API marketplace

Fetch and parse an XML sitemap (the sitemaps.org protocol). Pass a sitemap URL and the parse endpoint fetches it — following redirects and transparently gunzipping .gz sitemaps — and returns its type: a urlset with every URL and its lastmod, changefreq and priority, or a sitemapindex listing the child sitemaps, with offset/limit paging for large files. The urls endpoint goes further: when the sitemap is an index it fetches the child sitemaps too and flattens every page URL into a single list, with a configurable cap on URLs and child sitemaps and a truncated flag so you stay in control. The request is made server-side and private or internal targets are refused (SSRF-guarded). Built for SEO audits, building crawl queues and content inventories, change monitoring and migration checks. A sitemap fetcher and parser — distinct from generic XML-to-JSON conversion (xml), the robots.txt evaluator (robots) and the on-page SEO audit (seo). No upstream key, no cache.

Uptime

100.0%

Latency

1624ms

Subs

3,297

Fetch and evaluate any website's robots.txt. Pass a URL and a user-agent and the check endpoint tells you whether that URL is crawlable — selecting the most-specific user-agent group and applying the RFC 9309 longest-match Allow/Disallow rules (with * and $ wildcards, where Allow wins ties), and returning the matched rule, the group's crawl-delay and the sitemaps the site declares. The parse endpoint returns the whole file structured into per-user-agent groups (their allow and disallow lists and crawl-delay) plus the list of sitemaps. A missing robots.txt (404/403) means everything is allowed, exactly as the spec requires. The request is made server-side and private or internal targets are refused (SSRF-guarded). Built for SEO audits, crawler and scraper compliance, sitemap discovery and pre-flight "am I allowed to fetch this?" checks. A robots.txt evaluator — distinct from the on-page SEO audit (seo), the XML toolkit (xml) and link unfurling/preview (url). No upstream key, no cache.

Uptime

100.0%

Latency

115ms

Subs

4,091

Count and split text the way people actually read it, using Unicode-correct segmentation. The count endpoint returns the number of grapheme clusters — the real, user-perceived characters, so a family emoji counts as 1 (not 7) and an accented letter as 1 — alongside words, sentences, code points, UTF-16 code units (the naive string length that over-counts) and UTF-8 byte length. This is exactly what character-limit fields, tweet/SMS counters and validation need so the count agrees with what the user sees. The segment endpoint splits text into grapheme, word or sentence segments (word segments are flagged word-like versus punctuation and spaces) and is locale-aware, so Japanese, Chinese and Thai word boundaries come out right. Everything is computed locally with no network calls. A Unicode text segmenter — distinct from the Unicode codepoint database (unicode), the case/text-utilities toolkit (text) and string similarity (similarity). No upstream key, no cache.

Uptime

100.0%

Latency

84ms

Subs

3,876

Get the localized display name of a code in any language — countries and regions, languages, currencies, scripts and calendars. Pass a code, a type and a locale and the name endpoint returns the right name: US as region in fr gives "États-Unis", de as language in fr gives "allemand", EUR as currency gives "Euro", and the same code reads correctly in German, Japanese, Arabic or any other locale. The list endpoint returns every code of a type localized and sorted in that locale's collation — ideal for building a country, language or currency dropdown in any language. Powered by the platform's full ICU data (Intl.DisplayNames) and computed locally with no network calls. Built for internationalised forms and pickers, multilingual UIs, localized reports and onboarding. A localized-names resolver — distinct from country reference data in English (countries), number and currency formatting (numberformat) and locale date formatting (datelocale). No upstream key, no cache.

