Back to Lookproof
Card snapshot
api.lookproof.dev
·
2026-11-10 22:02:47 UTC
·
ec199f94f16886a05fc228bd2eb0d5e49ce7785f1b633c25eb20004a6fbe2e3e
This is a frozen copy of the agent's agent-card.json as we observed it at the timestamp above. We capture a new snapshot every time the card's content hash changes. Useful for: forensic drift analysis, verifying downstream callers see the right version, reproducing routing decisions made historically.
{
"capabilities": {
"pushNotifications": false,
"streaming": false
},
"defaultInputModes": [
"application/json"
],
"defaultOutputModes": [
"application/json"
],
"description": "Email, DNS and website security checks for developers and AI agents: SPF, DMARC, DKIM, MX, MTA-STS, BIMI, DNSSEC, CAA, TLS certificates, security headers, RDAP and full domain and site health reports. Lookproof is a REST API described by OpenAPI, not an A2A message endpoint: call the skills' HTTPS endpoints directly. Pay per request with x402 (a request without payment gets 402 with the exact price, USDC on Base) or send an API key; an MCP server (uvx lookproof-mcp) is described in mcp.json.",
"documentationUrl": "https://lookproof.dev/agents",
"name": "Lookproof",
"provider": {
"organization": "Lookproof",
"url": "https://lookproof.dev"
},
"securitySchemes": {
"lookproofKey": {
"httpAuthSecurityScheme": {
"bearerFormat": "lp_live_...",
"description": "Authorization: Bearer lp_live_... uses the plan's monthly credits instead of paying. A free key can be requested at https://lookproof.dev/pricing#api-access; credits and plans: https://lookproof.dev/api-keys. Without a key, pay per request with x402 instead.",
"scheme": "Bearer"
}
}
},
"skills": [
{
"description": "Evaluate a domain's CAA records (RFC 8659), climbing to parent names up to the registrable domain when the name has none: allowed issuers for normal and wildcard certificates, iodef, unknown critical tags and invalid values. Use when an agent must tell which certificate authorities may issue for a domain, or why a certificate request is refused because of CAA.",
"examples": [
"GET https://api.lookproof.dev/v1/dns/caa?domain=example.com"
],
"id": "dns.caa",
"name": "CAA record check",
"tags": [
"dns",
"caa",
"tls",
"certificates",
"security"
]
},
{
"description": "Ask Cloudflare and Google the same DNS question, each alone and uncached, and compare response codes and records; different codes (such as SERVFAIL from one) are a warning, different records information. Use when an agent debugs propagation, DNSSEC or resolver-specific answers. Input: ?name=example.com&type=A.",
"examples": [
"GET https://api.lookproof.dev/v1/dns/compare?name=example.com&type=A"
],
"id": "dns.compare",
"name": "DNS resolver comparison",
"tags": [
"dns",
"resolvers",
"propagation",
"dnssec",
"compare"
]
},
{
"description": "Report a domain's DNSSEC status (secure, insecure, bogus or unknown) as validated by public resolvers, with DS and DNSKEY algorithms, deprecated algorithms, SHA-1 digests and DS records without a matching key. Use when an agent must tell whether a domain is signed, why it fails on validating resolvers, or whether a key rollover left the chain of trust broken.",
"examples": [
"GET https://api.lookproof.dev/v1/dns/dnssec?domain=example.com"
],
"id": "dns.dnssec",
"name": "DNSSEC check",
"tags": [
"dns",
"dnssec",
"security",
"ds",
"dnskey"
]
},
{
"description": "Read a name's HTTPS records (RFC 9460, SVCB): priority, target, AliasMode or ServiceMode, alpn (h3, h2), port, IPv4 and IPv6 hints and whether ECH is published, with AliasMode conflicts and missing mandatory keys. Use when an agent checks HTTP/3 or ECH setup. Input: ?domain=example.com.",
