{"openapi":"3.1.0","info":{"title":"URL & Domain Trust","version":"0.1.0","description":"Trust and phishing analysis for a link or a domain. `analyze` runs offline lexical phishing checks on a URL (IP hosts, embedded credentials, punycode, brand typosquatting, brand-in-subdomain, abused TLDs, shorteners) → risk score, verdict and reasons. `domain` scores a domain's reputation from live signals (RDAP registration age, DNS/MX presence) → age, records and a trust score.","x-guidance":"Trust and phishing analysis for a link or a domain. `analyze` runs offline lexical phishing checks on a URL (IP hosts, embedded credentials, punycode, brand typosquatting, brand-in-subdomain, abused TLDs, shorteners) → risk score, verdict and reasons. `domain` scores a domain's reputation from live signals (RDAP registration age, DNS/MX presence) → age, records and a trust score. Each operation is an HTTP POST to its /v1/<operation> path with a JSON request body (see each operation's requestBody schema) and returns a JSON response. Endpoints are paid per successful call via x402 or MPP (USDC on Base); an unpaid request returns 402 with payment metadata in the WWW-Authenticate header.","contact":{"email":"hello@openverbs.com"}},"x-discovery":{"ownershipProofs":["0xb1401a71756f51464a9962db12f1eb3e9522490cd20010b06d00cf7b7770acfd5f79721f9dfdf2643f8cecd29af3bde9ec133941a386042b32d9886053a70de61b","0xc1c1f11793e18a00fcb7072421f26e89fb75b6aa517fa84370564991f4b10efa024f6f57e4e67eefd20cf46cc01fc5a62d793fa8fbcda04f26c946a3433d73f91b","0x676b474af0ef9ed4809b5d12d2e789b36e52d56215b21f601d71f76620e36ec630347116a7b2b349a3c3681e5db0fbfa76c4169a676b6d6f27864d0e5017284a1c","0xc2ab96522515ed9e9bc4f1a241b774bd48df42e951ddbf7f6aa8fc76f5a96a20421703e1ec402ce7eb1e4eabea3b6e4e4129cf39d56ea91cf4fcf38561fc94fc1c"]},"servers":[{"url":"https://urltrust.openverbs.com"}],"paths":{"/health":{"get":{"summary":"Health check","security":[],"responses":{"200":{"description":"Healthy","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean"},"service":{"type":"string"},"version":{"type":"string"}}}}}}}}},"/v1/analyze":{"post":{"summary":"Analyze URL trust","description":"Score how likely a URL is to be phishing or untrustworthy using offline lexical and structural heuristics (no network lookups). Checks raw-IP hosts, embedded credentials, punycode/homoglyph labels, brand typosquatting, brand-in-subdomain, abused TLDs, shorteners, random hostnames, odd ports, plaintext http and executable paths. Returns a 0-100 risk score, a verdict and the reasons. Paid endpoint (x402 + MPP). Price: $0.004000 USDC per successful payment.","tags":["analyze url trust","phishing url scanner","url risk score","detect typosquatting url","malicious link analysis","url safety check"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"url":{"type":"string","minLength":1,"maxLength":2048,"description":"Absolute http(s) URL to analyze."}},"required":["url"],"additionalProperties":false},"example":{"url":"https://github.com/login"}}}},"responses":{"200":{"description":"`{ url, host, scheme, score (0-100), verdict: low|medium|high, reasons: [{ code, message, weight }] }`.","content":{"application/json":{"schema":{"type":"object","description":"`{ url, host, scheme, score (0-100), verdict: low|medium|high, reasons: [{ code, message, weight }] }`."}}}},"400":{"description":"Invalid request; no payment is attempted"},"402":{"description":"Payment required; x402/MPP metadata returned in headers"},"502":{"description":"Upstream provider error after payment verification"}},"x-payment-info":{"amount":"4000","currency":"0x20c000000000000000000000b9537d11c60e8b50","description":"Score how likely a URL is to be phishing or untrustworthy using offline lexical and structural heuristics (no network lookups). Checks raw-IP hosts, embedded credentials, punycode/homoglyph labels, brand typosquatting, brand-in-subdomain, abused TLDs, shorteners, random hostnames, odd ports, plaintext http and executable paths. Returns a 0-100 risk score, a verdict and the reasons.","method":"tempo","preferredOffer":"mpp-tempo","price":{"mode":"fixed","currency":"USD","amount":"0.004000"},"protocols":[{"x402":{"scheme":"exact","network":"eip155:8453","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}},{"mpp":{"method":"evm","intent":"charge","network":"8453","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}},{"mpp":{"method":"tempo","intent":"charge","network":"4217","currency":"0x20c000000000000000000000b9537d11c60e8b50","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}}],"network":"4217","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A","offers":[{"amount":"4000","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","description":"Score