": false,
                "reference": "https://www.cert.pl/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "8": {
                "name": "COI CZ",
                "detected": false,
                "reference": "https://coi.gov.cz/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "9": {
                "name": "CryptoScamDB",
                "detected": false,
                "reference": "https://cryptoscamdb.org/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "10": {
                "name": "EtherAddressLookup",
                "detected": false,
                "reference": "https://github.com/409H/EtherAddressLookup/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            ...
        },
        "detections": 0,
        "engines_count": 42,
        "detection_rate": "0%",
        "scan_time_ms": 120
    },
    "ecommerce_platform": {
        "is_shopify": false,
        "is_woocommerce": false,
        "is_opencart": false,
        "is_prestashop": false,
        "is_magento": false,
        "is_zencart": false,
        "is_other": false
    },
    "geo_location": {
        "countries": [
            "US",
            "DE"
        ]
    },
    "html_info": {
        "title": "Amazon.com. Spend less. Smile more.",
        "description": "Free shipping on millions of items. Get the best of Shopping and Entertainment with Prime. Enjoy low prices and great deals on the largest selection of everyday essentials and other products, including fashion, home, beauty, electronics, Alexa Devices, sporting goods, toys, automotive, pets, baby, books, video games, musical instruments, office supplies, and more.",
        "keywords": "Amazon, Amazon.com, Books, Online Shopping, Book Store, Magazine, Subscription, Music, CDs, DVDs, Videos, Electronics, Video Games, Computers, Cell Phones, Toys, Games, Apparel, Accessories, Shoes, Jewelry, Watches, Office Products, Sports & Outdoors, Sporting Goods, Baby Products, Health, Personal Care, Beauty, Home, Garden, Bed & Bath, Furniture, Tools, Hardware, Vacuums, Outdoor Living, Automotive Parts, Pet Supplies, Broadband, DSL",
        "robots": "",
        "canonical": "https://www.amazon.com/",
        "og_image": "https://m.media-amazon.com/images/I/31epF-8N9LL.png",
        "article_publisher": "",
        "og_site_name": "",
        "twitter_site": "",
        "generator": "",
        "ld_organization": "",
        "lang": "en-us"
    },
    "redirection": {
        "found": false,
        "external": false,
        "url": ""
    },
    "response_headers": {
        "code": 200,
        "status": "HTTP/2 200",
        "content-type": "text/html",
        "server": "Server",
        "date": "Tue, 23 Dec 2025 16:13:51 GMT",
        "x-amz-rid": "E158SRJTEWGJ2DDFSFZ4",
        "set-cookie": "skin=noskin; path=/; domain=.amazon.com",
        "vary": "Content-Type,Accept-Encoding,User-Agent",
        "last-modified": "Tue, 23 Dec 2025 16:13:48 GMT",
        "etag": "\"178e45-646a0d4277060-gzip\"",
        "accept-ranges": "bytes",
        "content-encoding": "gzip",
        "strict-transport-security": "max-age=47474747; includeSubDomains; preload",
        "x-frame-options": "SAMEORIGIN",
        "x-cache": "Miss from cloudfront",
        "via": "1.1 d31c4c288ffef497f9a848a4bcb51e54.cloudfront.net (CloudFront)",
        "x-amz-cf-pop": "ATL58-P3",
        "alt-svc": "h3=\":443\"; ma=86400",
        "x-amz-cf-id": "gKbTOmeZcd0lzdM2oZoxnX0vlyLpN0x8zH3z1E-hZ0haAS0ilEubwg=="
    },
    "security_checks": {
        "is_suspended_site": false,
        "is_most_abused_tld": false,
        "is_robots_noindex": false,
        "is_website_accessible": true,
        "is_empty_page_content": false,
        "is_redirect_to_search_engine": false,
        "is_suspicious_redirect": false,
        "http_status_code": 200,
        "is_http_status_error": false,
        "is_http_server_error": false,
        "is_http_client_error": false,
        "is_empty_page_title": false,
        "is_ipv6_enabled": false,
        "is_domain_blacklisted": false,
        "is_suspicious_domain": false,
        "is_sinkholed_domain": false,
        "is_http_redirected_to_https": true,
        "is_directory_listing": false,
        "is_domain_ipv4_assigned": true,
        "is_domain_ipv4_private": false,
        "is_domain_ipv4_loopback": false,
        "is_domain_ipv4_reserved": false,
        "is_domain_ipv4_valid": true,
        "is_uncommon_host_length": false,
        "is_uncommon_dash_char_count": false,
        "is_uncommon_dot_char_count": false,
        "is_email_configured": true,
        "is_email_spoofable": true,
        "is_dmarc_configured": true,
        "is_dmarc_enforced": true,
        "is_caa_configured": false,
        "is_external_redirect": false,
        "is_custom_404_configured": true,
        "is_valid_https": true,
        "is_ssl_blacklisted": false,
        "is_ssl_expired": false,
        "is_ssl_revoked": false,
        "ssl_type": "Domain Validation",
        "ssl_issuer_organization": "DigiCert Inc",
        "ssl_issuer_country": "US",
        "ssl_subject_organization": "",
        "ssl_subject_common_name": "www.amazon.com",
        "ssl_subject_country": "",
        "is_hsts_header": true,
        "is_referrer_policy_header": false,
        "is_unsafe_url_in_referrer_policy_header": false,
        "is_csp_header": false,
        "is_unsafe_eval_in_csp_header": false,
        "is_unsafe_inline_in_csp_header": false,
        "is_content_type_options_header": false,
        "is_frame_options_header": true,
        "is_xss_protection_header": false,
        "is_permissions_policy_header": false,
        "is_set_cookie_header": true,
        "is_secure_on_all_cookies": false,
        "is_server_header_exposing_version": false,
        "is_powered_by_header_exposed": false,
        "is_aspnet_version_header_exposed": false,
        "is_dnssec_enabled": false,
        "is_dnssec_signed": false,
        "is_defaced_heuristic": false,
        "is_website_popular": true,
        "is_domain_recent": "no",
        "is_domain_very_recent": "no",
        "domain_creation_date": "1994-11-01",
        "domain_age_in_days": 11375,
        "domain_age_in_months": 366,
        "domain_age_in_years": 31,
        "is_ecommerce_platform": false,
        "is_high_discounts": false,
        "is_fake_socials": false,
        "is_heuristic_pattern": false,
        "is_free_email": false,
        "is_risky_geo_location": false,
        "is_china_country": false,
        "is_nigeria_country": false
    },
    "server_details": {
        "ip": "98.82.161.185",
        "hostname": "ec2-98-82-161-185.compute-1.amazonaws.com",
        "continent_code": "NA",
        "continent_name": "North America",
        "country_code": "US",
        "country_name": "United States of America",
        "region_name": "Virginia",
        "city_name": "Ashburn",
        "latitude": 39.039474,
        "longitude": -77.491809,
        "isp": "Amazon Technologies Inc.",
        "asn": "AS14618"
    },
    "trust_score": {
        "result": 100
    },
    "url_parts": {
        "scheme": "https",
        "host": "www.amazon.com",
        "host_nowww": "amazon.com",
        "port": 443,
        "path": "/",
        "query": ""
    },
    "elapsed_ms": 3123
}
```

## Response fields

The fields returned in the JSON response:

- `host` (string): Host submitted for the trustworthiness analysis.
- `dns_records → ns` (array): NS records of the domain; each item has target, ip, country_code, country_name and isp.
- `dns_records → ns[n] → target` (string): Name server hostname.
- `dns_records → ns[n] → ip` (string): IPv4 address of the name server.
- `dns_records → ns[n] → country_code` (string): Country code (e.g. US) of the name server IP address.
- `dns_records → ns[n] → country_name` (string): Country name of the name server IP address.
- `dns_records → ns[n] → isp` (string): Internet Service Provider (ISP) of the name server IP address.
- `dns_records → mx` (array): MX records of the domain; each item has target, ip, country_code, country_name and isp.
- `dns_records → mx[n] → target` (string): Mail server hostname.
- `dns_records → mx[n] → ip` (string): IPv4 address of the mail server.
- `dns_records → mx[n] → country_code` (string): Country code (e.g. US) of the mail server IP address.
- `dns_records → mx[n] → country_name` (string): Country name of the mail server IP address.
- `dns_records → mx[n] → isp` (string): Internet Service Provider (ISP) of the mail server IP address.
- `dns_records → cname` (string): CNAME target of the host. Empty string if none.
- `domain_blacklist → engines` (object): List of scanning engines; each item has name, detected, reference, confidence and elapsed_ms.
- `domain_blacklist → engines → [index] → name` (string): Name of the scanning engine.
- `domain_blacklist → engines → [index] → detected` (boolean): Returns true if this engine flagged the submitted domain.
- `domain_blacklist → engines → [index] → reference` (string): Link to the engine's website or listing details.
- `domain_blacklist → engines → [index] → confidence` (string): Confidence of this engine detection, e.g. high.
- `domain_blacklist → engines → [index] → elapsed_ms` (integer): Time taken by this engine to complete its check, in milliseconds.
- `domain_blacklist → detections` (integer): Number of scanning engines that detected the domain.
- `domain_blacklist → engines_count` (integer): Number of scanning engines used to scan the domain.
- `domain_blacklist → detection_rate` (string): Percentage of engines that detected the domain, e.g. 5%.
- `domain_blacklist → scan_time_ms` (integer): Time taken to scan the domain across all engines, in milliseconds.
- `ecommerce_platform → is_shopify` (boolean): Returns true if the website runs on Shopify.
- `ecommerce_platform → is_woocommerce` (boolean): Returns true if the website runs on WooCommerce.
- `ecommerce_platform → is_opencart` (boolean): Returns true if the website runs on OpenCart.
- `ecommerce_platform → is_prestashop` (boolean): Returns true if the website runs on PrestaShop.
- `ecommerce_platform → is_magento` (boolean): Returns true if the website runs on Magento.
- `ecommerce_platform → is_zencart` (boolean): Returns true if the website runs on Zen Cart.
- `ecommerce_platform → is_other` (boolean): Returns true if the website runs on another known e-commerce platform.
- `geo_location → countries` (array): List of potential countries of origin.
- `html_info → title` (string): Title of the page.
- `html_info → description` (string): Meta description of the page.
- `html_info → keywords` (string): Contents of the `meta keywords` tag.
- `html_info → robots` (string): Robots meta tag of the page.
- `html_info → canonical` (string): Canonical URL of the page.
- `html_info → og_image` (string): Open Graph image URL of the page.
- `html_info → article_publisher` (string): Contents of the article:publisher Open Graph tag. Empty string if none.
- `html_info → og_site_name` (string): Open Graph site name of the page.
- `html_info → twitter_site` (string): Twitter site handle of the page.
- `html_info → generator` (string): CMS or framework from `meta generator` tag (e.g. WordPress).
- `html_info → ld_organization` (string): Organization name found in JSON-LD structured data.
- `html_info → lang` (string): Language declared by the page, e.g. en-US.
- `redirection → found` (boolean): Returns true if the website redirects to another URL.
- `redirection → external` (boolean): Returns true if the redirect points to an external host.
- `redirection → url` (string): Destination URL of the redirect. Empty string if none.
- `response_headers` (object): HTTP response headers returned by the server, keyed by lowercase header name.
- `security_checks → is_suspended_site` (boolean): Returns true if the website appears suspended by the hosting provider.
- `security_checks → is_most_abused_tld` (boolean): Returns true if the domain TLD is risky, e.g. .top or .tk.
- `security_checks → is_robots_noindex` (boolean): Returns true if URL "doesn't want" to be indexed on Google.
- `security_checks → is_website_accessible` (boolean): Returns true if website is accessible by our servers (status code is 2xx or 3xx).
- `security_checks → is_empty_page_content` (boolean): Returns true if website page content is empty.
- `security_checks → is_redirect_to_search_engine` (boolean): Returns true if website redirects to search engines, like google.com.
- `security_checks → is_suspicious_redirect` (boolean): Returns true if the redirect matches our suspicious redirect rules.
- `security_checks → http_status_code` (integer): HTTP status code returned by the website, e.g. 200.
- `security_checks → is_http_status_error` (boolean): Returns true if the HTTP status code is an error (4xx or 5xx).
- `security_checks → is_http_server_error` (boolean): Returns true if the HTTP status code is a server error (5xx).
- `security_checks → is_http_client_error` (boolean): Returns true if the HTTP status code is a client error (4xx).
- `security_checks → is_empty_page_title` (boolean): Returns true if website page title is empty.
- `security_checks → is_ipv6_enabled` (boolean): Returns true if host has IPv6 AAAA records configured.
- `security_checks → is_domain_blacklisted` (boolean): Returns true if domain is blacklisted by trusted sources.
- `security_checks → is_suspicious_domain` (boolean): Returns true if domain matches our suspicious domain rules.
- `security_checks → is_sinkholed_domain` (boolean): Returns true if domain is sinkholed (malicious).
- `security_checks → is_http_redirected_to_https` (boolean): Returns true if HTTP requests are redirected to HTTPS.
- `security_checks → is_directory_listing` (boolean): Returns true if website is a directory listing.
- `security_checks → is_domain_ipv4_assigned` (boolean): Returns true if the domain resolves to an assigned IPv4 address.
- `security_checks → is_domain_ipv4_private` (boolean): Returns true if the domain resolves to a private IPv4 address.
- `security_checks → is_domain_ipv4_loopback` (boolean): Returns true if the domain resolves to a loopback (e.g. 127.0.0.1) IPv4 address.
- `security_checks → is_domain_ipv4_reserved` (boolean): Returns true if the domain resolves to a reserved IPv4 address.
- `security_checks → is_domain_ipv4_valid` (boolean): Returns true if the domain resolves to a valid public IPv4 address.
- `security_checks → is_uncommon_host_length` (boolean): Returns true if the host length is uncommon (such as, a very long domain).
- `security_checks → is_uncommon_dash_char_count` (boolean): Returns true if the host contains too many dash "-" characters.
- `security_checks → is_uncommon_dot_char_count` (boolean): Returns true if the host contains too many dot "." characters.
- `security_checks → is_email_configured` (boolean): Returns true if the domain has MX records configured to receive email.
- `security_checks → is_email_spoofable` (boolean): Returns true if the domain's email can be spoofed due to missing or weak SPF/DMARC configuration.
- `security_checks → is_dmarc_configured` (boolean): Returns true if the domain has a DMARC record.
- `security_checks → is_dmarc_enforced` (boolean): Returns true if the DMARC policy is enforced (p=quarantine or p=reject).
- `security_checks → is_caa_configured` (boolean): Returns true if the domain has CAA records configured.
- `security_checks → is_external_redirect` (boolean): Returns true if the URL redirects to an external website.
- `security_checks → is_custom_404_configured` (boolean): Returns true if the website returns a custom 404 error page.
- `security_checks → is_valid_https` (boolean): Returns true if the URL HTTPS (SSL) is valid.
- `security_checks → is_ssl_blacklisted` (boolean): Returns true if the SSL certificate is blacklisted by trusted sources.
- `security_checks → is_ssl_expired` (boolean): Returns true if the SSL certificate is expired.
- `security_checks → is_ssl_revoked` (boolean): Returns true if the SSL certificate has been revoked.
- `security_checks → ssl_type` (string): SSL certificate type, can be Domain Validation, Organization Validation or Extended Validation.
- `security_checks → ssl_issuer_organization` (string): Organization that issued the SSL certificate, e.g. DigiCert Inc.
- `security_checks → ssl_issuer_country` (string): Country of the SSL certificate issuer.
- `security_checks → ssl_subject_organization` (string): Organization in the SSL certificate subject. Empty string if not present.
- `security_checks → ssl_subject_common_name` (string): Common Name (CN) in the SSL certificate subject.
- `security_checks → ssl_subject_country` (string): Country in the SSL certificate subject. Empty string if not present.
- `security_checks → is_hsts_header` (boolean): Returns true if the Strict-Transport-Security (HSTS) header is present.
- `security_checks → is_referrer_policy_header` (boolean): Returns true if the Referrer-Policy header is present.
- `security_checks → is_unsafe_url_in_referrer_policy_header` (boolean): Returns true if the Referrer-Policy header uses the unsafe-url value.
- `security_checks → is_csp_header` (boolean): Returns true if the Content-Security-Policy header is present.
- `security_checks → is_unsafe_eval_in_csp_header` (boolean): Returns true if the Content-Security-Policy header contains unsafe-eval.
- `security_checks → is_unsafe_inline_in_csp_header` (boolean): Returns true if the Content-Security-Policy header contains unsafe-inline.
- `security_checks → is_content_type_options_header` (boolean): Returns true if the X-Content-Type-Options header is present.
- `security_checks → is_frame_options_header` (boolean): Returns true if the X-Frame-Options header is present.
- `security_checks → is_xss_protection_header` (boolean): Returns true if the X-XSS-Protection header is present.
- `security_checks → is_permissions_policy_header` (boolean): Returns true if the Permissions-Policy header is present.
- `security_checks → is_set_cookie_header` (boolean): Returns true if the website sets cookies via the Set-Cookie header.
- `security_checks → is_secure_on_all_cookies` (boolean): Returns true if all cookies are set with the Secure attribute.
- `security_checks → is_server_header_exposing_version` (boolean): Returns true if the Server header exposes the software version.
- `security_checks → is_powered_by_header_exposed` (boolean): Returns true if the X-Powered-By header is exposed.
- `security_checks → is_aspnet_version_header_exposed` (boolean): Returns true if the X-AspNet-Version header is exposed.
- `security_checks → is_dnssec_enabled` (boolean): Returns true if DNSSEC is enabled for the domain.
- `security_checks → is_dnssec_signed` (boolean): Returns true if the DNS response is signed with DNSSEC.
- `security_checks → is_defaced_heuristic` (boolean): Returns true if website has been defaced (we use our own rules).
- `security_checks → is_website_popular` (boolean): Returns true if the website is present in popular website rankings.
- `security_checks → is_domain_recent` (string): Returns "yes" if domain was created less than 6 months ago, can be yes/no/unknown.
- `security_checks → is_domain_very_recent` (string): Returns "yes" if domain was created less than 30 days ago, can be yes/no/unknown.
- `security_checks → domain_creation_date` (string): Domain registration date, format is Y-m-d (empty if unknown).
- `security_checks → domain_age_in_days` (integer): Age of the domain in days (0 if unknown).
- `security_checks → domain_age_in_months` (integer): Age of the domain in months (0 if unknown).
- `security_checks → domain_age_in_years` (integer): Age of the domain in years (0 if unknown).
- `security_checks → is_ecommerce_platform` (boolean): Returns true if the website is using an ecommerce platform like Shopify.
- `security_checks → is_high_discounts` (boolean): Returns true if the website is offering high discounts.
- `security_checks → is_fake_socials` (boolean): Returns true if the website is using fake social profiles.
- `security_checks → is_heuristic_pattern` (boolean): Returns true if our heuristic engine detected malicious patterns.
- `security_checks → is_free_email` (boolean): Returns true if website is using a free email like Gmail.
- `security_checks → is_risky_geo_location` (boolean): Returns true if website location is considered risky.
- `security_checks → is_china_country` (boolean): Returns true if website is potentially located in China.
- `security_checks → is_nigeria_country` (boolean): Returns true if website is potentially located in Nigeria.
- `server_details → ip` (string): IP address of the submitted host.
- `server_details → hostname` (string): Reverse DNS hostname (PTR record) of the host's IP address. Empty string if none.
- `server_details → continent_code` (string): Continent code (e.g. NA) of where the host's IP address is located.
- `server_details → continent_name` (string): Continent name (e.g. North America) of where the host's IP address is located.
- `server_details → country_code` (string): Country code (e.g. CN) of where the host's IP address is located.
- `server_details → country_name` (string): Country name of where the host's IP address is located.
- `server_details → region_name` (string): Region or state name of where the host's IP address is located.
- `server_details → city_name` (string): City name of where the host's IP address is located.
- `server_details → latitude` (float): Approximate latitude of the host's IP address.
- `server_details → longitude` (float): Approximate longitude of the host's IP address.
- `server_details → isp` (string): Internet Service Provider (ISP) of host's IP address.
- `server_details → asn` (string): IP Autonomous System Number (ASN), such as AS16509.
- `trust_score → result` (integer): Returns trust score, a number between 0 (bad) and 100 (good).
- `url_parts → scheme` (string): URL scheme: `http` or `https`.
- `url_parts → host` (string): Full hostname including subdomain (e.g. `www.example.com`).
- `url_parts → host_nowww` (string): Hostname with the `www.` prefix stripped.
- `url_parts → port` (integer): Port number. Typically `80` for HTTP, `443` for HTTPS, or `0` if unspecified.
- `url_parts → path` (string): URL path component (e.g. `/contact-us/`).
- `url_parts → query` (string): URL query string. Empty string if none.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/spf-validator-api/>

# SPF Validator API Reference

Validate the SPF record of a domain: check the record syntax, lookup count and common issues, and verify if an IP is authorized to send emails for the domain.

Service details and pricing: [SPF Validator API](https://www.apivoid.com/api/spf-validator/)

Endpoint: `POST https://api.apivoid.com/v2/spf-validator`

Credit cost: 5 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/spf-validator" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"host": "gmail.com"}'
```