"examples": [
"GET https://api.lookproof.dev/v1/dns/https-rr?domain=example.com"
],
"id": "dns.https_rr",
"name": "HTTPS record check",
"tags": [
"dns",
"https",
"svcb",
"http3",
"ech"
]
},
{
"description": "Convert a domain name between Unicode and punycode (A-labels) and check it against IDNA2008 and UTS 46: disallowed characters, bidi, context and hyphen rules, lengths, and mixed scripts in one label (homograph risk), per label. Offline. Use when an agent must register, compare or display an internationalised domain. Input: ?name=b\u00fccher.example.com.",
"examples": [
"GET https://api.lookproof.dev/v1/dns/idn?name=b%C3%BCcher.example.com"
],
"id": "dns.idn",
"name": "IDN converter",
"tags": [
"dns",
"idn",
"punycode",
"unicode",
"homograph"
]
},
{
"description": "Resolve chosen DNS record types (A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV) for a name through public resolvers, with TTL, observation time and the resolver that answered. Use when an agent needs the current public DNS answer for a name, for example to confirm that a record change is visible or to read a TXT verification record.",
"examples": [
"GET https://api.lookproof.dev/v1/dns/lookup?name=example.com&types=A&types=MX"
],
"id": "dns.lookup",
"name": "DNS lookup",
"tags": [
"dns",
"lookup",
"records",
"ttl"
]
},
{
"description": "Check a zone's name servers: the NS set, the IPv4 and IPv6 addresses of up to eight servers, a single server, servers that do not resolve, all addresses in one /24 or /48, one TLD for every name and in-zone servers that need glue. Use when an agent reviews DNS redundancy or a delegation. Input: ?domain=example.com.",
"examples": [
"GET https://api.lookproof.dev/v1/dns/ns?domain=example.com"
],
"id": "dns.ns",
"name": "Name server check",
"tags": [
"dns",
"nameservers",
"ns",
"redundancy",
"delegation"
]
},
{
"description": "Find which DNS provider a domain's NS records point to (Cloudflare, Route 53, Azure DNS, Google Cloud DNS, GoDaddy, Namecheap, NS1, Hetzner, OVHcloud and more) from a fixed, versioned list of name server patterns, with unknown name servers and several providers listed. Use when an agent must know where a zone is hosted before a DNS change. Input: ?domain=example.com.",
"examples": [
"GET https://api.lookproof.dev/v1/dns/ns-provider?domain=example.com"
],
"id": "dns.ns_provider",
"name": "DNS provider lookup",
"tags": [
"dns",
"nameservers",
"hosting",
"provider",
"ns"
]
},
{
"description": "Check a zone's SOA record through public resolvers: primary server, contact name, serial (YYYYMMDDnn or counter), refresh, retry, expire and negative caching TTL against RFC 1912 and RFC 2308. Use when an agent must explain zone transfer timers or why a deleted name keeps answering NXDOMAIN. Input: ?domain=example.com.",
"examples": [
"GET https://api.lookproof.dev/v1/dns/soa?domain=example.com"
],
"id": "dns.soa",
"name": "SOA record check",
"tags": [
"dns",
"soa",
"zone",
"secondary",
"ttl"
]
},
{
"description": "Show the TTL of A, AAAA, MX, NS, TXT, CAA and SOA records with its source: exact from a validated DNSSEC signature (RRSIG Original TTL) or the resolver's remaining cache time (normally a lower bound), plus the SOA negative caching TTL. Use when an agent plans a DNS change and must know how long old records live. Input: ?domain=example.com.",
"examples": [
"GET https://api.lookproof.dev/v1/dns/ttl?domain=example.com"
],
"id": "dns.ttl",
"name": "DNS TTL check",
"tags": [
"dns",
"ttl",
"cache",
"dnssec",
"records"
]
},
{
