AVAILABLE

Security

URL Normalize & Guard

Parse, normalize, compare, and check absolute URLs against explicit scheme, host, port, userinfo, and IP-literal rules without fetching them.

Get an API key on RapidAPIOpenAPI →

CONTRACT

Predictable for agents. Legible for reviewers.

REST
POST /v1/urls/policy-check
MCP tool
check_url_policy
Inputs
One absolute URL up to 16 KiB, or two URLs for comparison, plus explicit normalization or network-policy options depending on the operation.
Returns
Parsed components, IDNA host forms, hashes, named issues, normalized resource identity, or a CLEAR, REVIEW_REQUIRED, or BLOCKED policy decision with a next action.
Latency
Synchronous
Usage unit
URL operation

The focused suite also exposes /v1/urls/parse, /v1/urls/normalize, and /v1/urls/compare plus the separate /mcp/url server. It never resolves DNS, fetches a URL, follows a redirect, checks malware lists, or claims destination safety. A network client must revalidate DNS results, every redirect target, resolved IPs, and egress policy immediately before access.

AGENT-READABLE EXCEPTIONS

URL_WHITESPACE_OR_CONTROLURL_PERCENT_ENCODING_INVALIDURL_ENCODED_CONTROLURL_BACKSLASH_AMBIGUOUSURL_USERINFO_PRESENTURL_HOST_OBFUSCATED_IPURL_IP_LITERAL_NON_PUBLICURL_POLICY_HOST_NOT_ALLOWEDURL_RUNTIME_CHECKS_REQUIRED
HTTP request
POST /v1/urls/policy-check
Authorization: Bearer apc_...
Content-Type: application/json

{
  "url": "https://api.example.com/v1/items",
  "allowed_schemes": [
    "https"
  ],
  "allowed_hosts": [
    "api.example.com"
  ],
  "allowed_ports": [
    443
  ],
  "require_host_allowlist": true
}
cURL (bash)
curl --request POST \
  --url 'https://api-production-9502.up.railway.app/v1/urls/policy-check' \
  --header 'Authorization: Bearer ${AP_CONTROL_API_KEY}' \
  --header 'Content-Type: application/json' \
  --data '{
  "url": "https://api.example.com/v1/items",
  "allowed_schemes": [
    "https"
  ],
  "allowed_hosts": [
    "api.example.com"
  ],
  "allowed_ports": [
    443
  ],
  "require_host_allowlist": true
}'
Representative response
{
  "status": "COMPLETED",
  "decision": "CLEAR",
  "permitted": true,
  "requires_runtime_checks": true,
  "matched_allowlist_rule": "api.example.com",
  "components": {
    "scheme": "https",
    "hostname_ascii": "api.example.com",
    "hostname_unicode": "api.example.com",
    "port": null,
    "effective_port": 443,
    "path": "/v1/items",
    "query": "",
    "fragment": "",
    "origin": "https://api.example.com",
    "has_userinfo": false,
    "is_ip_literal": false,
    "ip_classification": null,
    "query_pair_count": 0
  },
  "issues": [
    {
      "code": "URL_RUNTIME_CHECKS_REQUIRED",
      "severity": "MEDIUM",
      "message": "Syntax policy cannot detect DNS changes, redirects, reputation, or the destination reached at request time.",
      "next_action": "Resolve and validate every DNS result, disable or revalidate redirects, and enforce egress policy immediately before fetching."
    }
  ],
  "input_sha256": "4e7c...",
  "next_action": "Perform DNS, resolved-IP, redirect, and egress checks immediately before the request."
}
No network accessThe API does not resolve DNS, fetch URLs, follow redirects, or query reputation providers.
Parser ambiguity blockedUserinfo, backslashes, non-public IP literals, localhost, and obfuscated numeric hosts receive explicit issues.
Runtime checks requiredEvery permitted result still requires DNS, resolved-IP, redirect, and egress enforcement in the caller's network client.

Use URL Normalize & Guard through RapidAPI.

Choose a capped marketplace plan, copy the generated request, and route the structured result through your own authorized workflow.

Get an API key on RapidAPICompare marketplace controls →