HTTP API

The checks behind the web tools, over HTTP. All read-only; nothing attacks or sends data to the target.

OpenAPI document

The full OpenAPI 3.1 description, ready to load into Postman, Swagger Editor or a client generator.

openapi.json v2026-10-13

Basics

  • Base URL: https://dechonet.com — every response is JSON.
  • Authentication: none needed. Send an API key to have limits counted per key instead of per IP: header "Authorization: Bearer dn_…". Create keys on the monitoring account page. A wrong or revoked key gets 401. Only the infrastructure pivot (/api/util/pivot) requires a key.
  • Rate limits: 60 requests per minute per client (IP or key) by default, fewer for heavy checks. Over the limit you get 429 with a Retry-After header. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (Unix seconds). A tool's target may be sent under any of query, host, domain, url or target.
  • POST requests need the header "Content-Type: application/json".
  • Interpretation language: ?lang=en or ?lang=ko.
  • Free use is non-commercial. Get in touch to use it in company work or a product.

Response envelope

Every response has the same envelope. When ok is false, read error.code (INVALID_INPUT, RATE_LIMITED, UPSTREAM_ERROR and others) and message. Most checks return data.raw (what was observed) and data.interpretation (status, key figures, issues with severity, cause and action). cached is true when a recent stored result was returned.

{
  "ok": true,
  "requestId": "…",
  "cached": false,
  "updatedAt": "2026-10-10T04:00:00.000Z",
  "data": { "raw": { … }, "interpretation": { "status": "…", "kpis": [ … ], "issues": [ … ] } },
  "error": null
}

Endpoints

Each description is the first sentence of the matching MCP tool description.

GET /api/util/dns

DNS Lookup — Query DNS records (A, AAAA, MX, TXT, NS, SOA, CAA) for a domain and validate email-related records, including DNSSEC presence and SPF/DMARC syntax, returning severity-rated diagnostics.

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/dns?query=example.com'

GET /api/util/ssl

SSL Certificate Check — Inspect a host's served TLS/SSL certificate and connection: expiry date, issuer, SAN list, chain integrity, revocation (OCSP, then CRL; unknown when neither answers — not graded unless revoked), TLS version, and HSTS, returning an A+ to F grade weighted by certificate validity (40%), TLS version (25%), chain trust (15%), and HSTS (20%).

Parameters: host (required), port

curl -s 'https://dechonet.com/api/util/ssl?host=example.com'

GET /api/util/http

HTTP Security Headers Audit — Follow a URL's HTTP redirect chain and audit response security headers (CSP, HSTS, X-Frame-Options, COOP, CORP, COEP, Permissions-Policy), grading A+ to F on the six core headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy; COOP/CORP/COEP are reported but not graded) and flagging information leaks such as server-version disclosure.

Parameters: url (required)

curl -s 'https://dechonet.com/api/util/http?url=example.com'

GET /api/util/email

Email Authentication Check — Assess a domain's email authentication and deliverability posture: MX records, SPF, DMARC, DKIM (probes 15 common selectors), BIMI, MTA-STS, TLS-RPT, and DANE, plus a blacklist check across all MX hosts, returning a 0-100 deliverability score.

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/email?query=example.com'

GET /api/util/port

Open Port Scan — Probe a host for a fixed set of common TCP ports (HTTP, HTTPS, SSH, FTP, SMTP, DNS, and common databases) and report which are open, the service name, and the response time.

Parameters: host (required)

curl -s 'https://dechonet.com/api/util/port?host=example.com'

GET /api/util/propagation

DNS Propagation Check — Query one DNS record across 8+ global public resolvers (Google, Cloudflare, Quad9, OpenDNS, and more) simultaneously and report which resolvers return stale versus updated values.

Parameters: domain (required), type

curl -s 'https://dechonet.com/api/util/propagation?domain=example.com'

GET /api/util/reverse-dns

Reverse DNS (PTR) Lookup — Resolve the PTR (reverse DNS) record for an IPv4 or IPv6 address and verify forward-confirmed reverse DNS (FCrDNS) by checking that the PTR hostname resolves back to the same IP.

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/reverse-dns?query=example.com'

GET /api/util/asn

ASN / BGP Lookup — Look up Autonomous System (ASN) / BGP information for an IP address or AS number: the network operator, announced prefixes, abuse contact, and a classification (cloud, CDN, ISP, hosting, or enterprise).

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/asn?query=example.com'

GET /api/util/rdap

WHOIS / RDAP Domain Lookup — Retrieve domain registration data via RDAP (with WHOIS fallback): registrar, creation/expiry/update dates, nameservers, and EPP status flags, highlighting risk states such as clientHold and pendingDelete.