"description": "List the domain verification tokens in a domain's apex TXT records (google-site-verification, MS=, Atlassian, Facebook, Apple, Adobe, DocuSign, Stripe and more) from a fixed, versioned list, with the full public token and services that have several. Use when an agent audits or cleans up old verification records. Input: ?domain=example.com.",
"examples": [
"GET https://api.lookproof.dev/v1/dns/txt-verification?domain=example.com"
],
"id": "dns.txt_verification",
"name": "Domain verification records",
"tags": [
"dns",
"txt",
"verification",
"audit",
"records"
]
},
{
"description": "Find out whether a DNS zone has a wildcard (RFC 4592): A, AAAA, TXT and MX of a random, uncached name under the domain through public resolvers, with a warning for a wildcard MX that accepts mail for every invented subdomain. Use when an agent must tell whether a subdomain really exists. Input: ?domain=example.com.",
"examples": [
"GET https://api.lookproof.dev/v1/dns/wildcard?domain=example.com"
],
"id": "dns.wildcard",
"name": "Wildcard DNS check",
"tags": [
"dns",
"wildcard",
"subdomains",
"mx",
"records"
]
},
{
"description": "Check a pasted DNS zone file (RFC 1035 master format, up to 64 KiB) with $ORIGIN and $TTL: unreadable lines, SOA and NS at the apex, CNAME at the apex or beside other data, duplicates, mixed TTLs in a set, out-of-zone names, NS/MX targets without addresses and SOA timers. Offline. Use when an agent edits a zone before loading it. Input: {\"zone\": \"$TTL 3600\\n@ IN SOA ...\", \"origin\": \"example.com\"}.",
"examples": [
"POST https://api.lookproof.dev/v1/dns/zone-lint with a JSON body as in the OpenAPI document"
],
"id": "dns.zone_lint",
"name": "Zone file checker",
"tags": [
"dns",
"zone",
"lint",
"bind",
"records"
]
},
{
"description": "One report on a domain's mail and DNS security: MX, SPF, DMARC, common DKIM selectors, MTA-STS with TLS-RPT, DNSSEC, reverse DNS of the mail servers, BIMI and CAA in one call, each as its own section with coded findings and evidence. Use when an agent must audit a domain's email security or build a domain health report; cheaper than calling the nine checks one by one. No score is computed.",
"examples": [
"GET https://api.lookproof.dev/v1/domain/health?domain=example.com"
],
"id": "domain.health",
"name": "Domain health check",
"tags": [
"domain",
"email",
"dns",
"security",
"audit"
]
},
{
"description": "Look up a domain's registration at its registry over RDAP (RFC 9083, servers from the IANA bootstrap file): registrar and IANA id, creation, change and expiry dates, EPP statuses such as hold or pending delete, nameservers and DNSSEC delegation. Contact data is never returned. Use when an agent must tell when a domain expires, whether it is locked against transfer or why it suddenly stopped resolving.",
"examples": [
"GET https://api.lookproof.dev/v1/domain/rdap?domain=example.com"
],
"id": "domain.rdap",
"name": "RDAP domain lookup",
"tags": [
"domain",
"rdap",
"whois",
"expiry",
"registrar"
]
},
{
"description": "Parse a pasted Set-Cookie header as RFC 6265bis does: Secure, HttpOnly, SameSite, Partitioned, __Host- and __Secure- prefix rules, Domain, Path, Expires and Max-Age with the 400-day cap. The cookie value is never returned, only its length. Offline. Use when an agent reviews session cookie settings. Input: {\"header\": \"__Host-sid=x; Path=/; Secure; HttpOnly; SameSite=Lax\"}.",
"examples": [
"POST https://api.lookproof.dev/v1/http/cookie-parse with a JSON body as in the OpenAPI document"
],
"id": "http.cookie_parse",
"name": "Set-Cookie parser",
"tags": [
"http",
"cookies",
"security",
"headers",
"session"
