{"uid":"cap_OKYgwTdmxyWJr4Db4rETJ","slug":"url-redirect-target-check-0dde555f","name":"URL Redirect Target Check","description":"URL Redirect Target Check: URL Redirect Target Check checks a redirect target against allowed schemes and hosts from bounded caller-supplied values without an external provider. Call URL Redirect Target Check before accepting, caching, redirecting, or retrying a caller-supplied web response. Returns normalized web evidence, the computed finding, and an explicit pass or advisory status for URL Redirect Target Check as versioned deterministic JSON. Price: $0.001 USDC via x402 on Base. First-party…","url":"https://api.delx.ai/api/v1/x402/url-redirect-target-check","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"target":{"type":"string","maxLength":8192,"description":"Target supplied to URL Redirect Target Check; used only for this bounded calculation and processed in memory without retention."},"base_url":{"type":"string","maxLength":8192,"description":"Base URL supplied to URL Redirect Target Check; used only for this bounded calculation and processed in memory without retention."},"allowed_hosts":{"type":"array","items":{"type":"string","maxLength":8192},"maxItems":256,"description":"Allowed Hosts supplied to URL Redirect Target Check; used only for this bounded calculation and processed in memory without retention."},"allowed_schemes":{"type":"array","items":{"type":"string","maxLength":8192},"maxItems":256,"description":"Allowed Schemes supplied to URL Redirect Target Check; used only for this bounded calculation and processed in memory without retention."}}},"responseSchema":{"type":"json","example":{"result":{"host":"example.com","scheme":"https","allowed":true,"resolved_url":"https://example.com/account"},"schema":"delx/util-url-redirect-target-check/v1","status":"pass","evidence":{"retained":false,"input_sha256":"6a1d59c98f30fc06ce9df9cfcba2c305b66be8e5eb56388a33bf40e364792c0c","external_calls":0},"operation":"web_reliability:url_redirect_target_check"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_zUtyvsG_VMKDKaP-ouqBu","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates a URL redirect target against caller-supplied allowed schemes and hosts, returning a deterministic pass/advisory finding as versioned JSON.","exampleAgentPrompt":"Before following this redirect to 'https://evil.example.com/landing', check whether the target is allowed — my permitted hosts are ['myapp.com','cdn.myapp.com'] and allowed schemes are ['https'], with a base URL of 'https://myapp.com'.","exampleUseCases":[{"title":"Blocking open redirect attacks in agent workflows","prompt":"We got a redirect response pointing to 'http://phishing-site.net/steal?token=abc' — check whether that target is allowed given our whitelist of hosts ['api.mycompany.com','mycompany.com'] and schemes ['https'] before we follow it."},{"title":"Validating user-supplied callback URLs","prompt":"A user just submitted 'javascript://evil.com' as their OAuth callback redirect — validate it against our allowed schemes ['https','http'] and hosts ['auth.myapp.com'] to see if we should accept it or reject it."},{"title":"Safe redirect caching before storing in CDN","prompt":"Before I cache this redirect to 'https://partner.trusted.com/offers', confirm it passes our policy — allowed hosts are ['trusted.com','partner.trusted.com'] and allowed schemes are ['https'], base URL is 'https://mysite.com'."}],"resultDescription":"Returns versioned deterministic JSON containing: normalized evidence of the evaluated URL, the computed finding (e.g. whether the target matches allowed hosts and schemes), and an explicit pass or advisory status indicating whether the redirect target should be accepted.","failureModes":["Target URL malformed or missing — validation cannot proceed","Allowed hosts or schemes list is empty or omitted — may default to restrictive policy","Target URL uses a scheme not in allowed_schemes — returns advisory/fail status","Target host does not match any entry in allowed_hosts — returns advisory/fail status","Redirect target is a relative URL that cannot be resolved without a valid base_url — error or advisory returned","Input exceeds maxLength of 8192 characters — request rejected","Payment not provided or insufficient — x402 payment required error"],"whenToPreferThis":"Choose this endpoint when you need a fast, stateless, deterministic check of a redirect target URL against a caller-controlled allowlist of hosts and schemes — especially before accepting, following, caching, or retrying a redirect in an automated agent workflow. Prefer this over building custom redirect validation logic when you want consistent, versioned, auditable results without storing data. Ideal for open-redirect vulnerability prevention in agentic pipelines, OAuth callback validation, and any scenario where redirect targets are user- or third-party-supplied.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T07:14:51.188Z","isFirstParty":false}