HTTP API

The checks behind the web tools, over HTTP. All read-only; nothing attacks or sends data to the target.

OpenAPI document

The full OpenAPI 3.1 description, ready to load into Postman, Swagger Editor or a client generator.

openapi.json v2026-10-10

Basics

  • Base URL: https://dechonet.com — every response is JSON.
  • Authentication: none needed. Send an API key to have limits counted per key instead of per IP: header "Authorization: Bearer dn_…". Create keys on the monitoring account page. A wrong or revoked key gets 401. Only the infrastructure pivot (/api/util/pivot) requires a key.
  • Rate limits: 60 requests per minute per client (IP or key) by default, fewer for heavy checks. Over the limit you get 429 with a Retry-After header.
  • POST requests need the header "Content-Type: application/json".
  • Interpretation language: ?lang=en or ?lang=ko.
  • Free use is non-commercial. Get in touch to use it in company work or a product.

Response envelope

Every response has the same envelope. When ok is false, read error.code (INVALID_INPUT, RATE_LIMITED, UPSTREAM_ERROR and others) and message. Most checks return data.raw (what was observed) and data.interpretation (status, key figures, issues with severity, cause and action). cached is true when a recent stored result was returned.

{
  "ok": true,
  "requestId": "…",
  "cached": false,
  "updatedAt": "2026-10-10T04:00:00.000Z",
  "data": { "raw": { … }, "interpretation": { "status": "…", "kpis": [ … ], "issues": [ … ] } },
  "error": null
}

Endpoints

Each description is the first sentence of the matching MCP tool description.

GET /api/util/dns

DNS Lookup — Query DNS records (A, AAAA, MX, TXT, NS, SOA, CAA) for a domain and validate email-related records, including DNSSEC presence and SPF/DMARC syntax, returning severity-rated diagnostics.

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/dns?query=example.com'

GET /api/util/ssl

SSL Certificate Check — Inspect a host's served TLS/SSL certificate and connection: expiry date, issuer, SAN list, chain integrity, revocation (OCSP, then CRL; unknown when neither answers — not graded unless revoked), TLS version, and HSTS, returning an A+ to F grade weighted by certificate validity (40%), TLS version (25%), chain trust (15%), and HSTS (20%).

Parameters: host (required), port

curl -s 'https://dechonet.com/api/util/ssl?host=example.com'

GET /api/util/http

HTTP Security Headers Audit — Follow a URL's HTTP redirect chain and audit response security headers (CSP, HSTS, X-Frame-Options, COOP, CORP, COEP, Permissions-Policy), grading A+ to F on the six core headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy; COOP/CORP/COEP are reported but not graded) and flagging information leaks such as server-version disclosure.

Parameters: url (required)

curl -s 'https://dechonet.com/api/util/http?url=example.com'

GET /api/util/email

Email Authentication Check — Assess a domain's email authentication and deliverability posture: MX records, SPF, DMARC, DKIM (probes 15 common selectors), BIMI, MTA-STS, TLS-RPT, and DANE, plus a blacklist check across all MX hosts, returning a 0-100 deliverability score.

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/email?query=example.com'

GET /api/util/port

Open Port Scan — Probe a host for a fixed set of common TCP ports (HTTP, HTTPS, SSH, FTP, SMTP, DNS, and common databases) and report which are open, the service name, and the response time.

Parameters: host (required)

curl -s 'https://dechonet.com/api/util/port?host=example.com'

GET /api/util/propagation

DNS Propagation Check — Query one DNS record across 8+ global public resolvers (Google, Cloudflare, Quad9, OpenDNS, and more) simultaneously and report which resolvers return stale versus updated values.

Parameters: domain (required), type

curl -s 'https://dechonet.com/api/util/propagation?domain=example.com'

GET /api/util/reverse-dns

Reverse DNS (PTR) Lookup — Resolve the PTR (reverse DNS) record for an IPv4 or IPv6 address and verify forward-confirmed reverse DNS (FCrDNS) by checking that the PTR hostname resolves back to the same IP.

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/reverse-dns?query=example.com'

GET /api/util/asn

ASN / BGP Lookup — Look up Autonomous System (ASN) / BGP information for an IP address or AS number: the network operator, announced prefixes, abuse contact, and a classification (cloud, CDN, ISP, hosting, or enterprise).

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/asn?query=example.com'

GET /api/util/rdap

WHOIS / RDAP Domain Lookup — Retrieve domain registration data via RDAP (with WHOIS fallback): registrar, creation/expiry/update dates, nameservers, and EPP status flags, highlighting risk states such as clientHold and pendingDelete.

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/rdap?query=example.com'

GET /api/util/subdomains

Subdomain Discovery — Enumerate the subdomains of a domain from Certificate Transparency logs — fully passive (no packets are sent to the target; CT logs are public records of every TLS certificate ever issued).