]
},
{
"description": "Parse a pasted Content-Security-Policy value as CSP Level 3 does: directives and sources per policy, 'unsafe-inline' and 'unsafe-eval', wildcard and scheme-only script or plugin sources, missing default-src, object-src and base-uri, and report-only mode. Offline. Use when an agent writes or reviews a CSP before it is deployed. Input: {\"header\": \"default-src 'self'; script-src 'self'\"}.",
"examples": [
"POST https://api.lookproof.dev/v1/http/csp-parse with a JSON body as in the OpenAPI document"
],
"id": "http.csp_parse",
"name": "CSP header parser",
"tags": [
"http",
"csp",
"security",
"headers",
"xss"
]
},
{
"description": "Parse a pasted Strict-Transport-Security value as RFC 6797 does: whether browsers accept it, max-age, includeSubDomains, preload, and which hstspreload.org header rules it meets. Offline. Use when an agent sets up HSTS or prepares a preload submission. Input: {\"header\": \"max-age=31536000; includeSubDomains; preload\"}.",
"examples": [
"POST https://api.lookproof.dev/v1/http/hsts-parse with a JSON body as in the OpenAPI document"
],
"id": "http.hsts_parse",
"name": "HSTS header parser",
"tags": [
"http",
"hsts",
"https",
"security",
"headers"
]
},
{
"description": "Follow a site's redirect chains from http:// and https:// and read the security headers of the final HTTPS response: HSTS with preload readiness, Content-Security-Policy with unsafe-inline detection, X-Content-Type-Options, frame protection, Referrer-Policy and cookie flags (never values). Use when an agent must tell whether a site forces HTTPS, why HSTS preload fails or which headers are missing.",
"examples": [
"GET https://api.lookproof.dev/v1/http/security-headers?domain=example.com"
],
"id": "http.security_headers",
"name": "Security headers check",
"tags": [
"http",
"https",
"hsts",
"csp",
"security"
]
},
{
"description": "Compute a CIDR block: network, first and last address, number of addresses, netmask and host mask, and whether the input had host bits set (192.0.2.5/24). IPv4 and IPv6, offline. Use when an agent must check or explain a CIDR block in a firewall, SPF or cloud configuration. Input: ?cidr=192.0.2.5/24.",
"examples": [
"GET https://api.lookproof.dev/v1/ip/cidr?cidr=192.0.2.5%2F24"
],
"id": "ip.cidr",
"name": "CIDR calculator",
"tags": [
"ip",
"cidr",
"subnet",
"network",
"calculator"
]
},
{
"description": "Check one IPv4 or IPv6 address against up to 100 CIDR blocks and get, for each, whether it contains the address, plus the blocks that do; blocks of the other IP version never match. Offline. Use when an agent must tell whether an address is in an allow list, a provider's ranges or an SPF ip4/ip6 term. Input: {\"ip\": \"192.0.2.10\", \"cidrs\": [\"192.0.2.0/24\"]}.",
"examples": [
"POST https://api.lookproof.dev/v1/ip/contains with a JSON body as in the OpenAPI document"
],
"id": "ip.contains",
"name": "IP in CIDR check",
"tags": [
"ip",
"cidr",
"allowlist",
"firewall",
"network"
]
},
{
"description": "Classify an IPv4 or IPv6 address by IANA's special-purpose registries (private, loopback, link-local, shared, documentation, 6to4, Teredo, NAT64 and more, with the RFC), with compressed and expanded forms, the reverse DNS name and the IPv4 form of an IPv4-mapped address. Offline. Use when an agent must tell whether an address is public. Input: ?ip=192.0.2.1.",
"examples": [
"GET https://api.lookproof.dev/v1/ip/info?ip=192.0.2.1"
],
"id": "ip.info",
"name": "IP address info",
"tags": [
"ip",
"ipv6",
"network",
"classification",
"offline"
]
},
{
