API features

Consistent JSON envelope

{
  "status": "success",
  "http_code": 200,
  "code": "SUCCESS",
  "message": "Operation completed",
  "data": { ... }
}

Request tracking

Each request gets an X-Request-ID header (a UUID). Send your own or use the generated one to line up logs across services. The ID comes back in both the response header and the JSON body.

Rate limiting and quotas

Sandbox mode

Try any endpoint without signing up. The "try it" dialog on every endpoint page grabs a sandbox token for you, so you can call the API right in your browser.

Security headers

• Content Security Policy (CSP)
• HTTP Strict Transport Security (HSTS)
• X-Frame-Options, X-Content-Type-Options
• Referrer Policy
• Strict TLS (TLS 1.2+) with modern ciphers

CORS support

All API endpoints send CORS headers, so you can call the API straight from browser JavaScript without a proxy.

Input sanitization

String inputs are trimmed for you. For endpoints that take HTML (like HTML to PDF), dangerous tags and scripts are stripped to block injection attacks.

SSRF prevention

Endpoints that take URLs (screenshot, redirect tracer, link checker and others) check targets against private and reserved IP ranges to prevent server-side request forgery.

OpenAPI specification

There's a machine-readable OpenAPI (Swagger) spec for every endpoint. Import it into Postman, Insomnia or any OpenAPI tool to generate clients and validate requests.