Scan
A static security report on any file or archive at a URL, produced in a sandbox that never runs it.
Livefrom $0.01free previewAccepted assets: USDC, EURQ, USDQ, goBTC
Routes and prices
| Route | What you get | Price |
|---|---|---|
POST / | Static security scan of a file fetched from a URL: known-malware signature match (ClamAV), file-type verification, entropy, embedded URL/IP extraction, and a zip/tar-bomb-safe archive member listing with the same checks applied per member. The target is downloaded server-side and scanned in a network-isolated sandbox that never executes it. Supports ?preview=true for a free, redacted, unpaid, rate-limited fixed example of the same response shape. free preview | $0.01 |
How paying works
- AskCall the route with no payment. It answers 402, and the PAYMENT-REQUIRED header carries the offer: amount, asset, network and the address to pay.
- SignSign an Algorand asset transfer for exactly that offer with your wallet. Nothing reaches the chain yet.
- RepeatRepeat the same call with the signed group in PAYMENT-SIGNATURE. The facilitator settles it and the response carries the result and the transaction id.
Call it
With curl you handle the 402, the signature and the retry yourself; the pxke_x402 Python client does all three inside one call.
# 1. Ask for the offer (HTTP 402, offer in the PAYMENT-REQUIRED header)
curl -si -X POST 'https://algorand-api.pxke.me/api/v1/x402/scan/url' \
-H 'Content-Type: application/json' \
-d '{"url": "https://example.com/suspicious-download.zip"}'
# 2. Sign an Algorand transfer for that offer with any x402 client, then
# 3. repeat the same request with the signed group attached
curl -s -X POST 'https://algorand-api.pxke.me/api/v1/x402/scan/url' \
-H 'Content-Type: application/json' \
-H "PAYMENT-SIGNATURE: $SIGNED" \
-d '{"url": "https://example.com/suspicious-download.zip"}'
# Free preview of the response shape, nothing fetched, nothing charged
curl -s -X POST 'https://algorand-api.pxke.me/api/v1/x402/scan/url?preview=true' \
-H 'Content-Type: application/json' \
-d '{"url": "https://example.com/suspicious-download.zip"}'
from pxke_x402 import PxkeClient
client = PxkeClient(mnemonic=MNEMONIC) # 25 words, the paying wallet
report = client.scan_url("https://example.com/suspicious-download.zip")
print(report["one_line_summary"])
print(report["risk"]["verdict"], report["risk"]["malicious"])
for member in (report.get("archive") or {}).get("members", []):
print(member)
Add ?preview=true for a free, redacted example of the response shape. Nothing is fetched, nothing is charged.
What comes back
A successful POST /api/v1/x402/scan/url answers 200 with this JSON. settlement_tx_id is the Algorand transaction that paid for it.
{
"source_url": "https://example.com/suspicious-download.zip",
"download_bytes": 18422,
"schema_version": 1,
"status": "ok",
"one_line_summary": "No concerns found -- no indicators -- file type: Zip archive data",
"target": {
"label": "input",
"size_bytes": 18422,
"type": "Zip archive data",
"entropy_bits_per_byte": 7.91,
"indicators": {
"urls": [],
"ipv4_addresses": []
}
},
"clamav": {
"engine": "clamdscan",
"exit_code": 0,
"infected_files": [],
"clean": true
},
"archive": {
"archive_kind": "zip",
"member_count": 3,
"declared_uncompressed_bytes": 40200,
"extraction_skipped_reason": null,
"clamav": {
"engine": "clamdscan",
"exit_code": 0,
"infected_files": [],
"clean": true
},
"members": []
},
"yara": {
"matched_rules": 0
},
"fuzzy_hash": {
"ssdeep_hash": "3:hMCE0O++uV4d3QOMikMR+RFgVn:hu0O0u29MRuFgV",
"comparison_corpus": null,
"note": "no known-bad comparison corpus is bundled -- informational only, never contributes to risk_score"
},
"risk": {
"score": 0,
"verdict": "no concerns found",
"malicious": false,
"caution_notes": []
},
"settlement_tx_id": "JQ3G…R5YA"
}Limits and notes
- The URL must be http or https. It is fetched server-side once, up to the size cap stated in the offer, then discarded.
- Static analysis only: ClamAV signatures, file type, entropy, embedded URLs and IP addresses, and a bomb-safe listing of zip and tar members with the same checks per member. The file is never executed.
- A URL that cannot be fetched answers 422 and keeps the payment, since the URL is yours. A sandbox failure refunds it.
- Rate-limited per wallet and IP, with a small number of concurrent scans. A full queue answers 503 before anything is charged.