BXSS URL Checker API

Base URL: https://api.urlchecker.bxss.site · All responses are JSON over HTTPS.

Machine-readable OpenAPI 3.1 document: /openapi.json.

Authentication

Create an account, then generate an API key on the account page. Send it with every request:

Authorization: Bearer YOUR_API_KEY

or (used by the Zapier integration):

X-API-Key: YOUR_API_KEY

Keys can be revoked any time. Invalid or missing keys return 401.

Rate limiting

Check endpoints are limited to 20 requests per minute per IP by default; exceeding the limit returns 429 with a JSON error.

Endpoints

GET/health

Service health. No authentication required.

GET/v1/whoami

Returns the authenticated account email — handy for verifying a key and as a Zapier connection label.

curl https://api.urlchecker.bxss.site/v1/whoami -H "X-API-Key: YOUR_API_KEY"

{
  "email": "you@example.com",
  "created_at": "2026-08-15T10:00:00Z"
}

POST/v1/check

Check a URL. Body: {"url":"https://example.com","method":"GET"} — method may be GET or HEAD (default GET). Only http/https is allowed; private and local network addresses are rejected.

curl -X POST https://api.urlchecker.bxss.site/v1/check \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

{
  "id": "check_7k3f9x2m1qpzw4dn",
  "url": "https://example.com",
  "final_url": "https://example.com/",
  "status_code": 200,
  "response_time_ms": 143,
  "content_type": "text/html",
  "response_size": 1256,
  "title": "Example Domain",
  "checked_at": "2026-08-15T10:00:00Z"
}

GET/v1/checks

List your recent checks, newest first. Optional ?limit=25 (1–100). Returns a JSON array — suitable for polling triggers.

curl https://api.urlchecker.bxss.site/v1/checks?limit=10 \
  -H "X-API-Key: YOUR_API_KEY"

GET/v1/checks/{id}

Fetch a single check by its ID.

curl https://api.urlchecker.bxss.site/v1/checks/check_7k3f9x2m1qpzw4dn \
  -H "X-API-Key: YOUR_API_KEY"

Check object fields

Field	Type	Description
`id`	string	Stable unique check ID
`url`	string	Requested URL
`final_url`	string\|null	Final URL after redirects
`status_code`	integer\|null	HTTP status code
`response_time_ms`	integer\|null	Response time in milliseconds
`content_type`	string\|null	Content type
`response_size`	integer\|null	Response size in bytes
`title`	string\|null	Page title when HTML
`checked_at`	string	ISO 8601 timestamp

Errors

{
  "error": {
    "code": "INVALID_URL",
    "message": "Please provide a valid HTTP or HTTPS URL."
  }
}

Status	Code	Meaning
400	INVALID_URL / BLOCKED_URL / INVALID_METHOD	Bad request body, disallowed URL or method
401	UNAUTHORIZED	Missing, invalid, or revoked API key
404	NOT_FOUND	Unknown check ID
422	TIMEOUT / TOO_MANY_REDIRECTS / REQUEST_FAILED	The URL could not be checked
429	RATE_LIMITED	Too many requests
500	INTERNAL	Unexpected server error

Security notes

Only public HTTP/HTTPS URLs can be checked. Requests to localhost, private, link-local, and cloud-metadata ranges are rejected — on initial requests and on every redirect — and resolved addresses are re-validated at connection time. Redirects are limited to 5, timeouts to 10000 ms, and response reading to 2 MB.