CrawlCheck Bundle API
The Bundle API from CrawlCheck — 1 operation(s) for bundle.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/crawlcheck-io:crawlcheck-io-bundle-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Crawlcheck Io Bundle API
version: '1'
contact:
name: CrawlCheck
url: https://crawlcheck.io/policy
email: hello@crawlcheck.io
license:
name: Terms
url: https://crawlcheck.io/policy
x-core-contract:
promise: 'These operations are the core contract. They stay at /api/v1 and keep answering for at least 180 days after any /api/v2 is announced; their stable fields change only in a new major version, and their provisional fields only after 30 days'' notice, per /docs/api/compatibility. Verifying what they return needs none of these calls: crawlcheck-verify.mjs checks a document on your machine against the published keys (/.well-known/http-message-signatures-directory) and the rotation record, read once with --online or saved for --keys. Everything else documented here is useful but secondary, and may change with the notice its fields'' tags promise.'
operations:
- method: GET
path: /api/v1/resolve
operationId: resolveDomainV1
- method: POST
path: /api/v1/resolve
operationId: resolveBatchV1
- method: POST
path: /api/v1/preflight
operationId: preflightV1
- method: GET
path: /api/v1/decisions/{sha256}
operationId: decisionCheckV1
- method: GET
path: /api/v1/revocations
operationId: revocations
- method: GET
path: /api/v1/visitor
operationId: visitorResolveV1
- method: POST
path: /api/v1/visitor
operationId: visitorResolveBatchV1
- method: GET
path: /api/v1/mcp/scan
operationId: mcpScanUrl
- method: POST
path: /api/v1/mcp/lock/check
operationId: mcpLockCheck
list: https://crawlcheck.io/api/v1/core
description: 'Operations tagged Bundle across 2 of this provider''s published API definitions: crawlcheck-io-openapi.json, crawlcheck-io-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://crawlcheck.io
tags:
- name: Bundle
paths:
/api/bundle:
get:
operationId: evidenceBundle
summary: 'One evidence bundle that verifies offline: signed manifest + public key, record…'
parameters:
- name: id
in: query
required: true
schema:
type: string
description: 'report id, d1: decision id, f1: finding id, or manifest sha256'
- name: download
in: query
required: false
schema:
type: string
enum:
- '0'
description: 0 to return inline instead of as an attachment
responses:
'200':
description: '{kind, version, report, verifier, manifest, record, seal}'
content:
application/json:
schema:
$ref: '#/components/schemas/EvidenceBundleV1'
examples:
worked:
summary: download=0 returns it inline instead of as a file. Captured from production on 2026-10-02 (MDT).
value:
kind: crawlcheck-evidence-bundle
version: 1
generated_at: '2026-10-02T19:55:17.945Z'
report:
id: 9uwb9boadf
domain: crawlcheck.io
path: /
scanned_at: '2026-10-02T19:54:51.397Z'
score_version: 26
archived: false
verifier:
url: https://crawlcheck.io/crawlcheck-verify.mjs?v=edc1c2cd6ce52e81
sha256: edc1c2cd6ce52e81a6148a15fd42bc408c4a90ab1593451f2a9f08273f61c570
run: node crawlcheck-verify.mjs <this file>
page: https://crawlcheck.io/verify
proves:
- these manifest bytes were signed by the key published at https://crawlcheck.io/.well-known/http-message-signatures-directory
- the record digest is a leaf of the Merkle root sealed for its day, and that root is timestamped (OpenTimestamps, anchored in Bitcoin once confirmed)
- 'with the subject included: the sealed record names this report and commits to this manifest, so every fetched byte listed in the manifest (by SHA-256) is bound to the timestamp'
does_not_prove:
- that a finding is substantively right - it proves what was recorded and when, not that the rule was the right rule
