---
title: "Safety-scan lookup for ANY file hash or repo reference — not just Hugging Bay-hosted rows."
method: GET
path: "/api/safety"
tags: ["Trust", "Agent Docs"]
---

# Safety-scan lookup for ANY file hash or repo reference — not just Hugging Bay-hosted rows.

`GET /api/safety`

## Request

- Base URL: `https://huggingbay.xyz`
- URL: `https://huggingbay.xyz/api/safety`
- Auth: none declared

Pass sha256=<hex> (matches hosted files with a recorded SHA-256) or repo=<owner/name-or-id>. Unknown hashes return verdict unknown with hash_not_in_catalog so agents can treat unverified provenance as a risk signal.

**Inputs.** Path, query and header fields are listed below. No request body is required.

**Outputs.** See each status below for its media type, schema and headers. A missing record or unavailable capability is not a successful empty result.

**Errors.** API JSON failures use the documented response schema. Read code, message and next; retry only when the response allows it. Auth, invalid input and missing records need a caller change.

**Rate limits.** Public read budgets apply by client IP and route group. This operation can have a smaller route-specific budget. Read Retry-After on 429 or retryable 503 responses.

## Query parameters

- `sha256` string
- `repo` string
- `compat` 'containment'

## Response `200`

Safety verdict (known or unknown-hash)

- object: Safety verdict (known or unknown-hash). Fields can vary; no stronger field guarantee is specified for this operation.

## Other responses

- `400`: Missing/invalid parameters
- `404`: Repo not found

---

[API](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api.md) · [All operations](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/huggingbay/apis/hugging-bay-public-api/revisions/63c474bf0fe4?raw)