how likely a URL is to be phishing or untrustworthy using offline lexical and structural heuristics (no network lookups). Checks raw-IP hosts, embedded credentials, punycode/homoglyph labels, brand typosquatting, brand-in-subdomain, abused TLDs, shorteners, random hostnames, odd ports, plaintext http and executable paths. Returns a 0-100 risk score, a verdict and the reasons.","intent":"charge","method":"evm","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"},{"amount":"4000","currency":"0x20c000000000000000000000b9537d11c60e8b50","description":"Score how likely a URL is to be phishing or untrustworthy using offline lexical and structural heuristics (no network lookups). Checks raw-IP hosts, embedded credentials, punycode/homoglyph labels, brand typosquatting, brand-in-subdomain, abused TLDs, shorteners, random hostnames, odd ports, plaintext http and executable paths. Returns a 0-100 risk score, a verdict and the reasons.","intent":"charge","method":"tempo","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}]}}},"/v1/domain":{"post":{"summary":"Score a domain's reputation","description":"Assess how trustworthy a domain is using authoritative live signals, not just its spelling. Fuses RDAP registration data (domain age — the single strongest phishing signal — plus registrar, expiry and registry status flags), DNS resolvability (A/AAAA), MX presence and DNSSEC into a 0-100 risk score with a verdict (low/medium/high) and the exact reasons. Pairs with `urltrust` (lexical) for a complete picture. Paid endpoint (x402 + MPP). Price: $0.006000 USDC per successful payment.","tags":["domain reputation score","check domain trust","rdap domain age","dns mx reputation","domain phishing signals","whois trust lookup"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"domain":{"type":"string","minLength":1,"maxLength":253,"description":"Registrable domain to score, e.g. \"example.com\" (no scheme or path)."}},"required":["domain"],"additionalProperties":false},"example":{"domain":"github.com"}}}},"responses":{"200":{"description":"`{ domain, registered, ageDays, createdAt, expiresAt, registrar, resolves, addresses, hasMx, mx, dnssec, status, score (0-100), verdict, reasons: [{ code, message, weight }] }`.","content":{"application/json":{"schema":{"type":"object","description":"`{ domain, registered, ageDays, createdAt, expiresAt, registrar, resolves, addresses, hasMx, mx, dnssec, status, score (0-100), verdict, reasons: [{ code, message, weight }] }`."}}}},"400":{"description":"Invalid request; no payment is attempted"},"402":{"description":"Payment required; x402/MPP metadata returned in headers"},"502":{"description":"Upstream provider error after payment verification"}},"x-payment-info":{"amount":"6000","currency":"0x20c000000000000000000000b9537d11c60e8b50","description":"Assess how trustworthy a domain is using authoritative live signals, not just its spelling. Fuses RDAP registration data (domain age — the single strongest phishing signal — plus registrar, expiry and registry status flags), DNS resolvability (A/AAAA), MX presence and DNSSEC into a 0-100 risk score with a verdict (low/medium/high) and the exact reasons. Pairs with `urltrust` (lexical) for a complete picture.","method":"tempo","preferredOffer":"mpp-tempo","price":{"mode":"fixed","currency":"USD","amount":"0.006000"},"protocols":[{"x402":{"scheme":"exact","network":"eip155:8453","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}},{"mpp":{"method":"evm","intent":"charge","network":"8453","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}},{"mpp":{"method":"tempo","intent":"charge","network":"4217","currency":"0x20c000000000000000000000b9537d11c60e8b50","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}}],"network":"4217","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A","offers":[{"amount":"6000","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","description":"Assess how trustworthy a domain is using authoritative live signals, not just its spelling. Fuses RDAP registration data (domain age — the single strongest phishing signal — plus registrar, expiry and registry status flags), DNS resolvability (A/AAAA), MX presence and DNSSEC into a 0-100 risk score with a verdict (low/medium/high) and the exact reasons. Pairs with `urltrust` (lexical) for