"description": "Turn a start and end IPv4 or IPv6 address into the smallest list of CIDR blocks that covers exactly that range (at most 62 for IPv4, 254 for IPv6). Offline. Use when an agent must write a range from a provider or registry as firewall, ACL or SPF entries. Input: ?start=192.0.2.10&end=192.0.2.20.",
"examples": [
"GET https://api.lookproof.dev/v1/ip/range-to-cidr?end=192.0.2.20&start=192.0.2.10"
],
"id": "ip.range_to_cidr",
"name": "IP range to CIDR",
"tags": [
"ip",
"cidr",
"range",
"firewall",
"network"
]
},
{
"description": "Split an IPv4 or IPv6 CIDR block into subnets of a longer prefix, in order, at most 256 at a time; a larger split is refused before anything is computed. Offline. Use when an agent must plan an address layout or hand out subnets. Input: ?cidr=192.0.2.0/24&prefix=26.",
"examples": [
"GET https://api.lookproof.dev/v1/ip/subnets?cidr=192.0.2.0%2F24&prefix=26"
],
"id": "ip.subnets",
"name": "Subnet calculator",
"tags": [
"ip",
"subnet",
"cidr",
"planning",
"network"
]
},
{
"description": "Check a domain's BIMI record (<selector>._bimi, default selector, with fallback to the organisational domain): v=BIMI1 syntax, HTTPS logo and certificate URLs, an SVG logo path and whether DMARC is enforced at quarantine or reject with pct=100. Use when an agent must tell why a brand logo does not show in mail clients. The logo and certificate are not downloaded.",
"examples": [
"GET https://api.lookproof.dev/v1/mail/bimi?domain=example.com"
],
"id": "mail.bimi",
"name": "BIMI record check",
"tags": [
"email",
"dns",
"deliverability",
"bimi",
"branding"
]
},
{
"description": "Parse a pasted BIMI record: v=BIMI1, the l= logo and a= certificate tags, repeated or missing tags, HTTPS URLs, the .svg logo path and a missing mark certificate. Offline: the logo and DMARC are not fetched. Use when an agent writes or reviews a BIMI record. Input: {\"record\": \"v=BIMI1; l=https://example.com/logo.svg\"}.",
"examples": [
"POST https://api.lookproof.dev/v1/mail/bimi-parse with a JSON body as in the OpenAPI document"
],
"id": "mail.bimi_parse",
"name": "BIMI record parser",
"tags": [
"email",
"dns",
"bimi",
"brand",
"logo"
]
},
{
"description": "One report on a domain's mail setup: MX, SPF and DMARC, plus DKIM for the selectors you give, with coded findings, an overall status and a spoofing protection category (protected, partial, monitoring, unprotected or broken) with its reasons. Use when an agent needs a complete overview of a domain's email authentication in one call instead of four, or must judge how well the domain is protected against spoofing.",
"examples": [
"GET https://api.lookproof.dev/v1/mail/check?dkim_selectors=selector1&domain=example.com"
],
"id": "mail.check",
"name": "Mail configuration check",
"tags": [
"email",
"dns",
"deliverability",
"spf",
"dmarc"
]
},
{
"description": "Run the mail configuration check (MX, SPF, DMARC) on up to 20 domains in one request, each with its spoofing protection category. Results keep the input order, and items that fail for a technical reason come with a token for a free retry. Use when an agent must audit many domains at once, for example a customer list or a portfolio of brands.",
"examples": [
"POST https://api.lookproof.dev/v1/mail/check/bulk with a JSON body as in the OpenAPI document"
],
"id": "mail.check.bulk",
"name": "Bulk mail configuration check",
"tags": [
"email",
"dns",
"deliverability",
"bulk",
"audit"
]
},
{
"description": "Fetch and validate the DKIM public key record at selector._domainkey for a domain: key type, key size, revocation and syntax, with coded findings. Use when an agent knows the selector (s= in a DKIM-Signature header) and must confirm that the key is published and usable. It does not verify message signatures.",