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/rdap?query=example.com'

GET /api/util/subdomains

Subdomain Discovery — Enumerate the subdomains of a domain from Certificate Transparency logs — fully passive (no packets are sent to the target; CT logs are public records of every TLS certificate ever issued).

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/subdomains?query=example.com'

GET /api/util/lookalike

Lookalike Domain Check — Generate the typosquat/lookalike variants of a domain that phishers actually register — homoglyph swaps (l→1, o→0, rn→m), TLD swaps (.com→.co), character omissions, transpositions, repetitions, hyphenations — and check which of them are currently registered (live NS delegation via DoH).

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/lookalike?query=example.com'

GET /api/util/ip

My IP Info — Report information about the caller's own public IP as seen by the server: IPv4/IPv6 address, ISP, ASN, approximate geolocation, and proxy/VPN heuristics.

curl -s 'https://dechonet.com/api/util/ip'

POST /api/util/email-header

Email Header Analysis — Parse raw email headers to reconstruct the delivery path (each Received hop in order), extract SPF/DKIM/DMARC authentication results, measure per-hop delays, and flag unencrypted (non-TLS) hops.

JSON: headers

curl -s -X POST https://dechonet.com/api/util/email-header \
  -H 'Content-Type: application/json' \
  -d '{"headers": "…"}'

GET /api/util/owasp

OWASP Security Checkup — Assess a domain's OWASP posture from EXTERNAL OBSERVATION only: the OWASP Secure Headers Project plus the externally observable OWASP Top 10:2025 subset — A04 Cryptographic Failures (TLS/cert), A02 Security Misconfiguration (header/info leaks), and A03 Software Supply Chain Failures (outdated components via version disclosure) — returning an A+ to F grade.

Parameters: host (required)

curl -s 'https://dechonet.com/api/util/owasp?host=example.com'

GET /api/util/impersonation

Brand Impersonation Exposure — Assess how exposed a domain is to brand impersonation and phishing, PASSIVELY: live typosquat/lookalike domains (homoglyph, omission, transposition, TLD swap) that actually resolve, operational subdomains (dev/staging/admin) exposed in CT logs, and whether a wildcard certificate exists — returning an A+ (low exposure) to F (high exposure) grade.

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/impersonation?query=example.com'

GET /api/util/changes

Domain Change History — Report what has changed for a domain over time — the security regressions and drift that DechoNet's daily monitoring has recorded across every watch on the domain (SSL grade, headers, DNS, OWASP posture, impersonation exposure, etc.).

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/changes?query=example.com'

GET /api/util/history

Infrastructure History — Show how a domain's (or IPv4 address's) infrastructure has changed over time from DechoNet's stored observations: nameservers, A/AAAA, MX, CNAME, certificate issuer, registrar, RDAP nameservers and status, and for an IP its ASN and PTR — each value with when it was first and last seen.

Parameters: target (required)

curl -s 'https://dechonet.com/api/util/history?target=example.com'

GET /api/util/pivot

Infrastructure Pivot — Find other domains DechoNet has seen with the same infrastructure value — a nameserver, IP address, MX host, certificate issuer or registrar — with first and last seen, to map related infrastructure (e.g.

Parameters: kind (required), value (required)

curl -s 'https://dechonet.com/api/util/pivot?kind=example.com&value=example.com'

POST /api/expect

Set Outside Expectations (daily re-check) — Record what a domain should show from outside and check it now — HSTS or another header present, DMARC enforcing, an issue key no longer reported, an HTTP or TLS grade at or above a level, a certificate with enough days left, a DNS record present, absent or containing a value, HTTPS answering.

JSON: domain, expect, label

curl -s -X POST https://dechonet.com/api/expect \
  -H 'Content-Type: application/json' \
  -d '{"domain": "…", "expect": "…", "label": "…"}'

POST /api/expect

Verify Outside Expectations Now — Check expectations from outside now, with fresh reads: either a stored set by id (from set_expectations — its state is updated and an anonymous set is kept another 30 days), or a domain plus a list of checks once, storing nothing.

JSON: id

curl -s -X POST https://dechonet.com/api/expect \
  -H 'Content-Type: application/json' \
  -d '{"id": "…"}'

POST /api/precheck

Check a Page Before Logging In or Paying — Check the page an agent is about to log in, pay, download from or submit to: whether the address impersonates a brand, how new the domain is, whether DechoNet or a licensed feed has already flagged it, and — opened from Seoul (and Tokyo for Japan-targeted pages) as a phone — what the page turns into, including text it hides from people but an AI agent would read (instructions to ignore its rules, hand over secrets or keep the user out of it raise the answer to suspicious).