The same request in PHP:

```php
$host = 'gmail.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/spf-validator');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. gmail.com.

### Optional

- `iptest` (string): IPv4 or IPv6 address to test: the response tells you whether it is authorized to send email for the domain.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "host": "gmail.com",
    "has_spf_record": true,
    "dns_lookups_num": 4,
    "spf_record": "v=spf1 redirect=_spf.google.com",
    "spf_records_list": [
        {
            "record": "v=spf1 redirect=_spf.google.com",
            "origin": "gmail.com",
            "chars_num": 31,
            "use_macro": false,
            "domains": [
                "_spf.google.com"
            ]
        },
        {
            "record": "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all",
            "origin": "_spf.google.com",
            "chars_num": 103,
            "use_macro": false,
            "domains": [
                "_netblocks.google.com",
                "_netblocks2.google.com",
                "_netblocks3.google.com"
            ]
        },
        {
            "record": "v=spf1 ip4:35.190.247.0/24 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all",
            "authorized_ips": {
                "ipv4": [
                    "35.190.247.0/24",
                    "64.233.160.0/19",
                    "66.102.0.0/20",
                    "66.249.80.0/20",
                    "72.14.192.0/18",
                    "74.125.0.0/16",
                    "108.177.8.0/21",
                    "173.194.0.0/16",
                    "209.85.128.0/17",
                    "216.58.192.0/19",
                    "216.239.32.0/19"
                ]
            },
            "origin": "_netblocks.google.com",
            "chars_num": 223,
            "use_macro": false
        },
        {
            "record": "v=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all",
            "authorized_ips": {
                "ipv6": [
                    "2001:4860:4000::/36",
                    "2404:6800:4000::/36",
                    "2607:f8b0:4000::/36",
                    "2800:3f0:4000::/36",
                    "2a00:1450:4000::/36",
                    "2c0f:fb50:4000::/36"
                ]
            },
            "origin": "_netblocks2.google.com",
            "chars_num": 154,
            "use_macro": false
        },
        {
            "record": "v=spf1 ip4:172.217.0.0/19 ip4:172.217.32.0/20 ip4:172.217.128.0/19 ip4:172.217.160.0/20 ip4:172.217.192.0/19 ip4:172.253.56.0/21 ip4:172.253.112.0/20 ip4:108.177.96.0/19 ip4:35.191.0.0/16 ip4:130.211.0.0/22 ~all",
            "authorized_ips": {
                "ipv4": [
                    "172.217.0.0/19",
                    "172.217.32.0/20",
                    "172.217.128.0/19",
                    "172.217.160.0/20",
                    "172.217.192.0/19",
                    "172.253.56.0/21",
                    "172.253.112.0/20",
                    "108.177.96.0/19",
                    "35.191.0.0/16",
                    "130.211.0.0/22"
                ]
            },
            "origin": "_netblocks3.google.com",
            "chars_num": 211,
            "use_macro": false
        }
    ],
    "domains_extracted": [
        "_spf.google.com",
        "_netblocks.google.com",
        "_netblocks2.google.com",
        "_netblocks3.google.com"
    ],
    "authorized_ips": {
        "ipv4": [
            "35.190.247.0/24",
            "64.233.160.0/19",
            "66.102.0.0/20",
            "66.249.80.0/20",
            "72.14.192.0/18",
            "74.125.0.0/16",
            "108.177.8.0/21",
            "173.194.0.0/16",
            "209.85.128.0/17",
            "216.58.192.0/19",
            "216.239.32.0/19",
            "172.217.0.0/19",
            "172.217.32.0/20",
            "172.217.128.0/19",
            "172.217.160.0/20",
            "172.217.192.0/19",
            "172.253.56.0/21",
            "172.253.112.0/20",
            "108.177.96.0/19",
            "35.191.0.0/16",
            "130.211.0.0/22"
        ],
        "ipv6": [
            "2001:4860:4000::/36",
            "2404:6800:4000::/36",
            "2607:f8b0:4000::/36",
            "2800:3f0:4000::/36",
            "2a00:1450:4000::/36",
            "2c0f:fb50:4000::/36"
        ]
    },
    "issues_found": [],
    "spf_valid": true,
    "has_issues": false,
    "macros_found": false,
    "ip_pass": true,
    "elapsed_ms": 58
}
```

## Response fields

The fields returned in the JSON response:

- `host` (string): Host submitted for the SPF check.
- `has_spf_record` (boolean): Returns true if TXT SPF1 record is found.
- `dns_lookups_num` (integer): Number of DNS lookups performed.
- `spf_record` (string): TXT SPF1 record, e.g. v=spf1 redirect=_spf.google.com.
- `spf_records_list` (array): Array with details of each recursively-analyzed SPF record.
- `spf_records_list[n] → record` (string): The SPF record analyzed.
- `spf_records_list[n] → origin` (string): Domain where this SPF record was found (followed via include or redirect).
- `spf_records_list[n] → chars_num` (integer): Number of characters in the SPF record.
- `spf_records_list[n] → use_macro` (boolean): Returns true if this SPF record uses macros.
- `spf_records_list[n] → domains` (array): Domains referenced by this SPF record via include and redirect.
- `spf_records_list[n] → authorized_ips → ipv4` (array): IPv4 addresses and ranges authorized by this SPF record.
- `spf_records_list[n] → authorized_ips → ipv6` (array): IPv6 addresses and ranges authorized by this SPF record.
- `domains_extracted` (array): Array of domains extracted from include and redirect modifier.
- `authorized_ips` (object): Authorized sender addresses, grouped into `ipv4` and `ipv6` arrays.
- `authorized_ips → ipv4` (array): All IPv4 addresses and ranges authorized to send email for the domain.
- `authorized_ips → ipv6` (array): All IPv6 addresses and ranges authorized to send email for the domain.
- `issues_found` (array): Array of issues found, the "code" field can be SPF_NOT_FOUND, MULTIPLE_SPF_RECORDS, PTR_DEPRECATED, UPPERCASE_CHARACTERS, PLUS_ALL_FOUND, RECORD_TERMINATION_MISSING, DATA_AFTER_ALL, DATA_AFTER_REDIRECT, MULTIPLE_FALLBACKS, TOO_MANY_DNS_LOOKUPS, MULTIPLE_SPFV1_ON_SAME_RECORD, DUPLICATE_INCLUDE.
- `spf_valid` (boolean): Returns true if the SPF1 record is valid.
- `has_issues` (boolean): Returns true if we found issues on the SPF record.
- `macros_found` (boolean): Returns true if macros were found in any of the analyzed SPF records.
- `ip_pass` (boolean): Returns true if the IP submitted via "iptest" is authorized (ignore this field if you didn't set "iptest").
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/ssl-info-api/>

# SSL Info API Reference

Get detailed SSL certificate information of a host: owner, issuer, validity dates, and more.

Service details and pricing: [SSL Info API](https://www.apivoid.com/api/ssl-info/)

Endpoint: `POST https://api.apivoid.com/v2/ssl-info`

Credit cost: 1 credit per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/ssl-info" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"host": "paypal.com"}'
```

The same request in PHP:

```php
$host = 'paypal.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/ssl-info');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. google.com.

