---
title: "Scan a URL for SSRF risks, private-network access, and policy violations before fetching."
method: POST
path: "/v1/scan/url"
tags: ["security"]
---

# Scan a URL for SSRF risks, private-network access, and policy violations before fetching.

`POST /v1/scan/url`

## Request

- Base URL: `https://api.agent-toolbox.ai`
- URL: `https://api.agent-toolbox.ai/v1/scan/url`
- Auth: one of:
  - HTTP bearer
  - none

Cost: 1 credit(s). Free tier: 10 calls per IP (no auth).

## Request body

- ScanUrlRequest
  - `url` string, required
  - `policy` object
    - `allowSchemes` string[]
    - `allowHosts` string[]
    - `denyHosts` string[]
    - `denyPrivate` boolean
    - `allowedPorts` integer[]
    - `resolve` boolean
    - `blockSeverityAtOrAbove` 'low' | 'medium' | 'high' | 'critical'

## Response `200`

Success.

- ScanUrlResponse
  - `verdict` 'PASS' | 'FLAG' | 'BLOCK', required
  - `target` object, required
    - `scheme` string, required
    - `host` string, required
    - `hostType` 'ipv4' | 'ipv6' | 'hostname', required
    - `ipClass` 'public' | 'loopback' | 'private' | 'link-local' | 'reserved' | 'unknown', required
    - `port` integer, nullable, required
    - `normalizedUrl` string, required
  - `findings` object[], required
    - `ruleId` string, required
    - `severity` 'low' | 'medium' | 'high' | 'critical', required
    - `message` string, required
  - `counts` object, required
    - `low` integer, required
    - `medium` integer, required
    - `high` integer, required
    - `critical` integer, required
  - `certificate` string, required: Tamper-evident SHA-256 certificate.
  - `latencyMs` number, required: Server compute time in ms.

## Other responses

- `400`: Invalid request body.
- `402`: Free tier exhausted or insufficient credits.

---

[API](https://skmtc.dev/agent-toolbox/apis/agent-toolbox-ai-api.md) · [All operations](https://skmtc.dev/agent-toolbox/apis/agent-toolbox-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agent-toolbox/apis/agent-toolbox-ai-api/revisions/07132043190b?raw)