"examples": [
"GET https://api.lookproof.dev/v1/mail/dkim?domain=example.com&selector=selector1"
],
"id": "mail.dkim",
"name": "DKIM record check",
"tags": [
"email",
"dns",
"deliverability",
"dkim"
]
},
{
"description": "Try 31 common DKIM selectors (Google, Microsoft 365, Mailchimp, SendGrid, Mailgun, Zoho, Proton, Fastmail, mailbox.org, Mailjet, Amazon SES and generic names) for a domain and validate every key found: type, size, revocation and testing flag. Use when an agent needs a domain's DKIM keys but does not know the selector. Finding none is a hint, not proof that DKIM is missing.",
"examples": [
"GET https://api.lookproof.dev/v1/mail/dkim-discover?domain=example.com"
],
"id": "mail.dkim_discover",
"name": "DKIM selector finder",
"tags": [
"email",
"dns",
"deliverability",
"dkim",
"selectors"
]
},
{
"description": "Look up the DMARC record of a domain or its organisational domain and explain policy, subdomain policy, alignment and reporting addresses, with coded findings. Use when an agent must read which policy a domain asks receivers to apply to mail that fails DMARC, how strict it is, or why DMARC reports do not arrive.",
"examples": [
"GET https://api.lookproof.dev/v1/mail/dmarc?domain=example.com"
],
"id": "mail.dmarc",
"name": "DMARC check",
"tags": [
"email",
"dns",
"deliverability",
"dmarc"
]
},
{
"description": "Parse a pasted DMARC record without DNS (RFC 9989): p, sp, np, psd, t, adkim, aspf, rua and ruf, historic and unknown tags, with the same coded findings as the DMARC check, such as p=none or a missing report address. Use when an agent must check a DMARC record before publishing it. Input: {\"record\": \"v=DMARC1; p=none; rua=mailto:dmarc@example.com\"}.",
"examples": [
"POST https://api.lookproof.dev/v1/mail/dmarc-parse with a JSON body as in the OpenAPI document"
],
"id": "mail.dmarc_parse",
"name": "DMARC record parser",
"tags": [
"email",
"dns",
"deliverability",
"dmarc",
"parser"
]
},
{
"description": "Check a domain's MTA-STS setup (RFC 8461): the _mta-sts record, the HTTPS policy file with certificate check and no redirects, mode, max_age and whether every MX host is covered, plus the TLS-RPT record (RFC 8460). Use when an agent must tell whether inbound mail is protected against TLS downgrade, or why senders report MTA-STS failures for a domain.",
"examples": [
"GET https://api.lookproof.dev/v1/mail/mta-sts?domain=example.com"
],
"id": "mail.mta_sts",
"name": "MTA-STS and TLS-RPT check",
"tags": [
"email",
"dns",
"deliverability",
"mta-sts",
"tls"
]
},
{
"description": "Parse a pasted MTA-STS policy file (RFC 8461) as a sending server would: version, mode, mx patterns and max_age, lines that do not parse, testing or none mode and a short max_age. Offline. Use when an agent writes an MTA-STS policy before publishing it. Input: {\"policy\": \"version: STSv1\\nmode: enforce\\n...\"}.",
"examples": [
"POST https://api.lookproof.dev/v1/mail/mta-sts-parse with a JSON body as in the OpenAPI document"
],
"id": "mail.mta_sts_parse",
"name": "MTA-STS policy parser",
"tags": [
"email",
"dns",
"mta-sts",
"tls",
"policy"
]
},
{
"description": "List a domain's mail servers in preference order and detect null MX (RFC 7505) and MX targets that do not resolve, with coded findings. Use when an agent must find where mail for a domain is delivered or why a domain cannot receive mail.",
"examples": [
"GET https://api.lookproof.dev/v1/mail/mx?domain=example.com"
],
"id": "mail.mx",
"name": "MX lookup",
"tags": [
"email",
"dns",