a complete picture.","intent":"charge","method":"evm","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"},{"amount":"6000","currency":"0x20c000000000000000000000b9537d11c60e8b50","description":"Assess how trustworthy a domain is using authoritative live signals, not just its spelling. Fuses RDAP registration data (domain age — the single strongest phishing signal — plus registrar, expiry and registry status flags), DNS resolvability (A/AAAA), MX presence and DNSSEC into a 0-100 risk score with a verdict (low/medium/high) and the exact reasons. Pairs with `urltrust` (lexical) for a complete picture.","intent":"charge","method":"tempo","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}]}}},"/v1/techstack":{"post":{"summary":"Website technology stack lookup","description":"Detect the technology stack a website runs on. Given a domain, returns the software and services it uses (CDN, analytics, frameworks, CMS, payment, hosting, security) grouped by category, plus a domain rank, last-seen date, country and public social links. Unknown domain returns found=false. Paid endpoint (x402 + MPP). Price: $0.050000 USDC per successful payment.","tags":["website technology lookup","tech stack detector","what technologies a site uses","cms framework detection","builtwith alternative api","domain technology profile"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"domain":{"type":"string","minLength":3,"maxLength":253,"description":"Bare domain to profile, e.g. stripe.com (scheme and path are stripped)."}},"required":["domain"],"additionalProperties":false},"example":{"domain":"stripe.com"}}}},"responses":{"200":{"description":"`found`, `domain`, `categories`, `technologies` (category -> tech names), a flat `stack` list, and (where present) `domainRank`, `lastVisited`, `country`, `language`, `title`, `description`, `emails`, `phones`, `social`.","content":{"application/json":{"schema":{"type":"object","description":"`found`, `domain`, `categories`, `technologies` (category -> tech names), a flat `stack` list, and (where present) `domainRank`, `lastVisited`, `country`, `language`, `title`, `description`, `emails`, `phones`, `social`."}}}},"400":{"description":"Invalid request; no payment is attempted"},"402":{"description":"Payment required; x402/MPP metadata returned in headers"},"502":{"description":"Upstream provider error after payment verification"}},"x-payment-info":{"amount":"50000","currency":"0x20c000000000000000000000b9537d11c60e8b50","description":"Detect the technology stack a website runs on. Given a domain, returns the software and services it uses (CDN, analytics, frameworks, CMS, payment, hosting, security) grouped by category, plus a domain rank, last-seen date, country and public social links. Unknown domain returns found=false.","method":"tempo","preferredOffer":"mpp-tempo","price":{"mode":"fixed","currency":"USD","amount":"0.050000"},"protocols":[{"x402":{"scheme":"exact","network":"eip155:8453","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}},{"mpp":{"method":"evm","intent":"charge","network":"8453","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}},{"mpp":{"method":"tempo","intent":"charge","network":"4217","currency":"0x20c000000000000000000000b9537d11c60e8b50","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}}],"network":"4217","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A","offers":[{"amount":"50000","currency":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","description":"Detect the technology stack a website runs on. Given a domain, returns the software and services it uses (CDN, analytics, frameworks, CMS, payment, hosting, security) grouped by category, plus a domain rank, last-seen date, country and public social links. Unknown domain returns found=false.","intent":"charge","method":"evm","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"},{"amount":"50000","currency":"0x20c000000000000000000000b9537d11c60e8b50","description":"Detect the technology stack a website runs on. Given a domain, returns the software and services it uses (CDN, analytics, frameworks, CMS, payment, hosting, security) grouped by category, plus a domain rank, last-seen date, country and public social links. Unknown domain returns found=false.","intent":"charge","method":"tempo","recipient":"0xb3f4de103F34b99f0Da19B4F16D6B53a14C2194A"}]}}}},"x-service-info":{"categories":["trust-safety"],"docs":{"homepage":"https://urltrust.openverbs.com","apiReference":"https://urltrust.openverbs.com/openapi.json"}}}