---
title: "Hash generator: SHA-256, SHA-512, SHA-3, Keccak-256, BLAKE2 and HMAC digests"
method: GET
path: "/v1/code/hash"
tags: ["deterministic", "no-api-key", "code", "crypto", "hashing"]
---

# Hash generator: SHA-256, SHA-512, SHA-3, Keccak-256, BLAKE2 and HMAC digests

`GET /v1/code/hash`

## Request

- Base URL: `https://api.duoleads.com`
- URL: `https://api.duoleads.com/v1/code/hash`
- Auth: none declared

Hash generator: compute a cryptographic digest of supplied data: SHA-256, SHA-384, SHA-512, SHA-1, SHA3-256, SHA3-512, Keccak-256, BLAKE2b-256 and BLAKE2b-512, plus HMAC with any of them. Input is UTF-8 text, base64 or hex bytes; output is hex, base64, base64url or base32. Returns the digest, the byte length of the input, and the exact algorithm identifier used.

**Output (`data`):** digest, algo, out, input_bytes, hmac (boolean), bit_length.

Deterministic: identical input returns identical output, so the response is served with `Cache-Control: private, max-age=31536000, immutable` (the paying client may cache it indefinitely; shared caches must not, because the response is paid).

Price: $0.05 USDC per call (x402, Base). Route contract version 1.0.0. Docs: https://api.duoleads.com/docs#code-hash

## Query parameters

- `algo` 'sha256' | 'sha384' | 'sha512' | 'sha1' | 'sha3-256' | 'sha3-512' | 'keccak256' | 'blake2b-256' | 'blake2b-512', required
- `data` string, required
- `encoding` 'utf8' | 'base64' | 'base64url' | 'hex'
- `out` 'hex' | 'base64' | 'base64url' | 'base32'
- `hmac_key` string
- `hmac_key_encoding` 'utf8' | 'base64' | 'base64url' | 'hex'

## Response `200`

Paid and settled. `data` is route-specific; a route that judges its input returns 200 with `data.valid: false` for a bad value.

- object
  - `ok` unknown, required
  - `route` '/v1/code/hash', required
  - `version` '1.0.0', required
  - `data` object, required: digest, algo, out, input_bytes, hmac (boolean), bit_length.
    - `digest` string, required
    - `algo` string, required
    - `out` string, required
    - `input_bytes` integer, required
    - `hmac` boolean, required
    - `bit_length` integer, required
  - `meta` Meta, required
    - `disclaimer` string, required: Legal short disclaimer, identical on every response.
    - `request_id` string, required: ULID.
    - `computed_at` string, date-time, required: RFC 3339 UTC with milliseconds.
    - `price_usd` string, required: Decimal string, "0.05".
    - `deterministic` boolean, required
    - `sources` object[]: Present only on routes that read a vendored dataset: the exact edition that answered.
      - `id` string, required
      - `version` string, required
      - `published` string, required
      - `attribution` string
      - `licence` string

## Other responses

- `400`: MISSING_PARAM, INVALID_PARAM or UNSUPPORTED_VALUE. Not charged: validation runs before the paywall.
- `402`: Payment required. No valid PAYMENT-SIGNATURE was supplied: read the base64 PAYMENT-REQUIRED header (or this body) for the price ($0.05 = 50000 atomic USDC on eip155:8453), sign an EIP-3009 authorization and retry. Also returned when settlement is declined (PAYMENT_FAILED). Nothing is charged on a 402.
- `404`: NOT_FOUND: unknown path. Not charged.
- `405`: METHOD_NOT_ALLOWED: only GET and HEAD are served. Not charged.
- `413`: INPUT_TOO_LARGE: a parameter exceeded its documented maximum length. Not charged.
- `500`: INTERNAL: a server bug. Not charged.

---

[API](https://skmtc.dev/duoleads/apis/duo-data-utilities-iban-isin-vat-tax-id-barcode-timezone-geo.md) · [All operations](https://skmtc.dev/duoleads/apis/duo-data-utilities-iban-isin-vat-tax-id-barcode-timezone-geo/llms.txt) · [OpenAPI document](https://skmtc.dev/duoleads/apis/duo-data-utilities-iban-isin-vat-tax-id-barcode-timezone-geo/revisions/18790d59615e?raw)