Parse & validate a domain's security.txt

Code-Snippets

curl "https://api.oanor.com/securitytxt-api/v1/check" \
  -H "x-oanor-key: oanor_test_..."

await fetch("https://api.oanor.com/securitytxt-api/v1/check", {
  headers: { "x-oanor-key": "oanor_test_..." }
});

$ch = curl_init("https://api.oanor.com/securitytxt-api/v1/check");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-oanor-key: oanor_test_..."]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$out = curl_exec($ch);

import requests
requests.get(
    "https://api.oanor.com/securitytxt-api/v1/check",
    headers={"x-oanor-key": "oanor_test_..."}
)

Beispiel-Response

Echte Antwort dieses Endpoints, erfasst beim letzten Health-Check.

{
    "data": {
        "found": true,
        "valid": true,
        "domain": "google.com",
        "fields": {
            "csaf": [],
            "hiring": [
                "https://g.co/SecurityPrivacyEngJobs"
            ],
            "policy": [
                "https://g.co/vrp"
            ],
            "contact": [
                "https://g.co/vulnz",
                "mailto:[email protected]"
            ],
            "expires": "2030-04-01T00:00:00z",
            "canonical": [],
            "encryption": [
                "https://services.google.com/corporate/publickey.txt"
            ],
            "acknowledgments": [
                "https://bughunters.google.com/"
            ],
            "preferred_languages": null
        },
        "issues": [
            "no Canonical field (recommended)",
            "not PGP-signed (recommended, not required)"
        ],
        "signed": false,
        "expired": false,
        "location": "https://google.com/.well-known/security.txt",
        "expires_in_days": 1399
    },
    "meta": {
        "timestamp": "2026-06-01T23:40:50.817Z",
        "request_id": "9dbf6860-2787-48ed-bdee-5bf14a5ca2b0"
    },
    "status": "ok",
    "message": "security.txt checked",
    "success": true
}