Uptime

100.0%

Latency

108ms

Subs

4,616

Humanise timestamps and format dates for any locale and timezone using full ICU. The relative endpoint turns an instant into a localised relative phrase against now (or a given reference time) — "3 hours ago", "vor 3 Stunden", "in 2 days", "il y a 5 minutes" — automatically choosing the best unit from seconds to years. The format endpoint renders a localised date/time string (e.g. "mardi 2 juin 2026 à 15:30" or "2026年6月2日 22:30:00"), honouring the locale (BCP 47), a named IANA timezone, the chosen date and time styles (full/long/medium/short) and 12/24-hour preference, and returns a parts breakdown for custom displays. Pass dates as ISO 8601 or unix timestamps. Everything is computed locally with no network calls. Ideal for internationalised UIs, activity feeds, notifications, comments and dashboards. A relative-time and locale date formatter — distinct from current-time-in-a-timezone (time), the UTC parse/token toolkit (datetime) and number/currency formatting (numberformat). No upstream key, no cache.

Uptime

100.0%

Latency

76ms

Subs

3,530

Format numbers for any locale using full ICU data — the correct way to display money, percentages and measurements per region. Pass a value and a style and the format endpoint returns the locale-correct string: decimal, currency (any ISO 4217 code, with the right symbol and grouping — e.g. 1.234.567,89 € in de-DE, $1,234,567.89 in en-US, ￥1,234,567 in ja-JP, and the Indian lakh grouping 12,34,567.89 in hi-IN), percent, or unit (e.g. 80 km/h). Control the locale (BCP 47), minimum/maximum fraction digits, grouping, sign display and notation (standard, scientific, engineering or compact like 1.2M). A parts endpoint returns the formatToParts breakdown (integer, group, decimal, fraction, currency symbol…) for building custom-styled displays. Everything is computed locally with no network calls. Ideal for internationalised UIs, invoices and receipts, dashboards and reports. A locale number/currency formatter — distinct from foreign-exchange rates (currency), number-to-words (numberwords) and the numeral-base converter (baseconvert). No upstream key, no cache.

Uptime

100.0%

Latency

79ms

Subs

4,304

Convert integers between any numeral systems with exact big-integer math. Pass a number and a from/to base (radix 2 to 36, arbitrarily large, signed) and the convert endpoint returns the result and the decimal value; common 0x, 0b and 0o prefixes are accepted when they match the base, and whitespace or underscores in the input are ignored. The bases endpoint shows a single number across binary, octal, decimal, hexadecimal, base32 and base36 at once, together with its bit length, byte length and sign. Everything is computed locally with BigInt, so values of any size are exact and deterministic. Ideal for low-level and embedded debugging, networking and bit-twiddling work, teaching number systems, and anywhere you juggle hex, binary and decimal. A numeral-base converter — distinct from the text-encoding toolkit (encoding: base64/base32/hex of bytes), the Elixir/Erlang Hex package registry (hex) and number-to-words (numberwords). No upstream key, no cache.

Uptime

100.0%

Latency

75ms

Subs

4,231

Turn an email address into its Gravatar avatar and public profile. Pass an email and the service normalises it, computes the MD5 and SHA-256 hashes Gravatar uses, builds a ready-to-use avatar URL, checks whether a custom Gravatar actually exists, and fetches the public profile when present — display name, username, profile URL, location, about text, linked accounts and photos. A dedicated avatar endpoint builds just the image URL with full options: size (1-2048), a default image (identicon, monsterid, robohash, retro, mp, blank, 404, or your own URL), rating and force-default. Ideal for user-profile enrichment, comment systems, contact cards, team pages and onboarding — showing a real avatar from nothing but an email. A Gravatar lookup — distinct from deterministic avatar/identicon generation (avatar), which renders a brand-new image from a seed rather than fetching the avatar a person actually chose. No upstream key, no cache.