- anything about the site after the scan time
manifest:
sha256: 52822ea1488d4a0c8ec3a470d7453518719476ead7b97d164350bb686a368cd4
body: '{"experiences":[{"bytes":42800,"content_type":"text/html; charset=utf-8","error":null,"experience_id":"ex1:9ac75a03be8592572d595980def0807a","final_url":"https://crawlcheck.io/","identity":"crawlcheck","observed_at":"2026-10-02T19:54:51.397Z","request_profile":"rp1:9b061033b296c934","role":"page","sha256":"3b2e20111911632d1a9af50e0f252bdd17492049a2695df94357899daf87f193","status":200,"stored":"kept","url":"https://crawlcheck.io/","via":"self-scan vantage"},{"bytes":1761,"content_type":"text/plain; charset=utf-8","error":null,"experience_id":"ex1:9ee6dd275e6a753353e9882f4520af5f","final_url":"h…'
body_missing: null
signature:
alg: Ed25519
kid: hcIAczGf-8EFBnkunmZlvFWnD2nHHeHeC9cM4BTiBVo
message: 'crawlcheck-meg-manifest-v1
52822ea1488d4a0c8ec3a470d7453518719476ead7b97d164350bb686a368cd4'
sig: QSQxxfYs_bj4AlVeNJVxUyM4ysuQFWeX3CLe0zJPi_e716yGFzrJzlDSbq8Mc7aF9wyl1oWI13kkOCu_B_5qDA
signed_at: '2026-10-02T19:55:09.859Z'
key:
jwk:
kty: OKP
crv: Ed25519
x: Ny5tAiGdpyVWTm64G1_0g_sTo4ocLL7kqjZ6cK7G5KM
kid: hcIAczGf-8EFBnkunmZlvFWnD2nHHeHeC9cM4BTiBVo
published_in: https://crawlcheck.io/.well-known/http-message-signatures-directory
key_missing: null
record:
digest: a4622a64404beeb85d82f2ca7785d361ed20838b63c4c1b6cf83fe8fea1e7541
subject: null
subject_withheld: the sealed subject lists every finding code on this report, which is licence-gated; with a licence covering crawlcheck.io, or as its owner, the bundle carries it and closes the subject checks
recipe: digest = SHA-256 of the subject's UTF-8 bytes; the subject is canonical JSON (keys sorted, no whitespace); on records from 2026-09-20 its meg field is the manifest sha256
decision_leaves: null
lineage_leaves: null
leaves_withheld: the decision and lineage leaves name every finding code and business fact on this report, which is licence-gated; with a licence covering crawlcheck.io, or as its owner, the bundle carries them
seal:
state: pending
day: '2026-10-02'
why: the day 2026-10-02 is sealed after it closes, at 01:17 UTC the next day; download the bundle again after that
publish_guard:
checked:
- private_key
- private_jwk
- licence_key
withheld: []
disclosure: https://crawlcheck.io/docs/api#disclosure
'404':
description: No record for that id
x-codeSamples:
- lang: Shell
label: curl
source: "curl -s \\\n 'https://crawlcheck.io/api/bundle?id=9uwb9boadf&download=0'"
security: []
x-auth: public; no credential read
tags:
- Bundle
servers:
- url: https://crawlcheck.io
components:
schemas:
EvidenceBundleV1:
type: object
additionalProperties: false
required:
- kind
- version
- report
- verifier
- manifest
- record
- seal
description: 'GET /api/bundle: one file that checks offline with /crawlcheck-verify.mjs. A field that cannot be filled (an anonymous download, an unsealed day, a record from before manifests) is null with a *_withheld / *_missing / why reason, never omitted'
properties:
kind:
const: crawlcheck-evidence-bundle
x-stability: stable
version:
type: integer
x-stability: stable
generated_at:
type: string
x-stability: stable
report:
type: object
required:
- id
- domain
- scanned_at
properties:
id:
type:
- string
- 'null'
x-stability: stable
domain:
type:
- string
- 'null'
x-stability: stable
path:
type:
- string
- 'null'
x-stability: stable
scanned_at:
type:
- string
- 'null'
x-stability: stable
score_version:
type:
- number
- 'null'
x-stability: stable
archived:
type: boolean
x-stability: stable
x-stability: stable
verifier:
type: object
required:
- url
- sha256
properties:
url:
type: string
x-stability: stable
sha256:
type: string
pattern: ^[0-9a-f]{64}$
x-stability: stable