### Optional

- `port` (integer; Default: 443): SSL port to check. Must be between 443 and 65535.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "host": "paypal.com",
    "port": 443,
    "certificate": {
        "found": true,
        "debug_message": "",
        "fingerprint_sha1": "6f55d7d0b407cb6bb13bd14a1cbb105c0ee5c3d5",
        "fingerprint_sha256": "faf941ad6b7339463bcea590e77e39f7930a168eb6d130d79c3be12c5de83894",
        "type": "Extended Validation",
        "deprecated_issuer": false,
        "name_match": true,
        "blacklisted": false,
        "self_signed": false,
        "expired": false,
        "revoked": false,
        "valid": true,
        "details": {
            "subject": {
                "name": "SERIALNUMBER=3014267,CN=paypal.com,O=PayPal\\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553",
                "common_name": "paypal.com",
                "alternative_names": "paypal.com, paypal-workplace.com, xoom-experience.com, www.curv.cc, buyindiaonline.com, www.curv.co, curv.co, xoom.com, venmo-experience.com, sandbox.paypal.com, paypal.me, curv.cc, simility.com, paypal-experience.com, www.paypal.biz, www.simility.com, paypal.biz, cash2india.com, pypl.com, fastlane.paypal.com, paypal.co.uk, paypal.com.tr, paypal.ca, paypal-promo.es, paypal-marketing.co.uk, paypal-sverige.se, paypalgivingfund.org, paypal.com.hk, paypal.com.tw, paypalobjects.com, paypal-partners.com, paypal.se, PAYPAL.CO, paypal-nakit.com, paypal-mktg.com, paypal-marketing.ca, paypal-communications.com, paypal.fr, paypal.jp, paypal.no, paypal-donations.co.uk, paypal.be, paypal-passport.com, paypal.fi, paypal.nl, paypal-latam.com, paypal.vn, paypal-gifts.com, paypal.co.za, PAYPAL-MARKETING.PL, paypal.at, paypal-australia.com.au, paypal.co.in, paypal-danmark.dk, paypal-turkiye.com, paypal.co.il, paypal.com.cn, paypal-prepagata.com, paypal.es, paypal.eu, paypal.it, paypal.com.pe, paypal.in, paypal-business.com.au, paypal.co.id, paypal-globalshops.com, paypal-optimizer.com, paypal-mena.com, paypal-donations.com, paypal.ie, paypal.co.nz, paypal-media.com, paypal-information.com, paypal.com.sa, paypal-knowledge.com, paypal-businesscenter.com, paypal-community.com, PAYPAL-DEUTSCHLAND.DE, paypal.lu, PAYPAL.COM.MY, paypal.com.sg, paypal.dk, paypal.com.br, paypal.de, paypal-knowledge-test.com, paypal.pt, paypal.co.th, thepaypalblog.com, paypal-norge.no, paypal.pl, paypal.ph, paypal.com.ve, paypal.com.mx, paypal.cl, paypal-business.co.uk, paypal.com.au, paypalbenefits.com, paypal.ch, paypal.com.ar, paypal-support.com",
                "organization_unit": [],
                "organization": "PayPal, Inc.",
                "category": "Private Organization",
                "country": "US",
                "street": [],
                "postal_code": "",
                "state": "California",
                "location": "San Jose",
                "serial_number": "3014267",
                "inc_country": "US",
                "inc_state": "Delaware"
            },
            "issuer": {
                "common_name": "DigiCert EV RSA CA G2",
                "organization": "DigiCert Inc",
                "country": "US",
                "state": "",
                "location": "",
                "organization_unit": []
            },
            "public_key": {
                "algorithm": "RSA",
                "size": 2048
            },
            "crl_endpoints": [
                "http://crl3.digicert.com/DigiCertEVRSACAG2.crl",
                "http://crl4.digicert.com/DigiCertEVRSACAG2.crl"
            ],
            "signature": {
                "serial": "14728578715614846917259483520735530892",
                "serial_hex": "0B149EFF02F1C650CF59029012764F8C",
                "type": "SHA256-RSA"
            },
            "validity": {
                "days_left": 269,
                "expired_from_days": 0,
                "valid_from": "Mon, 26 Aug 2024 00:00:00 UTC",
                "valid_to": "Mon, 25 Aug 2025 23:59:59 UTC",
                "valid_from_timestamp": 1724630400,
                "valid_to_timestamp": 1756166399
            },
            "certificate_authority": false,
            "authority_key_id": "301680146a4e50bf98689d5b7b2075d45901794866923206",
            "subject_key_id": "04148d939fbf9c7cf8ba64066baa73bb814351b7dc41",
            "key_usages": [
                "Digital Signature",
                "Key Encipherment"
            ],
            "extended_key_usages": [
                "Server Authentication",
                "Client Authentication"
            ],
            "authority_info": [
                {
                    "location": "http://ocsp.digicert.com",
                    "method": "OCSP"
                },
                {
                    "location": "http://cacerts.digicert.com/DigiCertEVRSACAG2.crt",
                    "method": "CA Issuers"
                }
            ]
        }
    },
    "elapsed_ms": 289
}
```

## Response fields

The fields returned in the JSON response:

- `host` (string): Host submitted for the SSL check.
- `port` (integer): Port used for the SSL connection, e.g. 443.
- `certificate → found` (boolean): Returns true if a SSL certificate was found.
- `certificate → debug_message` (string): Debug or error details about the request, if any. Empty string if none.
- `certificate → fingerprint_sha1` (string): SHA-1 fingerprint of the certificate.
- `certificate → fingerprint_sha256` (string): SHA-256 fingerprint of the certificate.
- `certificate → type` (string): SSL certificate type, can be Domain Validation, Organization Validation or Extended Validation.
- `certificate → deprecated_issuer` (boolean): Returns true if the certificate was issued by a deprecated or distrusted certificate authority.
- `certificate → name_match` (boolean): Returns true if the certificate matches the submitted host name.
- `certificate → blacklisted` (boolean): Returns true if SSL certificate is blacklisted by [SSLBL](https://sslbl.abuse.ch/).
- `certificate → self_signed` (boolean): Returns true if the certificate is self-signed.
- `certificate → expired` (boolean): Returns true if the certificate is expired.
- `certificate → revoked` (boolean): Returns true if the certificate has been revoked.
- `certificate → valid` (boolean): Returns true if SSL certificate is valid.
- `certificate → details → subject → name` (string): Full subject distinguished name (DN) of the certificate.
- `certificate → details → subject → common_name` (string): Common Name (CN) of the certificate subject.
- `certificate → details → subject → alternative_names` (string): Subject Alternative Names (SANs) covered by the certificate, comma-separated.
- `certificate → details → subject → organization_unit` (array): Organizational Unit (OU) entries of the subject. Empty array if none.
- `certificate → details → subject → organization` (string): Organization (O) of the certificate subject. Empty string if not present.
- `certificate → details → subject → category` (string): Subject category for EV certificates, e.g. Private Organization. Empty string if not present.
- `certificate → details → subject → country` (string): Country (C) of the certificate subject. Empty string if not present.
- `certificate → details → subject → street` (array): Street address entries of the subject. Empty array if none.
- `certificate → details → subject → postal_code` (string): Postal code of the subject. Empty string if not present.
- `certificate → details → subject → state` (string): State or province (ST) of the certificate subject. Empty string if not present.
- `certificate → details → subject → location` (string): Locality (L) of the certificate subject. Empty string if not present.
- `certificate → details → subject → serial_number` (string): Subject serial number, typically present on EV certificates. Empty string if not present.
- `certificate → details → subject → inc_country` (string): Jurisdiction country of incorporation for EV certificates. Empty string if not present.
- `certificate → details → subject → inc_state` (string): Jurisdiction state of incorporation for EV certificates. Empty string if not present.
- `certificate → details → issuer → common_name` (string): Common Name (CN) of the certificate issuer.
- `certificate → details → issuer → organization` (string): Organization (O) of the certificate issuer.
- `certificate → details → issuer → country` (string): Country (C) of the certificate issuer.
- `certificate → details → issuer → state` (string): State or province (ST) of the certificate issuer. Empty string if not present.
- `certificate → details → issuer → location` (string): Locality (L) of the certificate issuer. Empty string if not present.
- `certificate → details → issuer → organization_unit` (array): Organizational Unit (OU) entries of the issuer. Empty array if none.
- `certificate → details → public_key → algorithm` (string): Public key algorithm, e.g. RSA or ECDSA.
- `certificate → details → public_key → size` (integer): Public key size, in bits (e.g. 2048).
- `certificate → details → crl_endpoints` (array): Certificate Revocation List (CRL) distribution point URLs.
- `certificate → details → signature → serial` (string): Certificate serial number, in decimal.
- `certificate → details → signature → serial_hex` (string): Certificate serial number, in hexadecimal (same format as `openssl x509 -serial`).
- `certificate → details → signature → type` (string): Signature algorithm of the certificate, e.g. SHA256-RSA.
- `certificate → details → validity → days_left` (integer): Days remaining until the certificate expires.
- `certificate → details → validity → expired_from_days` (integer): Days since the certificate expired; 0 if not expired.
- `certificate → details → validity → valid_from` (string): Start of the certificate validity period (UTC).
- `certificate → details → validity → valid_to` (string): End of the certificate validity period (UTC).
- `certificate → details → validity → valid_from_timestamp` (integer): Start of the validity period, as Unix timestamp.
- `certificate → details → validity → valid_to_timestamp` (integer): End of the validity period, as Unix timestamp.
- `certificate → details → certificate_authority` (boolean): Returns true if the certificate is a CA certificate.
- `certificate → details → authority_key_id` (string): Authority Key Identifier (AKID) extension value.
- `certificate → details → subject_key_id` (string): Subject Key Identifier (SKID) extension value.
- `certificate → details → key_usages` (array): Key usages allowed by the certificate, e.g. Digital Signature.
- `certificate → details → extended_key_usages` (array): Extended key usages of the certificate, e.g. Server Authentication.
- `certificate → details → authority_info` (array): Authority Information Access (AIA) endpoints; each item has method and location.
- `certificate → details → authority_info[n] → location` (string): URL of the AIA endpoint.
- `certificate → details → authority_info[n] → method` (string): AIA access method: CA Issuers or OCSP.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/tls-check-api/>

# TLS Check API Reference

Check which SSL/TLS protocol versions a host supports (SSLv2 to TLSv1.3), detect deprecated protocols, get an overall score, and optionally scan cipher suites.

Service details and pricing: [TLS Check API](https://www.apivoid.com/api/tls-check/)

Endpoint: `POST https://api.apivoid.com/v2/tls-check`

Credit cost: 4 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/tls-check" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"host": "stripe.com"}'
```

The same request in PHP:

```php
$host = 'stripe.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/tls-check');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `host` (string; Required): Host to submit, e.g. google.com.

### Optional

- `port` (integer; Default: 443): TLS port to check. Must be between 443 and 65535.
- `scan_ciphers` (boolean; Default: false; New; +1 Credit): Enable cipher suite scanning for all TLS protocols. Available on the Growth Plan and above. New response fields (when enabled): `ciphers`, `protocol_details`. Note: ⚠ Enabling this option costs 1 additional credit per successful request.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
   "host": "stripe.com",
   "ip": "198.202.176.231",
   "port": 443,
   "protocols": {
      "sslv2": {
         "enabled": false,
         "recommended_status": "disabled",
         "deprecated": true
      },
      "sslv3": {
         "enabled": false,
         "recommended_status": "disabled",
         "deprecated": true
      },
      "tlsv1.0": {
         "enabled": false,
         "recommended_status": "disabled",
         "deprecated": true
      },
      "tlsv1.1": {
         "enabled": false,
         "recommended_status": "disabled",
         "deprecated": true
      },
      "tlsv1.2": {
         "enabled": true,
         "recommended_status": "enabled",
         "deprecated": false
      },
      "tlsv1.3": {
         "enabled": true,
         "recommended_status": "enabled",
         "deprecated": false
      }
   },
   "connected": true,
   "score": "excellent",
   "elapsed_ms": 745
}
```

## Response fields

The fields returned in the JSON response:

- `host` (string): Host submitted for the TLS check.
- `ip` (string): IP address the host resolved to.
- `port` (integer): Port used for the TLS check, e.g. 443.
- `protocols` (object): Status of each SSL/TLS protocol version, keyed by protocol name.
- `protocols → [protocol] → enabled` (boolean): Returns true if the protocol version is enabled on the server.
- `protocols → [protocol] → recommended_status` (string): Recommended status for the protocol, can be enabled/disabled.
- `protocols → [protocol] → deprecated` (boolean): Returns true if the protocol version is deprecated.
- `connected` (boolean): Returns true if a TLS connection to the server was established.
- `score` (string): Overall TLS configuration score, e.g. excellent, moderate, poor.
- `ciphers` (object; With: scan_ciphers): Supported ciphers grouped by protocol version, keyed by protocol name (e.g. tlsv1.2, tlsv1.3).
- `ciphers → [protocol] → ciphers` (array; With: scan_ciphers): List of ciphers tested for this protocol; each item has name, hex_code, supported, key_exchange, bits and forward_secrecy.
- `ciphers → [protocol] → summary → insecure_cipher_count` (integer; With: scan_ciphers): Number of insecure ciphers supported.
- `ciphers → [protocol] → summary → weak_cipher_count` (integer; With: scan_ciphers): Number of weak ciphers supported.
- `ciphers → [protocol] → summary → strong_cipher_count` (integer; With: scan_ciphers): Number of strong ciphers supported.
- `ciphers → [protocol] → summary → total_supported` (integer; With: scan_ciphers): Total number of ciphers supported for this protocol.
- `protocol_details → secure_renegotiation` (boolean; With: scan_ciphers): Returns true if secure renegotiation is supported.
- `protocol_details → forward_secrecy` (boolean; With: scan_ciphers): Returns true if forward secrecy is supported.
- `protocol_details → rc4` (boolean; With: scan_ciphers): Returns true if RC4 ciphers are supported.
- `protocol_details → ocsp_stapling` (boolean; With: scan_ciphers): Returns true if OCSP stapling is enabled.
- `protocol_details → alpn` (boolean; With: scan_ciphers): Returns true if ALPN is supported.
- `protocol_details → alpn_protocols` (array; With: scan_ciphers): ALPN protocols advertised by the server, e.g. h2.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

## Optional response fields

Optional request parameters add extra fields to the JSON response, example:

```json
{
  "host": "stripe.com",
  "scan_ciphers": true
}
```

Each enabled option adds the following fields to the response:

- `scan_ciphers` adds `ciphers`, `protocol_details` (Top level: top level of the response)

Example response for the request payload above:

```json
{
   "host": "stripe.com",
   "ip": "198.202.176.231",
   "port": 443,
   "protocols": {
      "sslv2": {
         "enabled": false,
         "recommended_status": "disabled",
         "deprecated": true
      },
      "sslv3": {
         "enabled": false,
         "recommended_status": "disabled",
         "deprecated": true
      },
      "tlsv1.0": {
         "enabled": false,
         "recommended_status": "disabled",
         "deprecated": true
      },
      "tlsv1.1": {
         "enabled": false,
         "recommended_status": "disabled",
         "deprecated": true
      },
      "tlsv1.2": {
         "enabled": true,
         "recommended_status": "enabled",
         "deprecated": false
      },
      "tlsv1.3": {
         "enabled": true,
         "recommended_status": "enabled",
         "deprecated": false
      }
   },
   "connected": true,
   "score": "excellent",
   "ciphers": {
      "tlsv1.3": {
         "ciphers": [
            {
               "name": "TLS_AES_128_GCM_SHA256",
               "hex_code": "0x1301",
               "supported": true,
               "key_exchange": "ECDH",
               "bits": 128,
               "forward_secrecy": true
            },
            {
               "name": "TLS_AES_256_GCM_SHA384",
               "hex_code": "0x1302",
               "supported": true,
               "key_exchange": "ECDH",
               "bits": 256,
               "forward_secrecy": true
            },
            {
               "name": "TLS_CHACHA20_POLY1305_SHA256",
               "hex_code": "0x1303",
               "supported": true,
               "key_exchange": "ECDH",
               "bits": 256,
               "forward_secrecy": true
            }
         ],
         "summary": {
            "insecure_cipher_count": 0,
            "weak_cipher_count": 0,
            "strong_cipher_count": 3,
            "total_supported": 3
         }
      },
      "tlsv1.2": {
         "ciphers": [
            {
               "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
               "hex_code": "0xc030",
               "supported": true,
               "key_exchange": "ECDH",
               "bits": 256,
               "forward_secrecy": true
            },
            {
               "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
               "hex_code": "0xc02f",
               "supported": true,
               "key_exchange": "ECDH",
               "bits": 128,
               "forward_secrecy": true
            },
            {
               "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
               "hex_code": "0xcca8",
               "supported": true,
               "key_exchange": "ECDH",
               "bits": 256,
               "forward_secrecy": true
            },
            {
               "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
               "hex_code": "0xc02b",
               "supported": true,
               "key_exchange": "ECDH",
               "bits": 128,
               "forward_secrecy": true
            },
            {
               "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
               "hex_code": "0xcca9",
               "supported": true,
               "key_exchange": "ECDH",
               "bits": 256,
               "forward_secrecy": true
            },
            {
               "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
               "hex_code": "0xc014",
               "supported": true,
               "key_exchange": "ECDH",
               "bits": 256,
               "forward_secrecy": true,
               "weak": true
            },
            {
               "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
               "hex_code": "0xc013",
               "supported": true,
               "key_exchange": "ECDH",
               "bits": 128,
               "forward_secrecy": true,
               "weak": true
            },
            {
               "name": "TLS_RSA_WITH_AES_256_GCM_SHA384",
               "hex_code": "0x009d",
               "supported": true,
               "key_exchange": "RSA",
               "bits": 256,
               "weak": true
            },
            {
               "name": "TLS_RSA_WITH_AES_128_GCM_SHA256",
               "hex_code": "0x009c",
               "supported": true,
               "key_exchange": "RSA",
               "bits": 128,
               "weak": true
            },
            {
               "name": "TLS_RSA_WITH_AES_256_CBC_SHA",
               "hex_code": "0x0035",
               "supported": true,
               "key_exchange": "RSA",
               "bits": 256,
               "weak": true
            },
            {
               "name": "TLS_RSA_WITH_AES_128_CBC_SHA",
               "hex_code": "0x002f",
               "supported": true,
               "key_exchange": "RSA",
               "bits": 128,
               "weak": true
            }
         ],
         "summary": {
            "insecure_cipher_count": 0,
            "weak_cipher_count": 6,
            "strong_cipher_count": 5,
            "total_supported": 11
         }
      },
      "tlsv1.1": {
         "ciphers": [],
         "summary": {
            "insecure_cipher_count": 0,
            "weak_cipher_count": 0,
            "strong_cipher_count": 0,
            "total_supported": 0
         }
      },
      "tlsv1.0": {
         "ciphers": [],
         "summary": {
            "insecure_cipher_count": 0,
            "weak_cipher_count": 0,
            "strong_cipher_count": 0,
            "total_supported": 0
         }
      }
   },
   "protocol_details": {
      "secure_renegotiation": true,
      "forward_secrecy": true,
      "rc4": false,
      "ocsp_stapling": false,
      "alpn": true,
      "alpn_protocols": [
         "h2"
      ]
   },
   "elapsed_ms": 402
}
```

---

Source: <https://docs.apivoid.com/tor-test-api/>

# Tor Test API Reference

Check if a website is accessible from the Tor network: the URL is requested through a Tor exit node and the API returns the HTTP status code, response headers and page details as seen from Tor. Useful to verify whether a site blocks or challenges Tor visitors.