Uptime

100.0%

Latency

412ms

Subs

4,061

Infer a schema or types from a sample JSON document — the fastest way to get a contract out of an example API response. Pass a JSON sample and the schema endpoint returns a JSON Schema (Draft 2020-12) with detected types, required keys, array item schemas merged across elements, and recognised string formats (email, uri, uuid, date-time, date, ipv4); the typescript endpoint returns ready-to-paste TypeScript interfaces with named nested interfaces, typed arrays, unions for mixed-shape array elements and structural de-duplication. Supply the sample inline via ?json=, as a query parameter, or as a request body. Everything is computed locally with no network calls, so it is fast and deterministic. Built for scaffolding types from real API responses, generating validation schemas, documentation, contract testing and code generation. A JSON type/schema inferer — distinct from JSON-Schema validation (jsonschema), JSON pretty-printing and conversion (json), and JSON diff/patch (jsondiff). No upstream key, no cache.

Uptime

100.0%

Latency

67ms

Subs

3,988

Decode and build snowflake IDs — the 64-bit, time-sortable identifiers used by Twitter/X, Discord, Instagram and many distributed systems. Pass an ID and a platform and the service extracts the embedded creation timestamp (turn any Discord, Twitter/X or Instagram ID into the exact moment it was created) along with the machine and sequence components for that platform's epoch and bit layout. Supported platforms: twitter (X), discord, instagram, sony, and custom (supply your own epoch). The encode endpoint does the reverse: build the lower-bound snowflake for a given timestamp, so you can query "all IDs created at or after this moment" — the standard trick for time-based pagination on snowflake APIs. Everything is computed locally with exact 64-bit BigInt math and no network calls. Ideal for analytics, data forensics, API pagination and debugging distributed-ID systems. A snowflake-ID toolkit — distinct from UUID/ULID generation (uuid) and date/time math (datetime). No upstream key, no cache.

Uptime

100.0%

Latency

76ms

Subs

4,287

Inspect a domain's SMTP transport-security posture — whether mail servers are required to deliver inbound mail over authenticated TLS, protecting it from downgrade and man-in-the-middle attacks. Pass a domain and the service fetches the MTA-STS policy file from mta-sts.<domain>/.well-known/mta-sts.txt (its version, mode, the permitted MX hosts and max_age), the _mta-sts DNS TXT record (its policy id) and the _smtp._tls TLS-RPT record (the rua reporting address), then reports whether MTA-STS is actually enforced and a prioritised list of issues — no policy file, no DNS record, a mode of only "testing", or a missing TLS-RPT record. A second endpoint returns just the parsed policy file. The request is made server-side and private/internal targets are refused (SSRF-guarded). Built for email-deliverability and anti-downgrade-attack audits, vendor and third-party assessment, and compliance. An MTA-STS / TLS-RPT checker — the SMTP transport-security counterpart to the email-authentication analyzer (emailsec, which covers SPF, DKIM and DMARC), and distinct from raw DNS lookup (dns). No upstream key, no cache.

Uptime

100.0%

Latency

129ms

Subs

4,404

Check DNS propagation by querying a record across several major public resolvers at once — Google (8.8.8.8), Cloudflare (1.1.1.1), AdGuard and dns.sb — and seeing whether they all return the same answer. Pass a domain and a record type and the service queries every resolver in parallel and reports each resolver's answers, whether they are consistent (the change has fully propagated) or still differ (mid-propagation, stale caching or split-horizon DNS), the number of distinct answer sets and the union of all answers. Supported record types: A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA and PTR. A single-resolver endpoint queries one named resolver on its own, and a failing resolver is reported per-resolver without failing the whole call. Live DoH (DNS-over-HTTPS) JSON queries, always current. Built for verifying DNS changes after a migration or launch, debugging split-horizon or stale-cache issues, and uptime/propagation monitoring. A DNS propagation checker — distinct from single-resolver record lookup (dns), the email-authentication analyzer (emailsec) and WHOIS (whois). No upstream key, no cache.