JSON: url, action, expectedBrand, page

curl -s -X POST https://dechonet.com/api/precheck \
  -H 'Content-Type: application/json' \
  -d '{"url": "…", "action": "…", "expectedBrand": "…", "page": "…"}'

POST /api/page-report

Report a Page — Report a page to DechoNet: phishing or brand impersonation, a fake payment window (card fields where a payment provider should be), hidden instructions aimed at AI agents, a malicious download, a DechoNet verdict that looks wrong (false_positive) or a danger it missed (missed), an MCP server whose tool descriptions steer agents (malicious_mcp — url is the MCP endpoint), or a network anomaly (network_anomaly — the certificate serial/issuer or addresses you saw for the host, in observed).

JSON: url, kind, observed

curl -s -X POST https://dechonet.com/api/page-report \
  -H 'Content-Type: application/json' \
  -d '{"url": "…", "kind": "…", "observed": "…"}'

GET /api/util/golive

Go-Live Readiness Checklist — Check whether a domain is ready to launch or migrate — a go/no-go verdict over five essentials: DNS resolves to an IP, has propagated consistently across global resolvers, SSL/TLS is ready, the site is reachable over HTTPS, and the domain registration is not about to expire.

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/golive?query=example.com'

GET /api/util/pqc

Post-Quantum TLS Readiness — Check whether a website's public TLS endpoint is ready for post-quantum cryptography: does it complete a TLS 1.3 handshake that offers only the hybrid X25519MLKEM768 key exchange (ML-KEM), and does the organisation's own server provide it or a CDN edge in front of it.

Parameters: host (required)

curl -s 'https://dechonet.com/api/util/pqc?host=example.com'

GET /api/util/mcp-check

MCP Server Check — Check a remote MCP server from outside before connecting it to an agent: whether it requires authentication (and publishes OAuth protected-resource metadata, RFC 9728), which of its tools act on the world (run commands, write or delete files, send messages, make payments, read secrets), whether its server instructions or tool and parameter descriptions contain text that steers an agent (tool poisoning), whether a web page on any site could call it (CORS and Origin), HTTPS, and tool annotations.

Parameters: url (required)

curl -s 'https://dechonet.com/api/util/mcp-check?url=example.com'

GET /api/util/exposure

Exposed Admin Page Check — Map what an organisation exposes to the internet beyond its home page: subdomains from Certificate Transparency logs (plus hosts DechoNet has already observed), each opened once from outside and sorted into developer/ops tools, directory listings, admin screens, VPN/remote-access logins, staging servers, default install pages, login pages and so on — the forgotten assets AI-driven attack tools look for first.

Parameters: domain (required)

curl -s 'https://dechonet.com/api/util/exposure?domain=example.com'

POST /api/pilot/kit-observe

Case render fingerprint observation — Explicitly observe an existing authenticated case member under conditional-render rules and daily cap.

JSON: case, target

curl -s -X POST https://dechonet.com/api/pilot/kit-observe \
  -H 'Content-Type: application/json' \
  -d '{"case": "…", "target": "…"}'

POST /api/account/asm/nuclei-start

Owned ASM Nuclei start — Explicitly start limited active requests to a selected currently verified asset in your owned ASM report.

JSON: asmId, target, confirm

curl -s -X POST https://dechonet.com/api/account/asm/nuclei-start \
  -H 'Content-Type: application/json' \
  -d '{"asmId": "…", "target": "…", "confirm": "…"}'

GET /api/account/asm/nuclei-status

Owned ASM Nuclei status — Read private job status, coverage and sanitized evidence with current view permission and ownership.

Parameters: id (required)

curl -s 'https://dechonet.com/api/account/asm/nuclei-status?id=example.com'

POST /api/account/asm/nuclei-cancel

Owned ASM Nuclei cancel — Stop new requests and terminate this workspace scanner with edit permission.

JSON: id

curl -s -X POST https://dechonet.com/api/account/asm/nuclei-cancel \
  -H 'Content-Type: application/json' \
  -d '{"id": "…"}'

GET /api/util/gate

Pre-deploy gate — Runs the SSL and HTTP checks against a deployed URL and answers pass or fail per check, for failing a CI build.

Parameters: url (required), min_ssl, min_headers, min_days, require_https

curl -s 'https://dechonet.com/api/util/gate?url=example.com'

From an AI agent, the same checks are MCP tools: MCP →