Inspect a public link
The server fetches static HTML metadata of a public http(s) page under a strict SSRF policy and returns the status, final URL and social-card fields; missing fields are listed explicitly.
Inputs and parameters
url— Public URL
Real example
POST /api/v1/inspect {"url":"https://example.com/article?utm=private#frag"}
(head contains <title>Sample article</title>, <meta name="description" content="A description">, <link rel="canonical" href="/article">, <meta property="og:title" content="Sample article">, <meta property="og:image" content="/img/card.png">, <meta name="twitter:card" content="summary_large_image">)
→ HTTP 200 {"data":{"requestedUrl":"https://example.com/article","finalUrl":"https://example.com/article","status":200,"title":"Sample article","description":"A description","canonical":"https://example.com/article","openGraph":{"title":"Sample article","image":"https://example.com/img/card.png"},"twitter":{"card":"summary_large_image"},"warnings":["All fields were found","Static HTML metadata: no JS, no screenshots, no promise of matching platform caches","OG image not loaded automatically"],"checkedAt":"2026-11-15T00:00:00.000Z"},"requestId":"…"}
Note: the utm=private query and fragment appear in neither result nor logs; relative canonical / og:image are resolved to absolute URLs; og:image shows only a URL + placeholder.
Limits and failure handling
Defaults: 10 s total budget, separate connect timeout, 2 MiB decompressed HTML, max 3 redirects, process concurrency 4, bounded 10-minute cache. HTML only; timeouts, oversized/compressed responses, non-HTML content and invalid certificates yield readable errors. First release: no target JS execution, no screenshots, no promise of matching platform caches, no shared query history. OG image preview requires a click and a backend-restricted fetch under the same policy.
FAQ
Are authenticated pages supported?
No. The fetch carries no cookies or credentials and never returns cookies; only public static HTML is read.
Can I inspect an IP literal or custom port?
Only ports 80/443 are allowed and IP literals must be public; private/loopback/reserved and IPv4-mapped IPv6 addresses are refused.
Is my input kept on failure?
Yes. The error is shown in the result area and below the field, the input is preserved, and copy/download buttons appear only after success.
What if the target contains <script>?
Script text is only noted as an inert warning; it is never executed or injected. The fetched HTML body itself is never returned to the browser.