Service details and pricing: [Tor Test API](https://www.apivoid.com/api/tor-test/)

Endpoint: `POST https://api.apivoid.com/v2/tor-test`

Credit cost: 10 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/tor-test" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"url": "https://www.nvidia.com/"}'
```

The same request in PHP:

```php
$url = 'https://www.nvidia.com/';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/tor-test');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['url' => $url]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `url` (string; Required): URL to submit, e.g. `https://www.nvidia.com/`. Note: ⚠ Government and educational domains are blocked.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "url": "https://www.nvidia.com/",
    "accessible": false,
    "status_code": 403,
    "debug_message": "",
    "response_headers": {
        "content-length": "366",
        "content-type": "text/html",
        "date": "Fri, 28 Mar 2025 15:20:54 GMT",
        "expires": "Fri, 28 Mar 2025 15:20:54 GMT",
        "last-modified": "Fri, 28 Mar 2025 15:20:54 GMT",
        "mime-version": "1.0",
        "server": "AkamaiGHost",
        "set-cookie": "c_code=DE; Path=/; Secure",
        "x-cache-status": "Error from child",
        "x-cdn": "akam",
        "x-cdn-version": "v373"
    },
    "html_info": {
        "title": "Access Denied",
        "description": ""
    },
    "elapsed_ms": 678
}
```

## Response fields

The fields returned in the JSON response:

- `url` (string): URL submitted for the Tor accessibility test.
- `accessible` (boolean): Returns true if the URL is accessible from the Tor network.
- `status_code` (integer): HTTP status code returned by the server.
- `debug_message` (string): Debug or error details about the request, if any. Empty string if none.
- `response_headers` (object): HTTP response headers returned by the server to the Tor exit node, keyed by lowercase header name.
- `html_info → title` (string): Title of the page returned to the Tor exit node.
- `html_info → description` (string): Meta description of the page returned to the Tor exit node.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/url-reputation-api/>

# URL Reputation API Reference

Check the safety reputation and risk score of a URL using unique URL security checks, with detailed detection and website analysis data.

Service details and pricing: [URL Reputation API](https://www.apivoid.com/api/url-reputation/)

Endpoint: `POST https://api.apivoid.com/v2/url-reputation`

Credit cost: 5 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/url-reputation" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"url": "https://blog.google/products/android/"}'
```

The same request in PHP:

```php
$url = 'https://blog.google/products/android/';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/url-reputation');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['url' => $url]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `url` (string; Required): URL to submit, e.g. `https://www.example.com/index.html`.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "url": "https://blog.google/products/android/",
    "dns_records": {
        "ns": [
            {
                "target": "ns2.zdns.google",
                "ip": "216.239.34.114",
                "country_code": "US",
                "country_name": "United States of America",
                "isp": "Google LLC"
            },
            {
                "target": "ns1.zdns.google",
                "ip": "216.239.32.114",
                "country_code": "US",
                "country_name": "United States of America",
                "isp": "Google LLC"
            },
            {
                "target": "ns4.zdns.google",
                "ip": "216.239.38.114",
                "country_code": "US",
                "country_name": "United States of America",
                "isp": "Google LLC"
            },
            {
                "target": "ns3.zdns.google",
                "ip": "216.239.36.114",
                "country_code": "US",
                "country_name": "United States of America",
                "isp": "Google LLC"
            }
        ],
        "mx": [
            {
                "target": "smtp.google.com",
                "ip": "142.251.107.26",
                "country_code": "US",
                "country_name": "United States of America",
                "isp": "Google LLC"
            }
        ],
        "cname": ""
    },
    "domain_blacklist": {
        "engines": {
            "0": {
                "name": "ANJ Blocked Sites",
                "detected": false,
                "reference": "https://anj.fr/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "1": {
                "name": "AntiSocial Blacklist",
                "detected": false,
                "reference": "https://theantisocialengineer.com/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "2": {
                "name": "APVA",
                "detected": false,
                "reference": "https://www.antiphish.org/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "3": {
                "name": "Artists Against 419",
                "detected": false,
                "reference": "https://wiki.aa419.org/index.php/Main_Page",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "4": {
                "name": "AZORult Tracker",
                "detected": false,
                "reference": "https://azorult-tracker.net/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "5": {
                "name": "Badbitcoin",
                "detected": false,
                "reference": "https://badbitcoin.org/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "6": {
                "name": "Bambenek Consulting",
                "detected": false,
                "reference": "https://www.bambenekconsulting.com/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "7": {
                "name": "CERT Polska",
                "detected": false,
                "reference": "https://www.cert.pl/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "8": {
                "name": "COI CZ",
                "detected": false,
                "reference": "https://coi.gov.cz/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "9": {
                "name": "CryptoScamDB",
                "detected": false,
                "reference": "https://cryptoscamdb.org/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            "10": {
                "name": "EtherAddressLookup",
                "detected": false,
                "reference": "https://github.com/409H/EtherAddressLookup/",
                "confidence": "high",
                "elapsed_ms": 0
            },
            ...
        },
        "detections": 0,
        "engines_count": 42,
        "detection_rate": "0%",
        "scan_time_ms": 119
    },
    "domain_parts": {
        "root_domain": "blog.google",
        "subdomain": "",
        "tld": "google"
    },
    "file_type": {
        "signature": "HTML",
        "extension": "",
        "headers": "HTML"
    },
    "geo_location": {
        "countries": [
            "US"
        ]
    },
    "html_info": {
        "title": "Official Android news and updates | Google Blog",
        "description": "Read the latest news and updates about Android, the world's most popular mobile platform.",
        "keywords": "",
        "robots": "",
        "canonical": "https://blog.google/products/android/",
        "og_image": "https://storage.googleapis.com/gweb-uniblog-publish-prod/images/3D_DROID_HEAD_200x200.max-1440x810.jpg",
        "article_publisher": "",
        "og_site_name": "blog.google",
        "twitter_site": "@google",
        "generator": "",
        "ld_organization": "",
        "lang": "en-us"
    },
    "redirection": {
        "found": false,
        "external": false,
        "url": "",
        "redirects": []
    },
    "response_headers": {
        "code": 200,
        "status": "HTTP/2 200",
        "content-type": "text/html; charset=utf-8",
        "vary": "Accept-Encoding",
        "content-security-policy": "require-trusted-types-for 'script'; connect-src 'self' cdn.ampproject.org *.google.com storage.googleapis.com https://services.google.com/fb/submissions/thekeywordtest/ https://services.google.com/fb/submissions/0a65d7733e1f11ea9701614fc033d30c/ *.gstatic.com gstatic.com *.cdn.ampproject.org *.doubleclick.net https://readaloud.googleapis.com/ *.google-analytics.com https://www.youtube.com/; img-src * data: blob:; font-src 'self' themes.googleusercontent.com *.gstatic.com https://fonts.gstatic.com storage.googleapis.com fonts.googleapis.com *.cdn.ampproject.org; style-src 'self' 'unsafe-inline' fonts.googleapis.com *.gstatic.com storage.googleapis.com *.google.com cdn.ampproject.org; object-src 'none'; media-src 'self' data: *.gstatic.com storage.googleapis.com *.googlevideo.com; base-uri 'none'; script-src 'self' 'strict-dynamic' 'unsafe-inline' *.googleanalytics.com *.google-analytics.com *.youtube.com youtube.com optimize.google.com https://s.ytimg.com *.googletagmanager.com storage.googleapis.com *.googleapis.com *.google.com cdn.ampproject.org *.gstatic.com gstatic.com googleadservices.com *.googleadservices.com 'sha256-hdPneczWRi+c9LQVo+PzNzlNr9TacChC0CW0fiDBHkI=' 'sha256-DE/j4w1a1HDIXysWgFTrJCJK6JWEcHqScfyMr9zq9R4=' 'sha256-Ehy9lGqrTi8OqqWxX1HN6hKJT7iwwYMFJ+HLjpEobO0=' 'sha256-s/yvuH0ZHyO+7N8dM5CshPem4K1PknDExYN18xHq0LI=' 'sha256-MWQdkIAX5J//suH1t5P3PFFwFUiphY0PxD6VVzbBehQ=' 'sha256-587vJAV9t9k86IMQixmyKa7lbPaDhkGzrJsdngtoiAA=' 'sha256-nlbIOie3vmdUUZjQFDMa7iipxS6Qst8pPhTLjibMsRk=' 'sha256-+LJ+tgqOXIri3+D/uJC785tov3eXewv8x+Pkenx+3Z8=' 'sha256-PnD9J8UK8zpwVizQXkEtbZOvTiv9C/05Nn81NEwPBoQ=' 'sha256-LH1mE8uiAlSGs6/ejmL47sTk8G+/Hh6T1ydVxa0idaM=' 'sha256-GuPeLJgWIkkS7hCKcSc+mQs6jTN0D8QzfW624B4OMME=' 'sha256-CDqe41szG4ZmAxS54wSNKisRTrwu1wxcuRQv09PB3Nk=' 'sha256-Xyk5Ei/Yh7DuZgaxNfbPswkpmMKHk5Jy18vkxjfPMj0=' 'sha256-Q+8W9SyZ6wnayM05rLv0YuHooUH/nnzpE2XQZJ/ekjY=' 'sha256-1lOrojGb+aoV56bZpsODLpb+j+HHbONNEpX/YqVtiUU=' 'sha256-sAsQphoZozaLVFpcda3bvT5euqcGL4MqVnizAR+Xla4=' 'sha256-ZlqdbaXB1F4Evuv/nmY3QGBLFBbrfiNndyYxbgdQn7g=' 'sha256-OEwIbDcQTxJYhU2ONmKA0LutIDdkmge2c+9IPFv5vFE=' 'sha256-Iz9ZZz/rHQFiJs2bKOHSC82gR0WdD/37qrPCB65PCFg='; frame-src 'self' www.google.com *.youtube.com youtube.com accounts.google.com *.doubleclick.net apis.google.com optimize.google.com *.google.com *.cdn.ampproject.org https://www.gstatic.com/ https://www.youtube-nocookie.com/; default-src 'self' *.gstatic.com storage.googleapis.com",
        "content-language": "en-us",
        "access-control-allow-origin": "*",
        "content-encoding": "gzip",
        "x-cloud-trace-context": "3578b5662a689995c0760c7d9e7f155c",
        "date": "Fri, 19 Dec 2025 22:37:38 GMT",
        "server": "Google Frontend",
        "content-length": "63300"
    },
    "risk_score": {
        "result": 0
    },
    "security_checks": {
        "is_host_an_ipv4": false,
        "is_uncommon_host_length": false,
        "is_uncommon_dash_char_count": false,
        "is_uncommon_dot_char_count": false,
        "is_suspicious_url_pattern": false,
        "is_suspicious_file_extension": false,
        "is_robots_noindex": false,
        "is_suspended_page": false,
        "is_most_abused_tld": false,
        "is_uncommon_clickable_url": false,
        "is_phishing_heuristic": false,
        "is_possible_emotet": false,
        "is_redirect_to_search_engine": false,
        "is_redirect_to_wikipedia": false,
        "http_status_code": 200,
        "is_http_status_error": false,
        "is_http_server_error": false,
        "is_http_client_error": false,
        "is_suspicious_content": false,
        "is_url_accessible": true,
        "is_empty_page_title": false,
        "is_empty_page_content": false,
        "is_domain_ipv4_assigned": true,
        "is_domain_ipv4_private": false,
        "is_domain_ipv4_loopback": false,
        "is_domain_ipv4_reserved": false,
        "is_domain_ipv4_valid": true,
        "is_domain_blacklisted": false,
        "is_suspicious_domain": false,
        "is_sinkholed_domain": false,
        "is_defaced_heuristic": false,
        "is_masked_file": false,
        "is_risky_geo_location": false,
        "is_china_country": false,
        "is_nigeria_country": false,
        "is_non_standard_port": false,
        "is_email_address_on_url_query": false,
        "is_directory_listing": false,
        "is_exe_on_directory_listing": false,
        "is_zip_on_directory_listing": false,
        "is_php_on_directory_listing": false,
        "is_doc_on_directory_listing": false,
        "is_pdf_on_directory_listing": false,
        "is_apk_on_directory_listing": false,
        "is_linux_elf_file": false,
        "is_linux_elf_file_on_free_dynamic_dns": false,
        "is_linux_elf_file_on_free_hosting": false,
        "is_linux_elf_file_on_ipv4": false,
        "is_masked_linux_elf_file": false,
        "is_masked_windows_exe_file": false,
        "is_ms_office_file": false,
        "is_windows_exe_file_on_free_dynamic_dns": false,
        "is_windows_exe_file_on_free_hosting": false,
        "is_windows_exe_file_on_ipv4": false,
        "is_windows_exe_file": false,
        "is_android_apk_file_on_free_dynamic_dns": false,
        "is_android_apk_file_on_free_hosting": false,
        "is_android_apk_file_on_ipv4": false,
        "is_android_apk_file": false,
        "is_external_redirect": false,
        "is_risky_category": false,
        "is_domain_recent": "no",
        "is_domain_very_recent": "no",
        "domain_creation_date": "2016-08-12",
        "domain_age_in_days": 3416,
        "domain_age_in_months": 110,
        "domain_age_in_years": 9,
        "is_credit_card_field": false,
        "is_email_field": false,
        "is_password_field": false,
        "is_valid_https": true,
        "is_ssl_blacklisted": false
    },
    "server_details": {
        "ip": "216.239.34.21",
        "hostname": "any-in-2215.1e100.net",
        "continent_code": "NA",
        "continent_name": "North America",
        "country_code": "US",
        "country_name": "United States of America",
        "region_name": "California",
        "city_name": "Mountain View",
        "latitude": 37.38605,
        "longitude": -122.08385,
        "isp": "Google LLC",
        "asn": "AS15169"
    },
    "site_category": {
        "is_free_hosting": false,
        "is_anonymizer": false,
        "is_url_shortener": false,
        "is_free_dynamic_dns": false,
        "is_code_sandbox": false,
        "is_form_builder": false,
        "is_free_file_sharing": false,
        "is_pastebin": false
    },
    "url_parts": {
        "scheme": "https",
        "host": "blog.google",
        "host_nowww": "blog.google",
        "port": 443,
        "path": "/products/android/",
        "query": ""
    },
    "elapsed_ms": 1385
}
```

## Response fields

The fields returned in the JSON response:

- `url` (string): URL submitted for the reputation analysis.
- `dns_records → ns` (array): NS records of the domain; each item has target, ip, country_code, country_name and isp.
- `dns_records → ns[n] → target` (string): Name server hostname.
- `dns_records → ns[n] → ip` (string): IPv4 address of the name server.
- `dns_records → ns[n] → country_code` (string): Country code (e.g. US) of the name server IP address.
- `dns_records → ns[n] → country_name` (string): Country name of the name server IP address.
- `dns_records → ns[n] → isp` (string): Internet Service Provider (ISP) of the name server IP address.
- `dns_records → mx` (array): MX records of the domain; each item has target, ip, country_code, country_name and isp.
- `dns_records → mx[n] → target` (string): Mail server hostname.
- `dns_records → mx[n] → ip` (string): IPv4 address of the mail server.
- `dns_records → mx[n] → country_code` (string): Country code (e.g. US) of the mail server IP address.
- `dns_records → mx[n] → country_name` (string): Country name of the mail server IP address.
- `dns_records → mx[n] → isp` (string): Internet Service Provider (ISP) of the mail server IP address.
- `dns_records → cname` (string): CNAME target of the host. Empty string if none.
- `domain_blacklist → engines` (object): List of scanning engines; each item has name, detected, reference, confidence and elapsed_ms.
- `domain_blacklist → engines → [index] → name` (string): Name of the scanning engine.
- `domain_blacklist → engines → [index] → detected` (boolean): Returns true if this engine flagged the submitted domain.
- `domain_blacklist → engines → [index] → reference` (string): Link to the engine's website or listing details.
- `domain_blacklist → engines → [index] → confidence` (string): Confidence of this engine detection, e.g. high.
- `domain_blacklist → engines → [index] → elapsed_ms` (integer): Time taken by this engine to complete its check, in milliseconds.
- `domain_blacklist → detections` (integer): Number of scanning engines that detected the domain.
- `domain_blacklist → engines_count` (integer): Number of scanning engines used to scan the domain.
- `domain_blacklist → detection_rate` (string): Percentage of engines that detected the domain, e.g. 5%.
- `domain_blacklist → scan_time_ms` (integer): Time taken to scan the domain across all engines, in milliseconds.
- `domain_parts → root_domain` (string): Registered root domain (e.g. `example.com`), excluding subdomains.
- `domain_parts → subdomain` (string): Subdomain portion of the host (e.g. `www`). Empty string if none.
- `domain_parts → tld` (string): Top-level domain (e.g. `com`, `org`, `co.uk`).
- `file_type → signature` (string): Returns file type by analyzing file content.
- `file_type → extension` (string): Returns file type by analyzing file extension.
- `file_type → headers` (string): Returns file type by analyzing HTTP response headers.
- `geo_location → countries` (array): List of potential countries of origin.
- `html_info → title` (string): Title of the page.
- `html_info → description` (string): Meta description of the page.
- `html_info → keywords` (string): Contents of the `meta keywords` tag.
- `html_info → robots` (string): Robots meta tag of the page.
- `html_info → canonical` (string): Canonical URL of the page.
- `html_info → og_image` (string): Open Graph image URL of the page.
- `html_info → article_publisher` (string): Contents of the article:publisher Open Graph tag. Empty string if none.
- `html_info → og_site_name` (string): Open Graph site name of the page.
- `html_info → twitter_site` (string): Twitter site handle of the page.
- `html_info → generator` (string): CMS or framework from `meta generator` tag (e.g. WordPress).
- `html_info → ld_organization` (string): Organization name found in JSON-LD structured data.
- `html_info → lang` (string): Language declared by the page, e.g. en-US.
- `redirection → found` (boolean): Returns true if the URL redirects to another URL.
- `redirection → external` (boolean): Returns true if the redirect points to an external host.
- `redirection → url` (string): Destination URL of the redirect. Empty string if none.
- `redirection → redirects` (array): List of redirect URLs followed. Empty array if none.
- `response_headers` (object): HTTP response headers returned by the server, keyed by lowercase header name.
- `risk_score → result` (integer): Returns risk score, a number between 0 (safe) and 100 (dangerous).
- `security_checks → is_host_an_ipv4` (boolean): Returns true if the URL host is an IPv4 address instead of a domain.
- `security_checks → is_uncommon_host_length` (boolean): Returns true if the host length is uncommon (such as, a very long domain).
- `security_checks → is_uncommon_dash_char_count` (boolean): Returns true if the host contains too many dash "-" characters.
- `security_checks → is_uncommon_dot_char_count` (boolean): Returns true if the host contains too many dot "." characters.
- `security_checks → is_suspicious_url_pattern` (boolean): Returns true if URL pattern is suspicious.
- `security_checks → is_suspicious_file_extension` (boolean): Returns true if URL file extension is suspicious.
- `security_checks → is_robots_noindex` (boolean): Returns true if URL "doesn't want" to be indexed on Google.
- `security_checks → is_suspended_page` (boolean): Returns true if the web page has been suspended by the hosting provider.
- `security_checks → is_most_abused_tld` (boolean): Returns true if the domain TLD is risky, e.g. .top or .tk.
- `security_checks → is_uncommon_clickable_url` (boolean): Returns true if the URL is not a commonly clickable URL.
- `security_checks → is_phishing_heuristic` (boolean): Returns true if URL content matches our phishing rules.
- `security_checks → is_possible_emotet` (boolean): Returns true if URL is potentially related to Emotet.
- `security_checks → is_redirect_to_search_engine` (boolean): Returns true if URL redirects to search engines, like google.com.
- `security_checks → is_redirect_to_wikipedia` (boolean): Returns true if the URL redirects to Wikipedia.
- `security_checks → http_status_code` (integer): HTTP status code returned by the website, e.g. 200.
- `security_checks → is_http_status_error` (boolean): Returns true if the HTTP status code is an error (4xx or 5xx).
- `security_checks → is_http_server_error` (boolean): Returns true if the HTTP status code is a server error (5xx).
- `security_checks → is_http_client_error` (boolean): Returns true if the HTTP status code is a client error (4xx).
- `security_checks → is_suspicious_content` (boolean): Returns true if URL content matches our suspicious content rules.
- `security_checks → is_url_accessible` (boolean): Returns true if URL is accessible by our servers (status code is 2xx or 3xx).
- `security_checks → is_empty_page_title` (boolean): Returns true if URL page title is empty.
- `security_checks → is_empty_page_content` (boolean): Returns true if URL page content is empty.
- `security_checks → is_domain_ipv4_assigned` (boolean): Returns true if the domain resolves to an assigned IPv4 address.
- `security_checks → is_domain_ipv4_private` (boolean): Returns true if the domain resolves to a private IPv4 address.
- `security_checks → is_domain_ipv4_loopback` (boolean): Returns true if the domain resolves to a loopback (e.g. 127.0.0.1) IPv4 address.
- `security_checks → is_domain_ipv4_reserved` (boolean): Returns true if the domain resolves to a reserved IPv4 address.
- `security_checks → is_domain_ipv4_valid` (boolean): Returns true if the domain resolves to a valid public IPv4 address.
- `security_checks → is_domain_blacklisted` (boolean): Returns true if domain is blacklisted by trusted sources.
- `security_checks → is_suspicious_domain` (boolean): Returns true if domain matches our suspicious domain rules.
- `security_checks → is_sinkholed_domain` (boolean): Returns true if domain is sinkholed (malicious).
- `security_checks → is_defaced_heuristic` (boolean): Returns true if URL page has been defaced (we use our own rules).
- `security_checks → is_masked_file` (boolean): Returns true if remote file content does not match its extension.
- `security_checks → is_risky_geo_location` (boolean): Returns true if website location is considered risky.
- `security_checks → is_china_country` (boolean): Returns true if website is potentially located in China.
- `security_checks → is_nigeria_country` (boolean): Returns true if website is potentially located in Nigeria.
- `security_checks → is_non_standard_port` (boolean): Returns true if remote port is a non-standard port.
- `security_checks → is_email_address_on_url_query` (boolean): Returns true if an email address is found in the URL query string.
- `security_checks → is_directory_listing` (boolean): Returns true if URL page is a directory listing.
- `security_checks → is_exe_on_directory_listing` (boolean): Returns true if an EXE file is found in the directory listing.
- `security_checks → is_zip_on_directory_listing` (boolean): Returns true if a .zip file is found on an open directory listing.
- `security_checks → is_php_on_directory_listing` (boolean): Returns true if a .php file is found on an open directory listing.
- `security_checks → is_doc_on_directory_listing` (boolean): Returns true if a .doc file is found on an open directory listing.
- `security_checks → is_pdf_on_directory_listing` (boolean): Returns true if a .pdf file is found on an open directory listing.
- `security_checks → is_apk_on_directory_listing` (boolean): Returns true if a .apk file is found on an open directory listing.
- `security_checks → is_linux_elf_file` (boolean): Returns true if remote file is an ELF (executable) linux file.
- `security_checks → is_linux_elf_file_on_free_dynamic_dns` (boolean): Returns true if the URL serves a Linux ELF file hosted on a free dynamic DNS domain.
- `security_checks → is_linux_elf_file_on_free_hosting` (boolean): Returns true if the URL serves a Linux ELF file hosted on a free hosting service.
- `security_checks → is_linux_elf_file_on_ipv4` (boolean): Returns true if remote URL is an ELF file on an IPv4 host.
- `security_checks → is_masked_linux_elf_file` (boolean): Returns true if the URL serves a Linux ELF file masked with a different file extension.
- `security_checks → is_masked_windows_exe_file` (boolean): Returns true if remote EXE file is masked with wrong file extension.
- `security_checks → is_ms_office_file` (boolean): Returns true if the URL serves a Microsoft Office file.
- `security_checks → is_windows_exe_file_on_free_dynamic_dns` (boolean): Returns true if the URL serves a Windows executable hosted on a free dynamic DNS domain.
- `security_checks → is_windows_exe_file_on_free_hosting` (boolean): Returns true if the URL serves a Windows executable hosted on a free hosting service.
- `security_checks → is_windows_exe_file_on_ipv4` (boolean): Returns true if the URL serves a Windows executable hosted on a bare IPv4 address.
- `security_checks → is_windows_exe_file` (boolean): Returns true if remote file is an EXE (executable) Windows file.
- `security_checks → is_android_apk_file_on_free_dynamic_dns` (boolean): Returns true if the URL serves an Android APK file hosted on a free dynamic DNS domain.
- `security_checks → is_android_apk_file_on_free_hosting` (boolean): Returns true if the URL serves an Android APK file hosted on a free hosting service.
- `security_checks → is_android_apk_file_on_ipv4` (boolean): Returns true if the URL serves an Android APK file hosted on a bare IPv4 address.
- `security_checks → is_android_apk_file` (boolean): Returns true if the URL serves an Android APK file.
- `security_checks → is_external_redirect` (boolean): Returns true if the URL redirects to an external website.
- `security_checks → is_risky_category` (boolean): Returns true if domain is a free DNS provider, free hosting provider or URL shortener.
- `security_checks → is_domain_recent` (string): Returns "yes" if domain was created less than 6 months ago, can be yes/no/unknown.
- `security_checks → is_domain_very_recent` (string): Returns "yes" if domain was created less than 30 days ago, can be yes/no/unknown.
- `security_checks → domain_creation_date` (string): Domain registration date, format is Y-m-d (empty if unknown).
- `security_checks → domain_age_in_days` (integer): Age of the domain in days (0 if unknown).
- `security_checks → domain_age_in_months` (integer): Age of the domain in months (0 if unknown).
- `security_checks → domain_age_in_years` (integer): Age of the domain in years (0 if unknown).
- `security_checks → is_credit_card_field` (boolean): Returns true if the web page contains credit card input fields.
- `security_checks → is_email_field` (boolean): Returns true if the web page contains an email input field.
- `security_checks → is_password_field` (boolean): Returns true if the web page contains password input fields.
- `security_checks → is_valid_https` (boolean): Returns true if the URL HTTPS (SSL) is valid.
- `security_checks → is_ssl_blacklisted` (boolean): Returns true if the SSL certificate is blacklisted by trusted sources.
- `server_details → ip` (string): IP address of the submitted host.
- `server_details → hostname` (string): Reverse DNS hostname (PTR record) of the host's IP address. Empty string if none.
- `server_details → continent_code` (string): Continent code (e.g. NA) of where the host's IP address is located.
- `server_details → continent_name` (string): Continent name (e.g. North America) of where the host's IP address is located.
- `server_details → country_code` (string): Country code (e.g. CN) of where the host's IP address is located.
- `server_details → country_name` (string): Country name of where the host's IP address is located.
- `server_details → region_name` (string): Region or state name of where the host's IP address is located.
- `server_details → city_name` (string): City name of where the host's IP address is located.
- `server_details → latitude` (float): Approximate latitude of the host's IP address.
- `server_details → longitude` (float): Approximate longitude of the host's IP address.
- `server_details → isp` (string): Internet Service Provider (ISP) of host's IP address.
- `server_details → asn` (string): IP Autonomous System Number (ASN), such as AS16509.
- `site_category → is_free_hosting` (boolean): Returns true if the site is a known free hosting service.
- `site_category → is_anonymizer` (boolean): Returns true if the site is a known anonymizer service.
- `site_category → is_url_shortener` (boolean): Returns true if the site is a known URL shortener.
- `site_category → is_free_dynamic_dns` (boolean): Returns true if the site is a known free dynamic DNS service.
- `site_category → is_code_sandbox` (boolean): Returns true if the site is a known code sandbox service.
- `site_category → is_form_builder` (boolean): Returns true if the site is a known online form builder.
- `site_category → is_free_file_sharing` (boolean): Returns true if the site is a known free file sharing service.
- `site_category → is_pastebin` (boolean): Returns true if the site is a known pastebin service.
- `url_parts → scheme` (string): URL scheme: `http` or `https`.
- `url_parts → host` (string): Full hostname including subdomain (e.g. `www.example.com`).
- `url_parts → host_nowww` (string): Hostname with the `www.` prefix stripped.
- `url_parts → port` (integer): Port number. Typically `80` for HTTP, `443` for HTTPS, or `0` if unspecified.
- `url_parts → path` (string): URL path component (e.g. `/contact-us/`).
- `url_parts → query` (string): URL query string. Empty string if none.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/url-status-api/>

# URL Status API Reference

Check the status of a URL: HTTP response code, redirects chain, final URL and page details, with many options to control how the URL is fetched.

Service details and pricing: [URL Status API](https://www.apivoid.com/api/url-status/)

Endpoint: `POST https://api.apivoid.com/v2/url-status`

Credit cost: 1 credit per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/url-status" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"url": "http://wikipedia.com"}'
```

The same request in PHP:

```php
$url = 'http://wikipedia.com';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/url-status');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['url' => $url]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `url` (string; Required): URL to submit, e.g. `http://wikipedia.com`.