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/subdomains?query=example.com'

GET /api/util/lookalike

Lookalike Domain Check — Generate the typosquat/lookalike variants of a domain that phishers actually register — homoglyph swaps (l→1, o→0, rn→m), TLD swaps (.com→.co), character omissions, transpositions, repetitions, hyphenations — and check which of them are currently registered (live NS delegation via DoH).

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/lookalike?query=example.com'

GET /api/util/ip

My IP Info — Report information about the caller's own public IP as seen by the server: IPv4/IPv6 address, ISP, ASN, approximate geolocation, and proxy/VPN heuristics.

curl -s 'https://dechonet.com/api/util/ip'

POST /api/util/email-header

Email Header Analysis — Parse raw email headers to reconstruct the delivery path (each Received hop in order), extract SPF/DKIM/DMARC authentication results, measure per-hop delays, and flag unencrypted (non-TLS) hops.

JSON: headers

curl -s -X POST https://dechonet.com/api/util/email-header \
  -H 'Content-Type: application/json' \
  -d '{"headers": "…"}'

GET /api/util/owasp

OWASP Security Checkup — Assess a domain's OWASP posture from EXTERNAL OBSERVATION only: the OWASP Secure Headers Project plus the externally observable Top 10 subset — A02 Cryptographic Failures (TLS/cert), A05 Security Misconfiguration (header/info leaks), and A06 Vulnerable & Outdated Components (version disclosure) — returning an A+ to F grade.

Parameters: host (required)

curl -s 'https://dechonet.com/api/util/owasp?host=example.com'

GET /api/util/impersonation

Brand Impersonation Exposure — Assess how exposed a domain is to brand impersonation and phishing, PASSIVELY: live typosquat/lookalike domains (homoglyph, omission, transposition, TLD swap) that actually resolve, operational subdomains (dev/staging/admin) exposed in CT logs, and whether a wildcard certificate exists — returning an A+ (low exposure) to F (high exposure) grade.

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/impersonation?query=example.com'

GET /api/util/changes

Domain Change History — Report what has changed for a domain over time — the security regressions and drift that DechoNet's daily monitoring has recorded across every watch on the domain (SSL grade, headers, DNS, OWASP posture, impersonation exposure, etc.).

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/changes?query=example.com'

GET /api/util/history

Infrastructure History — Show how a domain's (or IPv4 address's) infrastructure has changed over time from DechoNet's stored observations: nameservers, A/AAAA, MX, CNAME, certificate issuer, registrar, RDAP nameservers and status, and for an IP its ASN and PTR — each value with when it was first and last seen.

Parameters: target (required)

curl -s 'https://dechonet.com/api/util/history?target=example.com'

GET /api/util/pivot

Infrastructure Pivot — Find other domains DechoNet has seen with the same infrastructure value — a nameserver, IP address, MX host, certificate issuer or registrar — with first and last seen, to map related infrastructure (e.g.

Parameters: kind (required), value (required)

curl -s 'https://dechonet.com/api/util/pivot?kind=example.com&value=example.com'

GET /api/util/golive

Go-Live Readiness Checklist — Check whether a domain is ready to launch or migrate — a go/no-go verdict over five essentials: DNS resolves to an IP, has propagated consistently across global resolvers, SSL/TLS is ready, the site is reachable over HTTPS, and the domain registration is not about to expire.

Parameters: query (required)

curl -s 'https://dechonet.com/api/util/golive?query=example.com'

GET /api/util/pqc

Post-Quantum TLS Readiness — Check whether a website's public TLS endpoint is ready for post-quantum cryptography: does it complete a TLS 1.3 handshake that offers only the hybrid X25519MLKEM768 key exchange (ML-KEM), and does the organisation's own server provide it or a CDN edge in front of it.

Parameters: host (required)

curl -s 'https://dechonet.com/api/util/pqc?host=example.com'

GET /api/util/exposure

Exposed Admin Page Check — Map what an organisation exposes to the internet beyond its home page: subdomains from Certificate Transparency logs (plus hosts DechoNet has already observed), each opened once from outside and sorted into developer/ops tools, directory listings, admin screens, VPN/remote-access logins, staging servers, default install pages, login pages and so on — the forgotten assets AI-driven attack tools look for first.

Parameters: domain (required)

curl -s 'https://dechonet.com/api/util/exposure?domain=example.com'

GET /api/util/gate

Pre-deploy gate — Runs the SSL and HTTP checks against a deployed URL and answers pass or fail per check, for failing a CI build.

Parameters: url (required), min_ssl, min_headers, min_days, require_https

curl -s 'https://dechonet.com/api/util/gate?url=example.com'

From an AI agent, the same checks are MCP tools: MCP →