"deliverability",
"mx"
]
},
{
"description": "Name the mail providers a domain uses from its MX hosts and SPF include tree: the mailbox provider behind the primary MX, inbound gateways and sending services, matched against a fixed, versioned list with the matching names as evidence. Use when an agent must tell who hosts a domain's mail, which services may send for it, or whether SPF still authorises a provider the domain has left.",
"examples": [
"GET https://api.lookproof.dev/v1/mail/provider?domain=example.com"
],
"id": "mail.provider",
"name": "Mail provider detection",
"tags": [
"email",
"dns",
"mx",
"spf",
"providers"
]
},
{
"description": "Check reverse DNS for a domain's mail servers: up to five MX hosts, their IPv4 and IPv6 addresses, each PTR name and whether it resolves back to the same address (FCrDNS), with coded findings. Use when an agent must tell whether a domain's mail servers have matching reverse DNS, a common reason for rejected or spam-filed mail.",
"examples": [
"GET https://api.lookproof.dev/v1/mail/ptr?domain=example.com"
],
"id": "mail.ptr",
"name": "Reverse DNS check for mail servers",
"tags": [
"email",
"dns",
"deliverability",
"ptr",
"reverse-dns"
]
},
{
"description": "Parse and evaluate a domain's SPF record: the include and redirect tree, qualifiers and the RFC 7208 limit of ten DNS lookups, with coded findings. Use when an agent must tell whether SPF is valid, why mail from a service fails SPF, or whether one more include would exceed the lookup limit.",
"examples": [
"GET https://api.lookproof.dev/v1/mail/spf?domain=example.com"
],
"id": "mail.spf",
"name": "SPF check",
"tags": [
"email",
"dns",
"deliverability",
"spf"
]
},
{
"description": "Unfold a domain's SPF policy (RFC 7208) into merged IPv4 and IPv6 blocks: include and redirect followed as a receiver counts them (10 lookups, 2 void lookups, PermError stops), a and mx resolved with /cidr, sources per block, exists, ptr and macros listed apart, and very broad blocks flagged. Use when an agent must know which servers may send. Input: ?domain=example.com.",
"examples": [
"GET https://api.lookproof.dev/v1/mail/spf-flatten?domain=example.com"
],
"id": "mail.spf_flatten",
"name": "SPF flattening check",
"tags": [
"email",
"dns",
"deliverability",
"spf",
"flatten"
]
},
{
"description": "Parse a pasted SPF record without DNS (RFC 7208): mechanisms with qualifiers and values, modifiers, syntax errors, the all policy and the number of terms that need DNS lookups, with coded findings such as +all, ptr and over ten lookups. Use when an agent must check an SPF record before publishing it. Input: {\"record\": \"v=spf1 mx include:_spf.example.com ~all\"}.",
"examples": [
"POST https://api.lookproof.dev/v1/mail/spf-parse with a JSON body as in the OpenAPI document"
],
"id": "mail.spf_parse",
"name": "SPF record parser",
"tags": [
"email",
"dns",
"deliverability",
"spf",
"parser"
]
},
{
"description": "Read how strong a domain's DMARC policy (RFC 9989) is: protected (reject), partial (quarantine), monitoring (none), unprotected or broken, plus whether it has gaps (none, partial or full), the effective policy after test mode (t=y), the subdomain policy, pct and the SPF all qualifier. Use when an agent must explain whether a domain asks receivers to stop forged mail. Input: ?domain=example.com.",
"examples": [
"GET https://api.lookproof.dev/v1/mail/spoofable?domain=example.com"
],
"id": "mail.spoofable",
"name": "Email spoofing check",
"tags": [
"email",
"dns",
"deliverability",
"dmarc",
"spoofing"
]
},
{