Uptime

100.0%

Latency

115ms

Subs

4,515

Validate a domain's mobile deep-link configuration — the well-known files that make iOS Universal Links and Android App Links open your native app instead of a browser tab. Pass a domain and the service fetches and validates both the Apple App Site Association (apple-app-site-association — the applinks app IDs, path components and webcredentials) and the Android Digital Asset Links (assetlinks.json — each statement's relation, package name and SHA-256 certificate fingerprints), checking the /.well-known/ path with a legacy root fallback, and reports per-platform validity with concrete issues: missing applinks, a non-JSON content type, missing certificate fingerprints, or malformed structure. Single-platform endpoints check iOS or Android on their own. The request is made server-side and private/internal targets are refused (SSRF-guarded). Built for mobile-app onboarding, universal/app-link debugging, pre-release checklists and continuous monitoring. A deep-link configuration validator — distinct from DNS lookup (dns), the security.txt parser (securitytxt) and the SSL/TLS certificate check (sslcheck). No upstream key, no cache.

Uptime

100.0%

Latency

337ms

Subs

4,882

Inspect any OpenID Connect / OAuth 2.0 provider. Pass an issuer (a domain, an issuer URL, or the full discovery URL) and the service fetches the provider's discovery document at /.well-known/openid-configuration, parses every endpoint — authorization, token, userinfo, jwks, registration, end-session, introspection, revocation and device-authorization — together with the supported scopes, response types, grant types, ID-token signing algorithms, PKCE methods and claims, then fetches the JWKS and summarises its signing keys (count, algorithms, key types and key IDs), and reports a validity check with any issues. A second endpoint fetches and summarises any JSON Web Key Set on its own. The request is made server-side and private/internal targets are refused (SSRF-guarded). Built for SSO and OAuth/OIDC integration, identity-provider configuration debugging (Auth0, Okta, Keycloak, Azure AD, Google), security review and monitoring of signing-key rotation. An OIDC discovery / JWKS inspector — distinct from the JWT toolkit (jwt), the security.txt parser (securitytxt) and the HTTP security-header grader (secheaders). No upstream key, no cache.

Uptime

100.0%

Latency

105ms

Subs

3,822

Compare and patch JSON documents to RFC standards. Pass two documents and the service returns whether they are equal, an RFC 6902 JSON Patch (the precise add/remove/replace operations that turn the first into the second, using RFC 6901 JSON-Pointer paths), a change summary, and an RFC 7386 JSON Merge Patch. The patch endpoint goes the other way: apply an RFC 6902 patch (add, remove, replace, move, copy and test operations) or an RFC 7386 merge patch to a document and get the result. Documents can be sent inline or as a JSON body. Everything is computed locally with no network calls, so it is fast and deterministic. Built for configuration and state management, API change detection, audit trails and change logs, optimistic-concurrency checks and data-sync pipelines. A JSON diff/patch engine — distinct from text diffing (textdiff), JSONPath querying (jsonpath), JSON validation and pretty-printing (json) and JSON-Schema validation (jsonschema). No upstream key, no cache.

Uptime

100.0%

Latency

93ms

Subs

4,983

Build a valid RFC 5545 iCalendar (.ics) event from simple parameters — and get ready-to-use "add to calendar" links for Google, Outlook, Office 365 and Yahoo. Pass a title, start and end (ISO 8601 or unix timestamps, in UTC) — or a duration in minutes, or an all-day flag — plus optional location, description, URL, organizer, an RRULE recurrence (e.g. FREQ=WEEKLY) and a reminder (a VALARM N minutes before). The service returns the fully-formed .ics text with correct escaping and 75-octet line folding, a base64 data: URI you can drop straight into a download link, and the four calendar deep-links. A second endpoint parses raw .ics text back into structured JSON events. Everything is computed locally with no network calls, so it is fast and deterministic. Built for booking and scheduling flows, event pages, email "add to calendar" buttons, reminders and no-code automations. A calendar-event builder — distinct from date/time math (datetime), public-holiday data (holidays) and the Jewish calendar (hebcal). No upstream key, no cache.