### Optional

- `follow_redirects` (boolean; Default: true): Specify if redirect URLs should be followed.
- `follow_external_redirects` (boolean; Default: true): Specify if external redirect URLs should be followed.
- `follow_meta_redirects` (boolean; Default: false): Specify if meta refresh redirects should be followed.
- `follow_header_redirects` (boolean; Default: false): Specify if header refresh redirects should be followed.
- `follow_custom_redirects` (boolean; Default: false): Specify if custom redirects (e.g. site-specific) should be followed.
- `max_redirects` (integer; Default: 10): Set maximum number of redirects to follow (max 10).
- `verify_ssl` (boolean; Default: true): Enable or disable SSL certificate verification. New response fields (when enabled): `valid_ssl`, `ssl_details`.
- `check_ssl_revocation` (boolean; Default: false): Enable SSL revocation check. Requires `"verify_ssl": true`. New response fields (when enabled): `revoked` inside `ssl_details`.
- `user_agent` (string; Default: desktop): Can be `desktop` (default, a random desktop user agent), `desktop-firefox`, `desktop-chrome`, `desktop-edge` or `mobile`.
- `referer` (string): Can be "origin" (the base URL {scheme}://{host}/), "google", "yahoo", "duckduckgo", or "bing".
- `accept_language` (string; Default: en-US): Change the Accept-Language HTTP header, format like `en` or `en-US`.
- `basic_auth_username` (string): Set username for Basic Authentication.
- `basic_auth_password` (string): Set password for Basic Authentication.
- `authorization_bearer` (string): Set the authorization bearer token.
- `connect_timeout` (integer; Default: 10): Set a connection timeout in seconds (max 15) for each followed URL.
- `include_response_headers` (boolean; Default: false): Enable the retrieval of response headers if needed. New response fields (when enabled): `response_headers`.
- `include_response_body` (boolean; Default: false): Enable the retrieval of response body (in base64) if needed. New response fields (when enabled): `body_base64`, `body_md5_hash_original`, `body_size_bytes`, `body_truncated`.
- `include_response_body_text` (boolean; Default: false): Include the response body in plain text only (no HTML tags). New response fields (when enabled): `body_text`.
- `include_favicon_details` (boolean; Default: false): Include favicon details, e.g. the base64-encoded file, MD5 hash, and image dimensions. New response fields (when enabled): `favicon_details`.
- `include_og_image_details` (boolean; Default: false): Include og:image details, e.g. the base64-encoded file, MD5 hash, and image dimensions. New response fields (when enabled): `og_image_details`.
- `include_links` (boolean; Default: false): Extract internal and external links categorized by tags, including links found in inline scripts. New response fields (when enabled): `links`.
- `include_forms` (boolean; Default: false): Extract and parse every form and all its elements (input, button, etc.). New response fields (when enabled): `forms`.
- `clean_page_content` (boolean; Default: false): Clean HTML content by removing extra whitespace and newlines.
- `custom_proxy` (string): Custom proxy URL, e.g. `http://user:pass@example.com:8000`.
- `use_premium_proxy` (boolean; Default: false): Use a premium proxy *BETA*.
- `use_http2` (boolean; Default: false): Use HTTP/2 to make the request.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "url": "http://wikipedia.com/",
    "unwrapped_url": "",
    "debug_message": "",
    "chain_status": "complete",
    "redirect_stats": {
        "redirects_found": 2,
        "followed_redirects": 2,
        "duplicate_redirects": 0,
        "http_to_https_redirects": 1,
        "https_to_http_redirects": 0,
        "external_redirects": 1,
        "same_origin_redirects": 0,
        "cross_origin_redirects": 2
    },
    "request_stats": {
        "total_requests": 3,
        "failed_requests": 0,
        "slow_requests": 0,
        "ssl_errors": 0,
        "avg_elapsed_ms": 285,
        "max_elapsed_ms": 374
    },
    "chain": [
        {
            "url": "http://wikipedia.com/",
            "hop": 0,
            "protocol": "HTTP/1.1",
            "status_code": 301,
            "status_message": "Moved Permanently",
            "content_type": "text/html",
            "can_resolve": true,
            "connection_error": false,
            "redirect_to": "https://wikipedia.com/",
            "redirect_type": "3xx_redirect",
            "redirect_info": {
                "http_to_https": true,
                "https_to_http": false,
                "non_www_to_www": false,
                "www_to_non_www": false,
                "external_redirect": false,
                "same_origin": false,
                "cross_origin": true,
                "same_scheme": false,
                "same_domain": true,
                "same_host": true,
                "same_port": false
            },
            "redirect_followed": true,
            "ip": "185.15.59.226",
            "url_parts": {
                "scheme": "http",
                "host": "wikipedia.com",
                "host_nowww": "wikipedia.com",
                "port": 80,
                "path": "/",
                "query": ""
            },
            "domain_parts": {
                "root_domain": "wikipedia.com",
                "subdomain": "",
                "tld": "com"
            },
            "valid_ssl": false,
            "elapsed_ms": 177
        },
        {
            "url": "https://wikipedia.com/",
            "hop": 1,
            "protocol": "HTTP/1.1",
            "status_code": 301,
            "status_message": "Moved Permanently",
            "content_type": "text/html",
            "can_resolve": true,
            "connection_error": false,
            "redirected_from": "http://wikipedia.com/",
            "redirect_to": "https://www.wikipedia.org/",
            "redirect_type": "3xx_redirect",
            "redirect_info": {
                "http_to_https": false,
                "https_to_http": false,
                "non_www_to_www": false,
                "www_to_non_www": false,
                "external_redirect": true,
                "same_origin": false,
                "cross_origin": true,
                "same_scheme": true,
                "same_domain": false,
                "same_host": false,
                "same_port": true
            },
            "redirect_followed": true,
            "ip": "185.15.59.226",
            "url_parts": {
                "scheme": "https",
                "host": "wikipedia.com",
                "host_nowww": "wikipedia.com",
                "port": 443,
                "path": "/",
                "query": ""
            },
            "domain_parts": {
                "root_domain": "wikipedia.com",
                "subdomain": "",
                "tld": "com"
            },
            "valid_ssl": true,
            "ssl_details": {
                "certificate_found": true,
                "ssl_errors": false,
                "name_match": true,
                "expired": false,
                "valid": true,
                "self_signed": false,
                "issuer": {
                    "common_name": "E8",
                    "organization": [
                        "Let's Encrypt"
                    ],
                    "organizational_unit": [],
                    "location": [],
                    "state": [],
                    "country": [
                        "US"
                    ]
                },
                "subject": {
                    "common_name": "wikipedia.com",
                    "organization": [],
                    "organizational_unit": [],
                    "location": [],
                    "state": [],
                    "country": []
                },
                "valid_from": "Mon, 23 Feb 2026 19:59:09 UTC",
                "valid_to": "Sun, 24 May 2026 19:59:08 UTC",
                "valid_days_left": 63,
                "expired_from_days": 0,
                "serial_number": "623dc3867ce9c736adc88a61b43e0f9e73e",
                "fingerprint_sha1": "cc2a48be4cbfecc7b5cddf3783bd3b188573fdf8",
                "fingerprint_sha256": "525174022c16125f127a9f34adc01c5dac8a1de93205588acc14a26d24c29ea3",
                "algorithm": "ECDSA-SHA384",
                "key_algorithm": "ECDSA",
                "key_size": 256,
                "type": "Domain Validation"
            },
            "elapsed_ms": 306
        },
        {
            "url": "https://www.wikipedia.org/",
            "hop": 2,
            "protocol": "HTTP/1.1",
            "status_code": 200,
            "status_message": "OK",
            "content_type": "text/html",
            "can_resolve": true,
            "connection_error": false,
            "redirected_from": "https://wikipedia.com/",
            "ip": "185.15.59.224",
            "html_info": {
                "title": "Wikipedia",
                "description": "Wikipedia is a free online encyclopedia, created and edited by volunteers around the world and hosted by the Wikimedia Foundation.",
                "keywords": "",
                "author": "",
                "robots": "",
                "googlebot": "",
                "canonical": "",
                "og_image": "https://upload.wikimedia.org/wikipedia/en/thumb/8/80/Wikipedia-logo-v2.svg/2244px-Wikipedia-logo-v2.svg.png",
                "og_type": "website",
                "og_site_name": "",
                "og_url": "",
                "article_publisher": "",
                "twitter_site": "",
                "fb_app_id": "",
                "ld_organization": "",
                "ld_url": "",
                "ld_logo": "",
                "ld_same_as": [],
                "generator": [],
                "refresh_url": "",
                "apple_itunes_app_id": "",
                "apple_itunes_app_name": "",
                "icon": "https://www.wikipedia.org/static/favicon/wikipedia.ico",
                "apple_touch_icon": [
                    {
                        "size": "",
                        "href": "https://www.wikipedia.org/static/apple-touch/wikipedia.png"
                    }
                ],
                "lang": "en",
                "hreflang": [],
                "h1": [
                    "Wikipedia The Free Encyclopedia",
                    "Wikipedia 25 years of the free encyclopedia"
                ],
                "h2": [
                    "Unlock birthday surprises on Wikipedia",
                    "1,000,000+ articles",
                    "100,000+ articles",
                    "10,000+ articles",
                    "1,000+ articles",
                    "100+ articles"
                ],
                "h3": []
            },
            "url_parts": {
                "scheme": "https",
                "host": "www.wikipedia.org",
                "host_nowww": "wikipedia.org",
                "port": 443,
                "path": "/",
                "query": ""
            },
            "domain_parts": {
                "root_domain": "wikipedia.org",
                "subdomain": "www",
                "tld": "org"
            },
            "valid_ssl": true,
            "ssl_details": {
                "certificate_found": true,
                "ssl_errors": false,
                "name_match": true,
                "expired": false,
                "valid": true,
                "self_signed": false,
                "issuer": {
                    "common_name": "E8",
                    "organization": [
                        "Let's Encrypt"
                    ],
                    "organizational_unit": [],
                    "location": [],
                    "state": [],
                    "country": [
                        "US"
                    ]
                },
                "subject": {
                    "common_name": "*.wikipedia.org",
                    "organization": [],
                    "organizational_unit": [],
                    "location": [],
                    "state": [],
                    "country": []
                },
                "valid_from": "Fri, 06 Feb 2026 21:41:32 UTC",
                "valid_to": "Thu, 07 May 2026 21:41:31 UTC",
                "valid_days_left": 47,
                "expired_from_days": 0,
                "serial_number": "666163cc3790d2d917d56a0dd1c87974320",
                "fingerprint_sha1": "2c9db350d2b084116c7a12bb629b7397d42da8fa",
                "fingerprint_sha256": "3461aaf30b87e6ffb74969ae7a96efa4e8e1c6a2a39a213ed3abd5d17de9279f",
                "algorithm": "ECDSA-SHA384",
                "key_algorithm": "ECDSA",
                "key_size": 256,
                "type": "Domain Validation"
            },
            "elapsed_ms": 374
        }
    ],
    "final_url": {
        "url": "https://www.wikipedia.org/",
        "protocol": "HTTP/1.1",
        "status": "online",
        "status_code": 200,
        "status_message": "OK"
    },
    "elapsed_ms": 857
}
```

## Response fields

The fields returned in the JSON response:

- `url` (string): The original URL submitted for checking.
- `unwrapped_url` (string): If the input is an email gateway protected link (Mimecast, Proofpoint, Barracuda, etc.), contains the extracted real destination URL that was scanned. Empty string if not applicable.
- `debug_message` (string): Populated when the chain stopped early (e.g. max redirects reached, meta refresh disabled). Empty string on a clean complete chain.
- `chain_status` (string): `complete` if the chain reached a final URL. `partial` if stopped early.
- `redirect_stats → redirects_found` (integer): Total redirects detected in the chain, including 3xx and other redirects.
- `redirect_stats → followed_redirects` (integer): Number of redirects actually followed. May be lower than `redirects_found` if a redirect was not followed.
- `redirect_stats → duplicate_redirects` (integer): Hops where the URL was already visited earlier in the chain. A non-zero value indicates a potential redirect loop.
- `redirect_stats → http_to_https_redirects` (integer): Redirects that upgraded the scheme from `http://` to `https://`.
- `redirect_stats → https_to_http_redirects` (integer): Redirects that downgraded the scheme from `https://` to `http://`. A non-zero value is a security concern.
- `redirect_stats → external_redirects` (integer): Redirects that crossed to a different root domain.
- `redirect_stats → same_origin_redirects` (integer): Redirects where scheme, host, and port all remained identical (browser origin definition).
- `redirect_stats → cross_origin_redirects` (integer): Redirects where scheme, host, or port changed. Includes subdomain changes such as non-www to www.
- `request_stats → total_requests` (integer): Total HTTP requests made across the entire chain, including the final destination hop.
- `request_stats → failed_requests` (integer): Hops that returned no HTTP response (`status_code: 0`). Covers DNS failures, private IP blocks, and connection errors.
- `request_stats → slow_requests` (integer): Hops that exceeded the slow request threshold (6000ms).
- `request_stats → ssl_errors` (integer): Hops with an invalid SSL certificate. Includes self-signed, expired, or name mismatch certificates.
- `request_stats → avg_elapsed_ms` (integer): Average response time in milliseconds across all hops in the chain.
- `request_stats → max_elapsed_ms` (integer): Slowest single hop response time in milliseconds across the chain.
- `chain` (array): Hops of the request chain; one item per request, from the submitted URL to the final destination.
- `chain[n] → url` (string): The URL requested at this hop.
- `chain[n] → hop` (integer): Zero-based index of this hop in the redirect chain.
- `chain[n] → protocol` (string): HTTP protocol version used (e.g. `HTTP/1.1`, `HTTP/2`). Empty string if the request failed.
- `chain[n] → status_code` (integer): HTTP response status code. `0` indicates no response was received (connection failure).
- `chain[n] → status_message` (string): HTTP status message or a descriptive error if the request failed (e.g. `Domain resolves to a non-public IP`).
- `chain[n] → content_type` (string): Content-Type of the response at this hop, e.g. text/html.
- `chain[n] → can_resolve` (boolean): Returns true if the domain resolved to a valid public IP address via DNS.
- `chain[n] → connection_error` (boolean): Returns true if a connection error occurred at this hop. True for DNS failures and non-public IP blocks.
- `chain[n] → redirect_to` (string): The URL this hop redirects to. Only present on redirect hops.
- `chain[n] → redirect_type` (string): `3xx_redirect` for HTTP redirects. `meta_redirect` for HTML meta refresh redirects.
- `chain[n] → redirect_info → http_to_https` (boolean): Returns true if this redirect upgraded from `http://` to `https://`.
- `chain[n] → redirect_info → https_to_http` (boolean): Returns true if this redirect downgraded from `https://` to `http://`.
- `chain[n] → redirect_info → non_www_to_www` (boolean): Returns true if this redirect added the `www.` subdomain.
- `chain[n] → redirect_info → www_to_non_www` (boolean): Returns true if this redirect removed the `www.` subdomain.
- `chain[n] → redirect_info → external_redirect` (boolean): Returns true if this redirect crossed to a different root domain.
- `chain[n] → redirect_info → same_origin` (boolean): Returns true if scheme, host, and port are all identical between source and destination (browser origin model).
- `chain[n] → redirect_info → cross_origin` (boolean): Returns true if scheme, host, or port differs between source and destination.
- `chain[n] → redirect_info → same_scheme` (boolean): Returns true if the redirect keeps the same URL scheme (http/https).
- `chain[n] → redirect_info → same_domain` (boolean): Returns true if the root domain is the same, regardless of subdomain or scheme changes.
- `chain[n] → redirect_info → same_host` (boolean): Returns true if the full host including subdomain is identical.
- `chain[n] → redirect_info → same_port` (boolean): Returns true if the port is identical between source and destination.
- `chain[n] → redirect_followed` (boolean): Returns true if the redirect at this hop was followed. False if max redirects reached or meta refresh is disabled.
- `chain[n] → ip` (string): Resolved IP address of the host at this hop.
- `chain[n] → url_parts → scheme` (string): URL scheme at this hop: `http` or `https`.
- `chain[n] → url_parts → host` (string): Full hostname including subdomain (e.g. `www.example.com`).
- `chain[n] → url_parts → host_nowww` (string): Hostname with the `www.` prefix stripped.
- `chain[n] → url_parts → port` (integer): Port number. Typically `80` for HTTP, `443` for HTTPS, or `0` if unspecified.
- `chain[n] → url_parts → path` (string): URL path component (e.g. `/contact-us/`).
- `chain[n] → url_parts → query` (string): URL query string. Empty string if none.
- `chain[n] → domain_parts → root_domain` (string): Registered root domain (e.g. `example.com`), excluding subdomains.
- `chain[n] → domain_parts → subdomain` (string): Subdomain portion of the host (e.g. `www`). Empty string if none.
- `chain[n] → domain_parts → tld` (string): Top-level domain (e.g. `com`, `org`, `co.uk`).
- `chain[n] → valid_ssl` (boolean; With: verify_ssl): Returns true if the SSL certificate passed all validation checks. Always `false` for plain HTTP hops.
- `chain[n] → elapsed_ms` (integer): Response time in milliseconds for this individual hop.
- `chain[n] → response_headers` (object; With: include_response_headers): HTTP response headers of the hop, keyed by lowercase header name.
- `chain[n] → body_base64` (string; With: include_response_body): Response body of the hop encoded in base64.
- `chain[n] → body_md5_hash_original` (string; With: include_response_body): MD5 hash of the original (untruncated) response body.
- `chain[n] → body_size_bytes` (integer; With: include_response_body): Size of the response body in bytes.
- `chain[n] → body_truncated` (boolean; With: include_response_body): Returns true if the response body was truncated.
- `chain[n] → body_text` (string; With: include_response_body_text): Visible text extracted from the response body.
- `chain[n] → redirected_from` (string): URL of the previous hop that redirected here. Only present from hop 1 onwards.
- `chain[n] → ssl_details → certificate_found` (boolean; With: verify_ssl): Returns true if an SSL certificate was found for this hop.
- `chain[n] → ssl_details → ssl_errors` (boolean; With: verify_ssl): Returns true if any SSL validation errors were detected.
- `chain[n] → ssl_details → name_match` (boolean; With: verify_ssl): Returns true if the certificate common name or SAN matches the requested hostname.
- `chain[n] → ssl_details → expired` (boolean; With: verify_ssl): Returns true if the certificate is past its expiry date.
- `chain[n] → ssl_details → revoked` (boolean; With: check_ssl_revocation): Returns true if the SSL certificate is revoked.
- `chain[n] → ssl_details → valid` (boolean; With: verify_ssl): Returns true if the certificate passed all validation checks.
- `chain[n] → ssl_details → self_signed` (boolean; With: verify_ssl): Returns true if the certificate is self-signed (issuer equals subject).
- `chain[n] → ssl_details → issuer → common_name` (string; With: verify_ssl): Common name of the Certificate Authority that issued this certificate.
- `chain[n] → ssl_details → issuer → organization` (array; With: verify_ssl): Organization name of the Certificate Authority (e.g. `Let's Encrypt`).
- `chain[n] → ssl_details → issuer → organizational_unit` (array): Organizational Unit (OU) entries of the certificate issuer. Empty array if none.
- `chain[n] → ssl_details → issuer → location` (array): Locality (L) entries of the certificate issuer. Empty array if none.
- `chain[n] → ssl_details → issuer → state` (array): State or province (ST) entries of the certificate issuer. Empty array if none.
- `chain[n] → ssl_details → issuer → country` (array): Country (C) entries of the certificate issuer. Empty array if none.
- `chain[n] → ssl_details → subject → common_name` (string; With: verify_ssl): Common name the certificate was issued for (e.g. `*.example.com`).
- `chain[n] → ssl_details → subject → organization` (array): Organization (O) entries of the certificate subject. Empty array if none.
- `chain[n] → ssl_details → subject → organizational_unit` (array): Organizational Unit (OU) entries of the certificate subject. Empty array if none.
- `chain[n] → ssl_details → subject → location` (array): Locality (L) entries of the certificate subject. Empty array if none.
- `chain[n] → ssl_details → subject → state` (array): State or province (ST) entries of the certificate subject. Empty array if none.
- `chain[n] → ssl_details → subject → country` (array): Country (C) entries of the certificate subject. Empty array if none.
- `chain[n] → ssl_details → valid_from` (string; With: verify_ssl): Certificate validity start date in UTC.
- `chain[n] → ssl_details → valid_to` (string; With: verify_ssl): Certificate expiry date in UTC.
- `chain[n] → ssl_details → valid_days_left` (integer; With: verify_ssl): Number of days until the certificate expires.
- `chain[n] → ssl_details → expired_from_days` (integer; With: verify_ssl): Number of days since the certificate expired. `0` on valid certificates.
- `chain[n] → ssl_details → serial_number` (string; With: verify_ssl): Unique serial number assigned by the Certificate Authority.
- `chain[n] → ssl_details → fingerprint_sha1` (string; With: verify_ssl): SHA-1 fingerprint of the certificate.
- `chain[n] → ssl_details → fingerprint_sha256` (string; With: verify_ssl): SHA-256 fingerprint of the certificate.
- `chain[n] → ssl_details → algorithm` (string; With: verify_ssl): Signature algorithm used (e.g. `ECDSA-SHA256`, `SHA256-RSA`).
- `chain[n] → ssl_details → key_algorithm` (string; With: verify_ssl): Public key algorithm (e.g. `RSA`, `ECDSA`).
- `chain[n] → ssl_details → key_size` (integer; With: verify_ssl): Key size in bits (e.g. `2048` for RSA, `256` for ECDSA).
- `chain[n] → ssl_details → type` (string; With: verify_ssl): Certificate validation type: `Domain Validation`, `Organization Validation`, or `Extended Validation`.
- `chain[n] → html_info → title` (string): Contents of the HTML `<title>` tag.
- `chain[n] → html_info → description` (string): Contents of the `meta description` tag.
- `chain[n] → html_info → keywords` (string): Contents of the `meta keywords` tag.
- `chain[n] → html_info → author` (string): Contents of the `meta author` tag. Empty string if none.
- `chain[n] → html_info → robots` (string): Contents of the `meta robots` tag.
- `chain[n] → html_info → googlebot` (string): Contents of the `meta googlebot` tag. Empty string if none.
- `chain[n] → html_info → canonical` (string): Canonical URL declared via `<link rel="canonical">`.
- `chain[n] → html_info → og_image` (string): Open Graph image URL (`og:image`).
- `chain[n] → html_info → og_type` (string): Open Graph content type (`og:type`).
- `chain[n] → html_info → og_site_name` (string): Open Graph site name (`og:site_name`).
- `chain[n] → html_info → og_url` (string): Open Graph URL of the page. Empty string if none.
- `chain[n] → html_info → article_publisher` (string): Contents of the article:publisher Open Graph tag. Empty string if none.
- `chain[n] → html_info → twitter_site` (string): Twitter/X site handle from `twitter:site` meta tag.
- `chain[n] → html_info → fb_app_id` (string): Facebook App ID from `fb:app_id` meta tag.
- `chain[n] → html_info → ld_organization` (string): Organization name from JSON-LD structured data.
- `chain[n] → html_info → ld_url` (string): URL from JSON-LD structured data.
- `chain[n] → html_info → ld_logo` (string): Logo URL from JSON-LD structured data.
- `chain[n] → html_info → ld_same_as` (array): sameAs URLs found in JSON-LD structured data (e.g. social profiles).
- `chain[n] → favicon_details → base64_file` (string; With: include_favicon_details): The favicon image encoded in base64.
- `chain[n] → favicon_details → md5_hash` (string; With: include_favicon_details): MD5 hash of the favicon image file.
- `chain[n] → favicon_details → image_width` (integer; With: include_favicon_details): Width of the favicon image in pixels.
- `chain[n] → favicon_details → image_height` (integer; With: include_favicon_details): Height of the favicon image in pixels.
- `chain[n] → favicon_details → file_size_bytes` (integer; With: include_favicon_details): File size of the favicon image in bytes.
- `chain[n] → favicon_details → file_size_readable` (string; With: include_favicon_details): File size in human-readable format, e.g. 2.7 KB.
- `chain[n] → og_image_details → base64_file` (string; With: include_og_image_details): The Open Graph image encoded in base64.
- `chain[n] → og_image_details → md5_hash` (string; With: include_og_image_details): MD5 hash of the Open Graph image file.
- `chain[n] → og_image_details → image_width` (integer; With: include_og_image_details): Width of the Open Graph image in pixels.
- `chain[n] → og_image_details → image_height` (integer; With: include_og_image_details): Height of the Open Graph image in pixels.
- `chain[n] → og_image_details → file_size_bytes` (integer; With: include_og_image_details): File size of the Open Graph image in bytes.
- `chain[n] → og_image_details → file_size_readable` (string; With: include_og_image_details): File size in human-readable format, e.g. 2.7 KB.
- `chain[n] → links` (object; With: include_links): Links found on the page, grouped by source tag: a, script, inline, img, link, form, iframe, embed, object.
- `chain[n] → links → [tag] → internal` (array; With: include_links): URLs of this tag group pointing to the same site.
- `chain[n] → links → [tag] → external` (array; With: include_links): URLs of this tag group pointing to external sites.
- `chain[n] → forms` (array; With: include_forms): HTML forms found on the page.
- `chain[n] → forms[n] → id` (string; With: include_forms): ID attribute of the form.
- `chain[n] → forms[n] → class` (string; With: include_forms): Class attribute of the form.
- `chain[n] → forms[n] → method` (string; With: include_forms): HTTP method of the form, e.g. post.
- `chain[n] → forms[n] → action` (string; With: include_forms): Action URL the form submits to.
- `chain[n] → forms[n] → enctype` (string; With: include_forms): Encoding type of the form, if set.
- `chain[n] → forms[n] → target` (string; With: include_forms): Target attribute of the form, if set.
- `chain[n] → forms[n] → autocomplete` (string; With: include_forms): Autocomplete attribute of the form, if set.
- `chain[n] → forms[n] → has_password_fields` (boolean; With: include_forms): Returns true if the form contains password fields.
- `chain[n] → forms[n] → has_hidden_fields` (boolean; With: include_forms): Returns true if the form contains hidden fields.
- `chain[n] → forms[n] → components` (array; With: include_forms): Form components; each item has tag, type, id, name, class, placeholder, value, required, minlength, maxlength and text.
- `chain[n] → html_info → generator` (array): CMS or framework from `meta generator` tag (e.g. WordPress).
- `chain[n] → html_info → refresh_url` (string): Target URL from a meta refresh tag. Used to detect meta redirects.
- `chain[n] → html_info → apple_itunes_app_id` (string): App ID from the apple-itunes-app meta tag. Empty string if none.
- `chain[n] → html_info → apple_itunes_app_name` (string): App name from the apple-itunes-app meta tag. Empty string if none.
- `chain[n] → html_info → icon` (string): URL of the site favicon.
- `chain[n] → html_info → apple_touch_icon` (array): Apple touch icon URLs and sizes declared on the page.
- `chain[n] → html_info → apple_touch_icon[n] → size` (string): Value of the sizes attribute, e.g. 180x180. Empty string if not specified.
- `chain[n] → html_info → apple_touch_icon[n] → href` (string): URL of the Apple touch icon.
- `chain[n] → html_info → lang` (string): Language code from the HTML `lang` attribute.
- `chain[n] → html_info → hreflang` (array): Hreflang alternate language/region URLs declared on the page.
- `chain[n] → html_info → h1` (array): All `<h1>` tag contents found on the page.
- `chain[n] → html_info → h2` (array): All `<h2>` tag contents found on the page.
- `chain[n] → html_info → h3` (array): Text of the H3 headings found on the page.
- `final_url → url` (string): The last URL reached after following all redirects.
- `final_url → protocol` (string): HTTP protocol version of the final response.
- `final_url → status` (string): Status of the final URL: `online` (2xx), `redirect` (3xx terminal), `client_error` (4xx), `server_error` (5xx), `offline` (no response).
- `final_url → status_code` (integer): HTTP status code of the final response. `0` if no response was received.
- `final_url → status_message` (string): HTTP status message of the final response.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

## Optional response fields

Several optional request parameters add extra fields to the JSON response, example:

```json
{
  "url": "https://www.wikipedia.org/",
  "include_response_headers": true,
  "include_response_body": true,
  "include_response_body_text": true,
  "include_links": true,
  "include_forms": true,
  "include_favicon_details": true,
  "include_og_image_details": true,
  "verify_ssl": true,
  "check_ssl_revocation": true
}
```

Each enabled option adds the following fields to the response:

- `include_response_headers` adds `response_headers` (Chain hop: inside each redirect chain hop)
- `include_response_body` adds `body_base64`, `body_md5_hash_original`, `body_size_bytes`, `body_truncated` (Chain hop: only on hops that return a `200` status code)
- `include_response_body_text` adds `body_text` (Chain hop: on chain hops that return a `200` status code)
- `include_favicon_details` adds `favicon_details` (Chain hop: on chain hops that return a `200` status code)
- `include_og_image_details` adds `og_image_details` (Chain hop: on chain hops that return a `200` status code)
- `include_links` adds `links` (Chain hop: on chain hops that return a `200` status code)
- `include_forms` adds `forms` (Chain hop: on chain hops that return a `200` status code)
- `verify_ssl` adds `valid_ssl`, `ssl_details` (Chain hop: on HTTPS hops, with certificate details)
- `check_ssl_revocation` adds `revoked` (SSL details: inside the `ssl_details` object)

Example response for the request payload above:

```json
{
    "url": "https://www.wikipedia.org/",
    "unwrapped_url": "",
    "debug_message": "",
    "chain_status": "complete",
    "redirect_stats": {
        "redirects_found": 0,
        "followed_redirects": 0,
        "duplicate_redirects": 0,
        "http_to_https_redirects": 0,
        "https_to_http_redirects": 0,
        "external_redirects": 0,
        "same_origin_redirects": 0,
        "cross_origin_redirects": 0
    },
    "request_stats": {
        "total_requests": 1,
        "failed_requests": 0,
        "slow_requests": 0,
        "ssl_errors": 0,
        "avg_elapsed_ms": 285,
        "max_elapsed_ms": 374
    },
    "chain": [
        {
            "url": "https://www.wikipedia.org/",
            "hop": 0,
            "protocol": "HTTP/1.1",
            "status_code": 200,
            "status_message": "OK",
            "content_type": "text/html",
            "can_resolve": true,
            "connection_error": false,
            "ip": "208.80.154.224",
            "response_headers": {
                "accept-ranges": [
                    "bytes"
                ],
                "age": [
                    "10766"
                ],
                "cache-control": [
                    "s-maxage=86400, must-revalidate, max-age=3600"
                ],
                "content-type": [
                    "text/html"
                ],
                "date": [
                    "Thu, 05 Mar 2026 12:19:43 GMT"
                ],
                "etag": [
                    "W/\"1fb73-64b80643ed380\""
                ],
                "last-modified": [
                    "Mon, 23 Feb 2026 16:37:50 GMT"
                ],
                "nel": [
                    "{ \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}"
                ],
                "report-to": [
                    "{ \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0\" }] }"
                ],
                "server": [
                    "ATS/9.2.11"
                ],
                "server-timing": [
                    "cache;desc=\"hit-front\", host;desc=\"cp6014\""
                ],
                "set-cookie": [
                    "WMF-Last-Access=05-Mar-2026;Path=/;HttpOnly;secure;Expires=Mon, 06 Apr 2026 12:00:00 GMT",
                    "WMF-Last-Access-Global=05-Mar-2026;Path=/;Domain=.wikipedia.org;HttpOnly;secure;Expires=Mon, 06 Apr 2026 12:00:00 GMT",
                    "GeoIP=IT:25:Milan:45.47:9.19:v4; Path=/; secure; Domain=.wikipedia.org",
                    "NetworkProbeLimit=0.001;Path=/;Secure;SameSite=None;Max-Age=3600",
                    "WMF-Uniq=Q-g5NIrOuPSTt1PWYtcIXwMaAAAAAFvdxYk6NVLI8rtq6pxtaEKbKNRjpbIF58FU;Domain=.wikipedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Fri, 05 Mar 2027 00:00:00 GMT"
                ],
                "strict-transport-security": [
                    "max-age=106384710; includeSubDomains; preload"
                ],
                "x-analytics": [
                    ""
                ],
                "x-cache": [
                    "cp6016 miss, cp6014 hit/137255"
                ],
                "x-cache-status": [
                    "hit-front"
                ],
                "x-client-ip": [
                    "2a03:f80:39:b25e::1"
                ],
                "x-request-id": [
                    "c2e5f414-d4b1-4b92-a71a-6a5a89d62a9e"
                ]
            },
            "cookies": [
                {
                    "name": "WMF-Last-Access",
                    "value": "05-Mar-2026",
                    "domain": "www.wikipedia.org",
                    "path": "/",
                    "expires": "Mon, 06 Apr 2026 12:00:00 UTC",
                    "size": 26,
                    "http_only": true,
                    "secure": true,
                    "same_site": ""
                },
                {
                    "name": "WMF-Last-Access-Global",
                    "value": "05-Mar-2026",
                    "domain": ".wikipedia.org",
                    "path": "/",
                    "expires": "Mon, 06 Apr 2026 12:00:00 UTC",
                    "size": 33,
                    "http_only": true,
                    "secure": true,
                    "same_site": ""
                },
                {
                    "name": "GeoIP",
                    "value": "IT:25:Milan:45.47:9.19:v4",
                    "domain": ".wikipedia.org",
                    "path": "/",
                    "expires": "",
                    "size": 30,
                    "http_only": false,
                    "secure": true,
                    "same_site": ""
                },
                {
                    "name": "NetworkProbeLimit",
                    "value": "0.001",
                    "domain": "www.wikipedia.org",
                    "path": "/",
                    "expires": "",
                    "size": 22,
                    "http_only": false,
                    "secure": true,
                    "same_site": "none"
                },
                {
                    "name": "WMF-Uniq",
                    "value": "Q-g5NIrOuPSTt1PWYtcIXwMaAAAAAFvdxYk6NVLI8rtq6pxtaEKbKNRjpbIF58FU",
                    "domain": ".wikipedia.org",
                    "path": "/",
                    "expires": "Fri, 05 Mar 2027 00:00:00 UTC",
                    "size": 72,
                    "http_only": true,
                    "secure": true,
                    "same_site": "none"
                }
            ],
            "body_base64": "PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIiBjbGFzcz0ibm8tanMiPgo8aGVhZD4KPG1ld...",
            "body_md5_hash_original": "46371d029de140b336cb01e7041e216b",
            "body_size_bytes": 129906,
            "body_text": "Wikipedia Wikipedia The Free Encyclopedia \nWikipedia 25 years of the free encyclopedia \nEnglish 7,141,000+ articles...",
            "body_truncated": false,
            "html_info": {
                "title": "Wikipedia",
                "description": "Wikipedia is a free online encyclopedia, created and edited by volunteers around the world and hosted by the Wikimedia Foundation.",
                "keywords": "",
                "author": "",
                "robots": "",
                "googlebot": "",
                "canonical": "",
                "og_image": "https://upload.wikimedia.org/wikipedia/en/thumb/8/80/Wikipedia-logo-v2.svg/2244px-Wikipedia-logo-v2.svg.png",
                "og_type": "website",
                "og_site_name": "",
                "og_url": "",
                "article_publisher": "",
                "twitter_site": "",
                "fb_app_id": "",
                "ld_organization": "",
                "ld_url": "",
                "ld_logo": "",
                "ld_same_as": [],
                "generator": [],
                "refresh_url": "",
                "apple_itunes_app_id": "",
                "apple_itunes_app_name": "",
                "icon": "https://www.wikipedia.org/static/favicon/wikipedia.ico",
                "apple_touch_icon": [
                    {
                        "size": "",
                        "href": "https://www.wikipedia.org/static/apple-touch/wikipedia.png"
                    }
                ],
                "lang": "en",
                "hreflang": [],
                "h1": [
                    "Wikipedia The Free Encyclopedia",
                    "Wikipedia 25 years of the free encyclopedia"
                ],
                "h2": [
                    "Unlock birthday surprises on Wikipedia",
                    "1,000,000+ articles",
                    "100,000+ articles",
                    "10,000+ articles",
                    "1,000+ articles",
                    "100+ articles"
                ],
                "h3": []
            },
            "links": {
                "a": {
                    "internal": [],
                    "external": [
                        "https://my.wikipedia.org/",
                        "https://sat.wikipedia.org/",
                        "https://za.wikipedia.org/",
                        "https://pfl.wikipedia.org/",
                        "https://rm.wikipedia.org/",
                        "https://hu.wikipedia.org/",
                        ...
                    ]
                },
                "script": {
                    "internal": [
                        "https://www.wikipedia.org/portal/wikipedia.org/assets/js/index-90de98612a.js",
                        "https://www.wikipedia.org/portal/wikipedia.org/assets/js/gt-ie9-507b16b6be.js"
                    ],
                    "external": []
                },
                "inline": {
                    "internal": [],
                    "external": []
                },
                "img": {
                    "internal": [
                        "https://www.wikipedia.org/portal/wikipedia.org/assets/img/Wikipedia-logo-v2.png"
                    ],
                    "external": []
                },
                "link": {
                    "internal": [
                        "https://www.wikipedia.org/static/favicon/wikipedia.ico",
                        "https://www.wikipedia.org/static/apple-touch/wikipedia.png"
                    ],
                    "external": [
                        "https://upload.wikimedia.org",
                        "https://wikis.world/@wikipedia",
                        "https://creativecommons.org/licenses/by-sa/4.0/"
                    ]
                },
                "form": {
                    "internal": [
                        "https://www.wikipedia.org/search-redirect.php"
                    ],
                    "external": []
                },
                "iframe": {
                    "internal": [],
                    "external": []
                },
                "embed": {
                    "internal": [],
                    "external": []
                },
                "object": {
                    "internal": [],
                    "external": []
                }
            },
            "forms": [
                {
                    "id": "search-form",
                    "class": "pure-form",
                    "method": "",
                    "action": "https://www.wikipedia.org/search-redirect.php",
                    "enctype": "",
                    "target": "",
                    "autocomplete": "",
                    "has_password_fields": false,
                    "has_hidden_fields": true,
                    "components": [
                        {
                            "tag": "input",
                            "type": "hidden",
                            "id": "",
                            "name": "family",
                            "class": "",
                            "placeholder": "",
                            "value": "wikipedia",
                            "required": false,
                            "minlength": "",
                            "maxlength": "",
                            "text": ""
                        },
                        {
                            "tag": "input",
                            "type": "search",
                            "id": "searchInput",
                            "name": "search",
                            "class": "",
                            "placeholder": "",
                            "value": "",
                            "required": false,
                            "minlength": "",
                            "maxlength": "",
                            "text": ""
                        },
                        {
                            "tag": "select",
                            "type": "",
                            "id": "searchLanguage",
                            "name": "language",
                            "class": "",
                            "placeholder": "",
                            "value": "",
                            "required": false,
                            "minlength": "",
                            "maxlength": "",
                            "text": ""
                        },
                        {
                            "tag": "button",
                            "type": "submit",
                            "id": "",
                            "name": "",
                            "class": "pure-button pure-button-primary-progressive",
                            "placeholder": "",
                            "value": "",
                            "required": false,
                            "minlength": "",
                            "maxlength": "",
                            "text": "Search"
                        },
                        {
                            "tag": "input",
                            "type": "hidden",
                            "id": "",
                            "name": "go",
                            "class": "",
                            "placeholder": "",
                            "value": "Go",
                            "required": false,
                            "minlength": "",
                            "maxlength": "",
                            "text": ""
                        }
                    ],
                    "text_only": "Search Wikipedia Afrikaans Shqip العربية Asturianu Azərbaycanca...",
                }
            ],
            "favicon_details": {
                "base64_file": "AAABAAMAMDAQAAEABABoBgAANgAAACAg...",
                "md5_hash": "904ce6bd2ef5e1eaa6de1eb02164436b",
                "image_width": 48,
                "image_height": 48,
                "file_size_bytes": 2734,
                "file_size_readable": "2.7 KB"
            },
            "og_image_details": {
                "base64_file": "iVBORw0KGgoAAAANSUhEUgAACMQAAAg...",
                "md5_hash": "5a294517cb0e591ba2f2f07b21f7477c",
                "image_width": 2244,
                "image_height": 2048,
                "file_size_bytes": 951071,
                "file_size_readable": "928.8 KB"
            },
            "url_parts": {
                "scheme": "https",
                "host": "www.wikipedia.org",
                "host_nowww": "wikipedia.org",
                "port": 443,
                "path": "/",
                "query": ""
            },
            "domain_parts": {
                "root_domain": "wikipedia.org",
                "subdomain": "www",
                "tld": "org"
            },
            "valid_ssl": true,
            "ssl_details": {
                "certificate_found": true,
                "ssl_errors": false,
                "name_match": true,
                "expired": false,
                "revoked": false,
                "valid": true,
                "self_signed": false,
                "issuer": {
                    "common_name": "E8",
                    "organization": [
                        "Let's Encrypt"
                    ],
                    "organizational_unit": [],
                    "location": [],
                    "state": [],
                    "country": [
                        "US"
                    ]
                },
                "subject": {
                    "common_name": "*.wikipedia.org",
                    "organization": [],
                    "organizational_unit": [],
                    "location": [],
                    "state": [],
                    "country": []
                },
                "valid_from": "Fri, 06 Feb 2026 21:41:32 UTC",
                "valid_to": "Thu, 07 May 2026 21:41:31 UTC",
                "valid_days_left": 63,
                "expired_from_days": 0,
                "serial_number": "666163cc3790d2d917d56a0dd1c87974320",
                "fingerprint_sha1": "2c9db350d2b084116c7a12bb629b7397d42da8fa",
                "fingerprint_sha256": "3461aaf30b87e6ffb74969ae7a96efa4e8e1c6a2a39a213ed3abd5d17de9279f",
                "algorithm": "ECDSA-SHA384",
                "key_algorithm": "ECDSA",
                "key_size": 256,
                "type": "Domain Validation"
            },
            "elapsed_ms": 795
        }
    ],
    "final_url": {
        "url": "https://www.wikipedia.org/",
        "protocol": "HTTP/1.1",
        "status": "online",
        "status_code": 200,
        "status_message": "OK"
    },
    "elapsed_ms": 795
}
```

---

Source: <https://docs.apivoid.com/url-to-pdf-api/>

# URL to PDF API Reference

Convert any URL into a printable, high quality PDF document rendered by a real browser.

Service details and pricing: [URL to PDF API](https://www.apivoid.com/api/url-to-pdf/)

Endpoint: `POST https://api.apivoid.com/v2/url-to-pdf`

Credit cost: 20 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/url-to-pdf" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"url": "https://apple.com/"}'
```

