# Deep Links API > Validate a domain's mobile deep-link configuration — the well-known files that make iOS Universal Links and Android App Links open your native app instead of a browser tab. Pass a domain and the service fetches and validates both the Apple App Site Association (apple-app-site-association — the applinks app IDs, path components and webcredentials) and the Android Digital Asset Links (assetlinks.json — each statement's relation, package name and SHA-256 certificate fingerprints), checking the /.well-known/ path with a legacy root fallback, and reports per-platform validity with concrete issues: missing applinks, a non-JSON content type, missing certificate fingerprints, or malformed structure. Single-platform endpoints check iOS or Android on their own. The request is made server-side and private/internal targets are refused (SSRF-guarded). Built for mobile-app onboarding, universal/app-link debugging, pre-release checklists and continuous monitoring. A deep-link configuration validator — distinct from DNS lookup (dns), the security.txt parser (securitytxt) and the SSL/TLS certificate check (sslcheck). No upstream key, no cache. ## Authentication All requests require your oanor API key in the `x-oanor-key` header. Get one at https://www.oanor.com/developer/keys. ```bash curl -H "x-oanor-key: oanor_live_…" "https://api.oanor.com/deeplinks-api/..." ``` ## Pricing - **Free** (Free) — 2,220 calls/Mo, 2 req/s - **Starter** ($7/Mo) — 43,500 calls/Mo, 8 req/s - **Pro** ($21/Mo) — 226,000 calls/Mo, 20 req/s - **Mega** ($55/Mo) — 845,000 calls/Mo, 50 req/s ## Endpoints ### Deep Links #### `GET /v1/android` — Android Digital Asset Links **Parameters:** - `domain` (query, required, string) — Domain to check Example: `google.com` **Example:** ```bash curl -H "x-oanor-key: $KEY" \ "https://api.oanor.com/deeplinks-api/v1/android?domain=google.com" ``` **Response:** ```json { "data": { "url": "https://google.com/.well-known/assetlinks.json", "found": true, "valid": true, "domain": "google.com", "issues": [], "platform": "android", "statements": [ { "site": null, "relation": [ "delegate_permission/common.handle_all_urls" ], "namespace": "android_app", "package_name": "com.google.android.calendar", "fingerprint_count": 1 }, { "site": null, "relation": [ "delegate_permission/common.handle_all_urls", "delegate_permission/common.use_as_origin" ], "namespace": "android_app", "package_name": "com.google.android.googlequicksearchbox", "fingerprint_count": 2 }, { "site": null, "relation": [ "delegate_permission/common.handle_all_urls" ], "namespace": "android_app", "package_name": "com.google.android.apps.travel.onthego", "fingerprint_count": 1 }, { "site": null, "relation": [ "delegate_permission/common.handle_all_urls", "delegate_permission/common.get_login_creds" …(truncated, see openapi.json for full schema) ``` #### `GET /v1/check` — Validate iOS + Android deep links **Parameters:** - `domain` (query, required, string) — Domain to check Example: `airbnb.com` **Example:** ```bash curl -H "x-oanor-key: $KEY" \ "https://api.oanor.com/deeplinks-api/v1/check?domain=airbnb.com" ``` **Response:** ```json { "data": { "ios": { "url": "https://airbnb.com/.well-known/apple-app-site-association", "found": true, "valid": true, "domain": "airbnb.com", "issues": [], "app_ids": [ "5LL7P8E8RA.com.airbnb.app", "5LL7P8E8RA.com.airbnb.appdev", "5LL7P8E8RA.com.airbnb.appbeta", "5LL7P8E8RA.com.airbnb.appenterprise", "9BPWRS9A4J.com.airbnb.app", "9BPWRS9A4J.com.airbnb.appdev", "9BPWRS9A4J.com.airbnb.appbeta", "9BPWRS9A4J.com.airbnb.appenterprise", "9BPWRS9A4J.com.airbnb.oneoff", "KYLDQ3QJT3.com.airbnb.app", "KYLDQ3QJT3.com.airbnb.appdev", "KYLDQ3QJT3.com.airbnb.appbeta", "KYLDQ3QJT3.com.airbnb.appenterprise" ], "details": [ { "paths": [ "NOT /c/r/*", "NOT /city-hosts/experiences/*", "NOT /experience-hosting/early-access", "NOT /login_with_redirect", "NOT /login_with_redirect/*", "NOT /memories", "NOT /online_experiences/join/*", "NOT /reservation/accept", "NOT /rooms", "NOT /rooms/*/building-rules", …(truncated, see openapi.json for full schema) ``` #### `GET /v1/ios` — Apple App Site Association **Parameters:** - `domain` (query, required, string) — Domain to check Example: `apple.com` **Example:** ```bash curl -H "x-oanor-key: $KEY" \ "https://api.oanor.com/deeplinks-api/v1/ios?domain=apple.com" ``` **Response:** ```json { "data": { "url": "https://apple.com/.well-known/apple-app-site-association", "found": true, "valid": true, "domain": "apple.com", "issues": [], "app_ids": [ "W74U47NE8E.com.apple.store.Jolly" ], "details": [ { "paths": null, "app_ids": [ "W74U47NE8E.com.apple.store.Jolly" ], "components": 142 } ], "applinks": true, "platform": "ios", "app_clips": true, "content_type": null, "detail_count": 1, "webcredentials": true }, "meta": { "timestamp": "2026-06-01T23:40:47.193Z", "request_id": "f51ca2d3-ab80-4c7a-a790-4468ed0edbcb" }, "status": "ok", "message": "AASA checked", "success": true } ``` ### Meta #### `GET /v1/meta` — Well-known file paths **Example:** ```bash curl -H "x-oanor-key: $KEY" \ "https://api.oanor.com/deeplinks-api/v1/meta" ``` **Response:** ```json { "data": { "note": "Validate a domain's mobile deep-link configuration — the files that make iOS Universal Links and Android App Links open your app instead of the browser. /v1/check?domain=airbnb.com fetches and validates both the Apple App Site Association (apple-app-site-association — applinks app IDs, path components, webcredentials) and the Android Digital Asset Links (assetlinks.json — each statement's relation, package name and SHA-256 certificate fingerprints), at the /.well-known/ path with a legacy root fallback, and reports per-platform validity with concrete issues (missing applinks, non-JSON content type, missing certificate fingerprints, malformed structure). /v1/ios and /v1/android check a single platform. The request is made server-side; private/internal targets are refused (SSRF-guarded). Built for mobile-app onboarding, universal/app-link debugging, release checklists and monitoring. A deep-link configuration validator — distinct from DNS lookup (dns), the security.txt parser (securitytxt) and the SSL/TLS certificate check (sslcheck). No key, no cache.", "files": { "ios": "/.well-known/apple-app-site-association", "android": "/.well-known/assetlinks.json" }, "endpoints": [ "/v1/check", "/v1/ios", "/v1/android", "/v1/meta" ] }, "meta": { "timestamp": "2026-06-01T23:40:47.270Z", "request_id": "5f2f0ce9-b58b-4995-9 …(truncated, see openapi.json for full schema) ``` --- Marketplace page: https://www.oanor.com/api/deeplinks-api OpenAPI spec: https://www.oanor.com/api/deeplinks-api/openapi.json