Uptime

100.0%

Latency

79ms

Subs

3,836

Generate Subresource Integrity (SRI) hashes for any web asset, so browsers can verify that a CDN-hosted script or stylesheet has not been tampered with. Pass a URL and the service fetches the asset and returns its sha256, sha384 and sha512 SRI hashes, the chosen integrity value (sha384 by default, or pass your preferred algorithm), the asset's size and content type, and a ready-to-paste <script> or <link> tag complete with the integrity and crossorigin attributes. A verify endpoint re-fetches the asset and tells you whether it still matches a known integrity string — catching silent CDN changes or supply-chain tampering before your users hit them. The request is made server-side; private and internal targets are refused (SSRF-guarded). Built for securing third-party scripts, supply-chain hardening, build pipelines and CSP/SRI compliance. A Subresource Integrity generator and verifier — distinct from raw cryptographic hashing of input data (hash), the HTTP security-header grader (secheaders) and the SSL/TLS certificate check (sslcheck). No upstream key, no cache.

Uptime

100.0%

Latency

99ms

Subs

4,297

Prioritise CVEs by real-world exploitation risk — not just severity. Combines the FIRST.org EPSS score (the probability, 0 to 1, that a CVE will be exploited in the next 30 days, with its percentile rank) and the CISA KEV catalog (vulnerabilities confirmed to be actively exploited in the wild — with the vendor, product, date added, remediation due date and whether the flaw is used in ransomware campaigns), and derives a single priority level for each CVE. Look up to 25 CVEs in one call, browse the full CISA Known Exploited Vulnerabilities catalog filtered by vendor, product or ransomware use, or list the CVEs with the highest current EPSS scores. Built for vulnerability management, patch prioritisation, risk scoring and security dashboards — answering not "how bad could this be?" but "how likely is it to actually be exploited?". A vulnerability-prioritisation layer — distinct from raw CVE details and CVSS severity (cve), password-breach checks (pwned) and the HTTP security-header grader (secheaders). Data live from FIRST.org and CISA. No upstream key, no cache.

Uptime

100.0%

Latency

114ms

Subs

4,379

Score how easy a piece of text is to read using the standard, peer-reviewed readability formulas — Flesch Reading Ease, Flesch-Kincaid Grade, Gunning Fog, SMOG, Coleman-Liau and the Automated Readability Index. Pass text and get all six scores back together with the underlying counts (words, sentences, syllables, complex and polysyllabic words, letters and characters), an averaged grade level, an estimated reading time and a plain-English interpretation of the reading ease. A second endpoint counts syllables for a word or for every word in a phrase. Supply text inline via ?text=, as a query parameter or in a request body; everything is computed locally with no network calls, so it is fast and deterministic. Built for content and copywriting tools, SEO and editorial workflows, education and accessibility (plain-language) checks, and UX-writing review. A readability scorer — distinct from sentiment/NLP analysis (nlp), spelling and grammar checking (grammar), the case and text utilities (text) and string similarity (similarity). No upstream key, no cache.

Uptime

100.0%

Latency

76ms

Subs

3,085

Validate and summarise an OpenAPI / Swagger API definition. Supply the spec inline (?spec=), as a request body, or fetched from a URL (?url=, SSRF-guarded) — in JSON or YAML. The validator detects the version (Swagger 2.0, OpenAPI 3.0.x or 3.1.x), checks the required structure (info.title and info.version, the presence of paths/components, and every operation's responses), and lints for common problems — duplicate or missing operationIds, operations without a summary or description, tags used but not declared, and malformed paths — returning a valid flag, counts of paths, operations, schemas, tags and servers, and separate error and warning lists. A summary endpoint inventories the whole API: every endpoint with its method, path, operationId, summary and tags, plus the declared servers, tags and component schemas. Built for CI gates on API contracts, API-catalogue ingestion, documentation pipelines and design review. An OpenAPI definition validator and linter — distinct from the JSON-Schema validator (jsonschema), the JSON/YAML/XML converters and the on-page HTML/SEO tools. No upstream key, no cache.

