Site health check API

Input

Query parameters.

Example request

curl -i 'https://api.lookproof.dev/v1/site/health?domain=example.com'

import asyncio
import os

from eth_account import Account
from x402 import x402Client
from x402.http.clients import x402HttpxClient
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact import register_exact_evm_client


async def main() -> None:
    signer = EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"]))
    client = register_exact_evm_client(x402Client(), signer, networks="eip155:8453")
    async with x402HttpxClient(client) as http:
        response = await http.get('https://api.lookproof.dev/v1/site/health', params={'domain': 'example.com'})
        response.raise_for_status()
        print(response.json())


asyncio.run(main())

import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
import { ExactEvmScheme } from "@x402/evm";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.EVM_PRIVATE_KEY);
const fetchWithPayment = wrapFetchWithPaymentFromConfig(fetch, {
  schemes: [{ network: "eip155:8453", client: new ExactEvmScheme(account) }],
});

const response = await fetchWithPayment("https://api.lookproof.dev/v1/site/health?domain=example.com");
console.log(await response.json());

curl: unpaid request — returns 402 with the price (PAYMENT-REQUIRED). The Python and JavaScript clients pay it and send the request again. Only ordinary wallets (EOA) can pay; smart-contract wallets get a 402 without charge. See payments.

Example response

{
  "checked_at": "2026-10-24T12:00:00Z",
  "data": {
    "domain": "example.com",
    "http": {
      "domain": "example.com",
      "from_http": {
        "error": null,
        "final_status": 200,
        "final_url": "https://example.com/",
        "hops": [
          {
            "location": "https://example.com/",
            "status": 301,
            "url": "http://example.com/"
          },
          {
            "location": null,
            "status": 200,
            "url": "https://example.com/"
          }
        ],
        "start_url": "http://example.com/"
      },
      "from_https": {
        "error": null,
        "final_status": 200,
        "final_url": "https://example.com/",
        "hops": [
          {
            "location": null,
            "status": 200,
            "url": "https://example.com/"
          }
        ],
        "start_url": "https://example.com/"
      },
      "headers": {
        "content_security_policy": "default-src 'self'; frame-ancestors 'none'",
        "content_security_policy_report_only": null,
        "cookies": [
          {
            "http_only": true,
            "name": "session",
            "same_site": "lax",
            "secure": true
          }
        ],
        "cross_origin_opener_policy": "same-origin",
        "permissions_policy": "camera=(), microphone=()",
        "referrer_policy": "strict-origin-when-cross-origin",
        "strict_transport_security": {
          "include_subdomains": true,
          "max_age": 63072000,
          "preload": true,
          "raw": "max-age=63072000; includeSubDomains; preload",
          "valid": true
        },
        "x_content_type_options": "nosniff",
        "x_frame_options": null
      }
    },
    "rdap": {
      "created": "1995-08-14T04:00:00Z",
      "days_to_expiry": 292,
      "delegation_signed": true,
      "domain": "example.com",
      "expires": "2027-08-13T04:00:00Z",
      "last_changed": "2026-08-14T07:01:39Z",
      "ldh_name": "example.com",
      "nameservers": [
        "a.iana-servers.net",
        "b.iana-servers.net"
      ],
      "rdap_server": "rdap.verisign.com",
      "registered": true,
      "registrar": "RESERVED-Internet Assigned Numbers Authority",
      "registrar_iana_id": 376,
      "statuses": [
        "client delete prohibited",
        "client transfer prohibited",
        "client update prohibited"
      ]
    },
    "tls": {
      "address_family": "ipv4",
      "chain": [
        {
          "issuer": "CN=Example Issuing CA",
          "subject": "CN=example.com"
        },
        {
          "issuer": "CN=Example Issuing CA",
          "subject": "CN=Example Issuing CA"
        }
      ],
      "cipher": "TLS_AES_256_GCM_SHA384",
      "days_remaining": 36,
      "domain": "example.com",
      "hostname_match": true,
      "issuer": "CN=Example Issuing CA",
      "key_bits": 256,
      "key_type": "ec",
      "not_after": "2026-11-30T00:00:00Z",
      "not_before": "2026-09-01T00:00:00Z",
      "san": [
        "example.com",
        "www.example.com"
      ],
      "serial_number": "5ec0de",
      "signature_algorithm": "ecdsa-with-SHA256",
      "subject_cn": "example.com",
      "tls_version": "TLSv1.3",
      "trusted": true,
      "untrusted_reason": null
    }
  },
  "endpoint": "site.health",
  "findings": [],
  "meta": {
    "cache_hit": false,
    "duration_ms": 42,
    "fresh_until": "2026-10-24T12:05:00Z",
    "observed_at": "2026-10-24T12:00:00Z",
    "resolver": null,
    "source": "dns"
  },
  "request_id": "req_aaaaaaaaaaaaaaaaaaaaaaaaaa",
  "schema_version": "1.0",
  "status": "ok"
}

Response fields

Fields in data

Status codes

Errors use the common error body. See errors.

Findings this endpoint can return