RunCall narrow tools
Use authenticated lookup and report endpoints for DNS, SSL, headers, redirects, DMARC, and temporary job workflows.
Developer docs
Bounded API workflows.
Account keys for lookup reports, jobs, usage, credits, webhooks, and MCP.
StartCreate an account key
Sign in, create an API key, and store the raw key securely when it is shown once.
ReviewHandle failures explicitly
Expect invalid input, private targets, timeouts, unsupported files, caps, and expiring artifacts.
Runtime boundariesAvailable API areasBrowser-local tools, public lookups, agent packs, and temporary jobs stay separated.
- Browser-local: stays in the browser.
- Lookups: public DNS, SSL, headers, redirects, WHOIS, DMARC.
- Agent packs: authenticated composed reports.
- Temporary jobs: capped PDF, Office, OCR, HEIC, HTML-to-PDF work.
Lookup conceptLookup API shapeNarrow public-record checks only. No private scans, crawling, content storage, or certification claims.
Narrow public-record checks only. No private scans, crawling, content storage, or certification claims.
{
"toolId": "security-headers-checker",
"input": { "url": "https://example.com" },
"result": {
"ok": true,
"summary": "Security header review completed.",
"warnings": ["missing-content-security-policy"]
}
}ErrorsError and failure envelopeExpect invalid input, unreachable hosts, private targets, rate limits, unsupported files, and job failures.
- Lookup: invalid input, unreachable host, timeout, private target, rate limit.
- Job: unsupported, encrypted, too large, unsafe, timeout, validation failure.
- Telemetry: metadata only, not raw user content.
LimitsRate limits, quotas, and deletionUploads, jobs, report runs, billing, keys, MCP, and OpenAPI have separate routes and boundaries.
- Uploads:
POST /v1/uploads - Jobs:
POST /v1/jobs - Launch report:
POST /v1/agent-packs/launch-readiness/run - Billing: Stripe Checkout and customer portal.
- Keys: raw keys shown once.
- MCP:
POST /mcp, read-only tools. - OpenAPI:
GET /openapi.json