Uptime

100.0%

Latency

83ms

Subs

3,562

Inspect any domain's email-authentication posture — its protection against spoofing and phishing — via live DNS. Pass a domain and the service looks up and validates SPF (the v=spf1 record, its all-qualifier and the 10-lookup limit), DMARC (the _dmarc policy p=none/quarantine/reject, plus sp, pct and rua/ruf reporting addresses), DKIM (probing the common selectors at selector._domainkey, or pass your own), BIMI and the MX servers — then returns an A+-to-F grade with a prioritised list of issues and concrete advice. A second endpoint parses the DMARC record tag by tag with a plain-English interpretation of the policy. Built for email-deliverability and anti-spoofing audits, vendor and third-party risk assessment, security onboarding and continuous monitoring. An email-authentication analyzer — distinct from mailbox/address validation (email), raw DNS record lookup (dns) and the HTTP security-header grader (secheaders). Pure live DNS, no upstream key, no cache.

Uptime

100.0%

Latency

93ms

Subs

4,971

Fetch and parse any domain's RFC 9116 security.txt — the machine-readable file at /.well-known/security.txt that tells security researchers how to report vulnerabilities. Pass a domain and the service locates the file (the canonical .well-known path with a legacy root fallback), parses every field — Contact, Expires, Encryption, Acknowledgments, Preferred-Languages, Canonical, Policy, Hiring and CSAF — and reports whether it is valid (has at least one Contact and a single, non-expired Expires), whether it is PGP-signed, whether it has expired (with the number of days remaining) and a list of issues with concrete advice. A companion endpoint returns the raw file. The request is made server-side; private and internal targets are refused (SSRF-guarded). Built for security audits, vendor and third-party risk assessment, attack-surface reviews and vulnerability-disclosure-policy compliance checks. A security.txt parser and validator — distinct from the HTTP security-header grader (secheaders), the SSL/TLS certificate check (sslcheck) and host reachability (hostcheck). No upstream key, no cache.

Uptime

100.0%

Latency

130ms

Subs

3,518

Fetch any URL and analyse its HTTP response security headers — grading the site A+ to F the way securityheaders.com and Mozilla Observatory do. Pass a URL and the service makes the request server-side (following redirects), then reports which protective headers are present, which are missing (with concrete remediation advice) and which response headers leak information. Graded headers include Strict-Transport-Security (HSTS), Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy; information-leak headers include Server and X-Powered-By. A companion endpoint returns every raw response header. Private and internal targets are refused (SSRF-guarded). Built for security audits, CI/CD security gates, attack-surface reviews and compliance checks. A security-header grader — distinct from the SSL/TLS certificate check (sslcheck), host reachability (hostcheck), the IANA HTTP status-code reference (http) and the on-page SEO audit (seo). No upstream key, no cache.

Uptime

100.0%

Latency

94ms

Subs

3,524

Look up the live Tor network as an API — powered by the Tor Project's official Onionoo service and the canonical bulk exit-node list. Check whether any IPv4 or IPv6 address is a Tor relay (is_tor_relay) and whether it is an exit node that clients leave the network through (is_exit_node, corroborated against the bulk exit list), returning the full matching relay record(s): nickname, fingerprint, flags, country, autonomous system, advertised bandwidth, exit-policy summary and first/last-seen dates. Or search the public relay list by nickname, fingerprint, IP, country or flag (Exit, Guard, Fast, Stable…) with paging. Built for fraud and abuse triage, login-risk scoring, comment- and registration-filtering, and network research — knowing at a glance whether a connection originates from the Tor network. Range data is fetched live from the Tor Project, so it is always current. A Tor-network lookup — distinct from cloud/CDN attribution (cloudips), IP geolocation (ipgeo), ASN/BGP ownership (asn, ripestat) and open-port exposure (internetdb). No upstream key, no cache.

Uptime

100.0%

Latency

412ms

Subs

3,654