"description": "Check a domain's TLS-RPT record (RFC 8460) at _smtp._tls: one v=TLSRPTv1 record with exactly one rua tag of mailto: or https: report addresses. Use when an agent sets up or audits SMTP TLS reporting, alone or before MTA-STS. Input: ?domain=example.com.",
"examples": [
"GET https://api.lookproof.dev/v1/mail/tlsrpt?domain=example.com"
],
"id": "mail.tlsrpt",
"name": "TLS-RPT check",
"tags": [
"email",
"dns",
"tls-rpt",
"tls",
"reporting"
]
},
{
"description": "Parse a pasted TLS-RPT record (RFC 8460): v=TLSRPTv1, exactly one rua tag and whether each report address is a mailto: or https: URI. Offline. Use when an agent sets up SMTP TLS reporting. Input: {\"record\": \"v=TLSRPTv1; rua=mailto:tlsrpt@example.com\"}.",
"examples": [
"POST https://api.lookproof.dev/v1/mail/tlsrpt-parse with a JSON body as in the OpenAPI document"
],
"id": "mail.tlsrpt_parse",
"name": "TLS-RPT record parser",
"tags": [
"email",
"dns",
"tls-rpt",
"tls",
"reporting"
]
},
{
"description": "One report on a website's security basics: the TLS certificate on port 443 (trust, name, expiry, key), the redirect chains from http:// and https:// with HSTS, CSP, frame protection, Referrer-Policy and cookie flags, and the domain's expiry and EPP statuses from RDAP, each as a section with coded findings. Use when an agent must audit a website or build a site health report; cheaper than the three checks one by one. No score is computed.",
"examples": [
"GET https://api.lookproof.dev/v1/site/health?domain=example.com"
],
"id": "site.health",
"name": "Site health check",
"tags": [
"website",
"tls",
"https",
"security",
"audit"
]
},
{
"description": "Check the TLS certificate a domain serves on port 443: whether it chains to a trusted root, matches the name (RFC 9525) and when it expires, with issuer, chain, key and signature algorithm, TLS version and coded findings for expired, expiring, untrusted, mismatched or weak certificates. Use when an agent must tell why HTTPS fails for a domain or when its certificate has to be renewed.",
"examples": [
"GET https://api.lookproof.dev/v1/tls/certificate?domain=example.com"
],
"id": "tls.certificate",
"name": "TLS certificate check",
"tags": [
"tls",
"ssl",
"certificates",
"https",
"security"
]
},
{
"description": "Decode one pasted PEM certificate signing request (PKCS#10): subject, DNS and IP names, key type and size, signature algorithm and whether the signature matches the key. Email addresses are never returned. Offline. Use when an agent must check a CSR before sending it to a certificate authority. Input: {\"pem\": \"-----BEGIN CERTIFICATE REQUEST...\"}.",
"examples": [
"POST https://api.lookproof.dev/v1/tls/csr-decode with a JSON body as in the OpenAPI document"
],
"id": "tls.csr_decode",
"name": "CSR decoder",
"tags": [
"tls",
"csr",
"certificates",
"pkcs10",
"decoder"
]
},
{
"description": "Decode one pasted PEM X.509 certificate: subject, issuer, validity and days left, DNS and IP names, key type and size, signature algorithm, CA flag, key usages, self-signed, and SHA-256 and SHA-1 fingerprints. Email addresses are never returned. Offline: no chain or revocation check. Use when an agent must inspect a certificate file before installing it. Input: {\"pem\": \"-----BEGIN CERTIFICATE...\"}.",
"examples": [
"POST https://api.lookproof.dev/v1/tls/pem-decode with a JSON body as in the OpenAPI document"
],
"id": "tls.pem_decode",
"name": "PEM certificate decoder",
"tags": [
"tls",
"certificates",
"x509",
"pem",
"decoder"
]
}
],
"supportedInterfaces": [
{
"protocolBinding": "https://lookproof.dev/openapi.json",
"protocolVersion": "1.0",
"url": "https://api.lookproof.dev"
}
],
"version": "1.0"
}