{"uid":"cap_q1WBLXWfZk94MoFKRATW1","slug":"delx-open-redirect-audit-062e76de","name":"Delx Open Redirect Audit","description":"Check a redirect target against an exact hostname allowlist. Use it as a bounded preflight or analysis step inside an enterprise agent workflow before data, policy, integration, security, or commercial decisions reach production. Returns deterministic machine-readable JSON for $0.003 USDC via x402 on Base. Execution is first-party, local-only, stateless, memory-only, and has no paid upstream or input retention. Results are advisory; the caller remains responsible for authorization and productio…","url":"https://api.delx.ai/api/v1/x402/open-redirect-audit","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"target":{"type":"string","description":"Input field: target."},"allowed_hosts":{"type":"array","description":"Input field: allowed_hosts."}}},"responseSchema":{"type":"json","example":{"schema":"delx/util-open-redirect-audit/v1","allowed":false,"finding":"external_host_not_allowlisted","target_host":"evil.example","recommendation":"resolve relative paths and enforce exact host allowlist"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_fA6SMZ0GrZCAbIchKAdY1","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Validates a redirect target URL against an exact hostname allowlist and returns a deterministic pass/fail JSON result","exampleAgentPrompt":"Before we redirect the user to https://checkout.partner.com/complete, check it against our approved hostname allowlist of [checkout.partner.com, payments.acme.com] to make sure it's safe to proceed.","exampleUseCases":[{"title":"Pre-redirect safety gate in checkout flow","prompt":"We're about to redirect the user to https://pay.thirdparty.io/return after payment. Can you audit that redirect target against our allowed hosts list — pay.thirdparty.io and billing.myapp.com — and tell me if it's safe to proceed?"},{"title":"Open redirect vulnerability triage","prompt":"I have a URL that came in via a query parameter: https://evil.example.com/phish. Run an open redirect audit on it against our approved hosts list [app.mycompany.com, auth.mycompany.com] so I know whether to block it."},{"title":"Policy enforcement in OAuth callback handling","prompt":"Before we honor the redirect_uri https://app.legit.com/oauth/callback in this OAuth flow, validate it against our registered callback hosts [app.legit.com, staging.legit.com] and return a machine-readable verdict."}],"resultDescription":"A deterministic machine-readable JSON object indicating whether the redirect target's hostname appears in the provided allowlist, with a pass or fail verdict and relevant details about the match result. Stateless and advisory — no data is retained.","failureModes":["Missing or malformed target URL returns a validation error","Empty allowed_hosts array may result in automatic fail verdict","Malformed hostname entries in allowlist may cause unexpected non-matches","Non-URL strings passed as target may return parse errors","Network or service errors return non-200 HTTP status"],"whenToPreferThis":"Choose this endpoint when you need a fast, stateless, deterministic preflight check for redirect safety inside an automated agent workflow — particularly when you have a known allowlist and need a machine-readable JSON verdict before acting. Prefer it over ad-hoc regex checks or general-purpose URL parsers when you want an auditable, reproducible security gate with no data retention and no upstream dependencies.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T07:01:58.098Z","isFirstParty":false}