run:
type: string
x-stability: stable
page:
type: string
x-stability: stable
x-stability: stable
proves:
type: array
items:
type: string
x-stability: provisional
does_not_prove:
type: array
items:
type: string
x-stability: provisional
manifest:
type:
- object
- 'null'
required:
- sha256
- body
properties:
sha256:
type: string
pattern: ^[0-9a-f]{64}$
x-stability: stable
body:
type:
- string
- 'null'
x-stability: stable
body_missing:
type:
- string
- 'null'
x-stability: stable
signature:
type:
- object
- 'null'
properties:
alg:
type:
- string
- 'null'
x-stability: stable
kid:
type:
- string
- 'null'
x-stability: stable
message:
type:
- string
- 'null'
x-stability: stable
sig:
type:
- string
- 'null'
x-stability: stable
signed_at:
type:
- string
- 'null'
x-stability: stable
x-stability: stable
key:
type:
- object
- 'null'
properties:
jwk:
type: object
required:
- kty
- crv
- x
properties:
kty:
const: OKP
x-stability: stable
crv:
const: Ed25519
x-stability: stable
x:
type: string
x-stability: stable
x-stability: stable
kid:
type: string
x-stability: stable
published_in:
type: string
x-stability: stable
x-stability: stable
key_missing:
type:
- string
- 'null'
x-stability: stable
x-stability: stable
record:
type:
- object
- 'null'
required:
- digest
- subject
properties:
digest:
type:
- string
- 'null'
x-stability: stable
subject:
type:
- string
- 'null'
x-stability: stable
subject_withheld:
type:
- string
- 'null'
x-stability: stable
recipe:
type:
- string
- 'null'
x-stability: internal
decision_leaves:
type:
- array
- 'null'
items:
type: object
x-stability: stable
lineage_leaves:
type:
- array
- 'null'
items:
type: object
x-stability: stable
leaves_withheld:
type:
- string
- 'null'
x-stability: stable
x-stability: stable
seal:
type:
- object
- 'null'
required:
- state
properties:
state:
enum:
- sealed
- pending
- unsealed
- unverifiable
- unknown
x-stability: stable
day:
type:
- string
- 'null'
x-stability: stable
root:
type:
- string
- 'null'
x-stability: stable
path:
type: array
items:
type: object
required:
- side
- hash
properties:
side:
enum:
- left
- right
x-stability: stable
hash:
type: string
pattern: ^[0-9a-f]{64}$
x-stability: stable
x-stability: stable
leaves_that_day:
type:
- number
- 'null'
x-stability: stable
sealed_at:
type:
- string
- 'null'
x-stability: stable
calendars:
type: array
items:
type: string
x-stability: stable
ots_base64:
type:
- string
- 'null'
x-stability: stable
bitcoin_block:
type:
- number
- 'null'
x-stability: stable
recipe:
type:
- string
- 'null'
x-stability: internal
why:
type:
- string
- 'null'
x-stability: stable
x-stability: stable
publish_guard:
type: object
description: 'sec8: every bundle is scanned before it is served; a section that matched is null and carries <section>_withheld'
properties:
checked:
type: array
items:
type: string
x-stability: provisional
withheld:
type: array
items:
type: object
properties:
section:
type: string
x-stability: provisional
matched:
type: array
items:
type: string
x-stability: provisional
x-stability: provisional
x-stability: provisional
disclosure:
type: string
description: 'Who can read which representation of a scan: /docs/api#disclosure'
x-stability: provisional
patternProperties:
^[a-z_]+_withheld$:
type: string
x-stability: stable
securitySchemes:
licenceKey:
type: apiKey
in: header
name: x-crawlcheck-key
description: 'Your licence key: cc_ followed by 32 hex characters. Sent on every keyed call.'
bearer:
type: http
scheme: bearer
description: The same licence key as a Bearer token. Accepted on /api/v1/* and /api/usage.
externalDocs:
url: https://crawlcheck.io/docs/api
description: Human-readable reference
x-refined-from:
- crawlcheck-io-openapi.json
- crawlcheck-io-openapi.yml