The same request in PHP:

```php
$url = 'https://apple.com/';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/url-to-pdf');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['url' => $url]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);

    // Save the "base64_file" data as PDF file
    if (isset($responseData['rendered_file']['base64_file'])) {
        $saveAs = __DIR__ . '/document.pdf';

        file_put_contents($saveAs, base64_decode($responseData['rendered_file']['base64_file']));

        if (file_exists($saveAs)) {
            echo '<p>File document.pdf saved successfully!</p>';
        } else {
            echo '<p>Failed to create document.pdf file.</p>';
        }
    }
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `url` (string; Required): URL to submit, e.g. `https://apple.com/`. Note: ⚠ Government and educational domains are blocked.

### Optional

- `viewport_width` (integer; Default: 1920): Browser viewport width in pixels (max 5000).
- `viewport_height` (integer; Default: 1080): Browser viewport height in pixels (max 10000).
- `user_agent` (string; Default: desktop): Can be `desktop` (default, a random desktop user agent) or `mobile`.
- `accept_language` (string; Default: en-US): Change the Accept-Language HTTP header, format like `en-US`.
- `delay` (integer; Default: 0): Wait N seconds (max 10) before converting the URL to PDF.
- `basic_auth_username` (string): Set username for Basic Authentication.
- `basic_auth_password` (string): Set password for Basic Authentication.
- `authorization_bearer` (string): Set the authorization bearer token.
- `custom_header` (string): A custom header, e.g. `X-key: 690d1f9e-5a53-45ad-997d-a23143a0d068`.
- `disable_js` (boolean; Default: false): Disable JavaScript.
- `disable_popups` (boolean; Default: true): Disable alerts, cookie consents and confirmation dialogs.
- `disable_images` (boolean; Default: false): Disable loading of images.
- `disable_ads` (boolean; Default: true): Disable advertisements.
- `emulate_media` (string; Default: screen): Emulate a media type, can be screen or print.
- `pdf_papersize_width` (integer; Default: 0): Change PDF paper width in pixels (max 5000).
- `pdf_papersize_height` (integer; Default: 0): Change PDF paper height in pixels (max 10000).
- `pdf_format` (string; Default: A4): Change PDF format, can be Letter, Legal, Tabloid, Ledger, A0, A1, A2, A3, A4, A5, A6.
- `pdf_margin` (integer; Default: 0): Change PDF margin.
- `pdf_show_background` (boolean; Default: true): Show the background of the web page.
- `pdf_landscape` (boolean; Default: false): Change the PDF orientation to landscape.
- `pdf_page_ranges` (string): Select page ranges, can be 1 or 1-3 (for example).
- `pdf_scale` (float): Scale the PDF, must be between 0.1 and 2.
- `pdf_one_page` (boolean; Default: false): Try to fit the web page into a single PDF page.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "url": "https://apple.com/",
    "rendered_file": {
        "format": "PDF",
        "date_time_utc": "2024-11-29 19:00:32",
        "base64_file": "JVBERi0xLjcKJeLjz9MKMSAwIG9iago8PC9UeXBlL0NhdGFsb2cvUGFnZXMgMiAwIFI+PgplbmRvYmoKMiAwIG9iago8PC9UICQUERBLEgWLA37KKoEbFrrKiINbH3rlhQsWHABhqxgQiKCg...",
        "file_size_readable": "344.53 KB",
        "file_size_bytes": 352795
    },
    "http_response": {
        "final_url": "https://www.apple.com/",
        "status_code": 200,
        "content_type": "text/html",
        "page_content_empty": false,
        "ip": "69.192.160.210"
    },
    "html_info": {
        "title": "Apple",
        "description": "Discover the innovative world of Apple and shop everything iPhone, iPad, Apple Watch, Mac, and Apple TV, plus explore accessories, entertainment, and expert device support.",
        "og_image": "https://www.apple.com/ac/structured-data/images/open_graph_logo.png?202110180743",
        "icon": "",
        "og_site_name": "Apple",
        "ld_organization": "Apple",
        "canonical": "https://www.apple.com/",
        "robots": "",
        "twitter_site": "",
        "lang": "en-US"
    },
    "elapsed_ms": 5763
}
```

## Response fields

The fields returned in the JSON response:

- `url` (string): URL submitted for the PDF rendering.
- `rendered_file → format` (string): Format of the rendered file, e.g. PDF.
- `rendered_file → date_time_utc` (string): Date and time (UTC) of when the file was rendered.
- `rendered_file → base64_file` (string): The rendered PDF file encoded in base64.
- `rendered_file → file_size_readable` (string): File size in human-readable format, e.g. 344.53 KB.
- `rendered_file → file_size_bytes` (integer): File size in bytes.
- `http_response → final_url` (string): Final URL after following redirects.
- `http_response → status_code` (integer): HTTP status code returned by the server.
- `http_response → content_type` (string): Content type of the page, e.g. text/html.
- `http_response → page_content_empty` (boolean): Returns true if the page content is empty.
- `http_response → ip` (string): IP address of the server that served the page.
- `html_info → title` (string): Title of the page.
- `html_info → description` (string): Meta description of the page.
- `html_info → og_image` (string): Open Graph image URL of the page.
- `html_info → icon` (string): Favicon URL of the page.
- `html_info → og_site_name` (string): Open Graph site name of the page.
- `html_info → ld_organization` (string): Organization name found in JSON-LD structured data.
- `html_info → canonical` (string): Canonical URL of the page.
- `html_info → robots` (string): Robots meta tag of the page.
- `html_info → twitter_site` (string): Twitter site handle of the page.
- `html_info → lang` (string): Language declared by the page, e.g. en-US.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.

---

Source: <https://docs.apivoid.com/vpn-test-api/>

# VPN Test API Reference

Check if a website is accessible from a VPN connection: the URL is requested through a VPN IP address and the API returns the HTTP status code, response headers and page details as seen from the VPN. Useful to verify whether a site blocks or challenges VPN visitors.

Service details and pricing: [VPN Test API](https://www.apivoid.com/api/vpn-test/)

Endpoint: `POST https://api.apivoid.com/v2/vpn-test`

Credit cost: 10 credits per successful request.

## Request example

Query the endpoint via an HTTPS POST request (replace `YOUR_API_KEY_HERE` with your [API key](https://docs.apivoid.com/authentication/)):

```bash
curl -X POST "https://api.apivoid.com/v2/vpn-test" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"url": "https://www.patreon.com/"}'
```

The same request in PHP:

```php
$url = 'https://www.patreon.com/';

$apiKey = 'YOUR_API_KEY_HERE';

$curl = curl_init('https://api.apivoid.com/v2/vpn-test');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['url' => $url]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);

if ($httpCode === 200) {
    $responseData = json_decode($response, true);
    print_r($responseData);
} else {
    print_r('An error occurred: '.$response);
}
```

## Request parameters

### Required

- `url` (string; Required): URL to submit, e.g. `https://www.patreon.com/`. Note: ⚠ Government and educational domains are blocked.

## Response example

A successful request returns HTTP `200` with a JSON body:

```json
{
    "url": "https://www.patreon.com/",
    "accessible": false,
    "status_code": 403,
    "debug_message": "",
    "response_headers": {
        "accept-ch": "Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA",
        "cache-control": "private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0",
        "cf-chl-out": "oCfcenr8aisw9BCZVlO6UgCVIhba0yavoWofUshfKsoxS0qPqaCDPROZv8sI03NIyTxkrqaQIJVWCsIokIan/hOb+XiEqx8ZW4jgkQL0MlWbbx/sagh1oKQHLg613cykA20IPDKlkluL4BK+pb+s1Q==$IHuTY7AGaBAQPSt5CN7cvQ==",
        "cf-mitigated": "challenge",
        "cf-ray": "927ae4a10dff7291-EWR",
        "content-type": "text/html; charset=UTF-8",
        "critical-ch": "Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA",
        "cross-origin-embedder-policy": "require-corp",
        "cross-origin-opener-policy": "same-origin",
        "cross-origin-resource-policy": "same-origin",
        "date": "Fri, 28 Mar 2025 23:26:33 GMT",
        "expires": "Thu, 01 Jan 1970 00:00:01 GMT",
        "nel": "{\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}",
        "origin-agent-cluster": "?1",
        "permissions-policy": "accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()",
        "referrer-policy": "same-origin",
        "report-to": "{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=DnAvbTN8ie3uDz84OovG1CRA4bp7jaiWwZ5%2FH9ZB2zORWklOm2KEPX7EZQnNt7N8fKcEtSGDvZOC7BgTMkoifnTAc1gWSHDDhiC%2FCOKTAvHUUavXyBwikf%2BGaWGEws7z3w%3D%3D\"}],\"group\":\"cf-nel\",\"max_age\":604800}",
        "server": "cloudflare",
        "server-timing": "chlray;desc=\"927ae4a10dff7291\"",
        "set-cookie": "__cf_bm=lCAZXpgkI5.hX9ghhJXZEPbjBpR64uTbpuNr_mlVlB8-1743204393-1.0.1.1-JFpzaxmPUAykjwdevJPx1vsBSuZ4Vf80VDrCM_jF3VtoRVIUWUsUOh8KKfQ4Y137KQa2JiGy3lXyfoibhq32vXuFQUOvtgzPGG1oFb6k7kKxWKoQ6rzYS0offJr7_.ZU; path=/; expires=Fri, 28-Mar-25 23:56:33 GMT; domain=.patreon.com; HttpOnly; Secure; SameSite=None",
        "strict-transport-security": "max-age=2592000",
        "vary": "Accept-Encoding",
        "x-content-options": "nosniff",
        "x-content-type-options": "nosniff",
        "x-frame-options": "SAMEORIGIN"
    },
    "html_info": {
        "title": "Just a moment...",
        "description": ""
    },
    "elapsed_ms": 29
}
```

## Response fields

The fields returned in the JSON response:

- `url` (string): URL submitted for the VPN accessibility test.
- `accessible` (boolean): Returns true if the URL is accessible from a VPN connection.
- `status_code` (integer): HTTP status code returned by the server.
- `debug_message` (string): Debug or error details about the request, if any. Empty string if none.
- `response_headers` (object): HTTP response headers returned by the server to the VPN connection, keyed by lowercase header name.
- `html_info → title` (string): Title of the page returned to the VPN connection.
- `html_info → description` (string): Meta description of the page returned to the VPN connection.
- `elapsed_ms` (integer): Time taken to process the request, in milliseconds.