API reference

TLS certificate, security headers, SPF, DMARC, MX. No AI, no crawl - just network/DNS checks.

curl -X POST https://api.validex.space/v1/validate/security \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <your-payment-token>" \
  -d '{"target": "stripe.com"}'

HTTPS, domain age, MX records, privacy policy, terms, contact page. No AI. The last three crawl the site itself, so this one is slower than a pure DNS/TLS check.

curl -X POST https://api.validex.space/v1/validate/trust \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <your-payment-token>" \
  -d '{"target": "stripe.com"}'

Pricing, documentation, about, blog, careers, changelog. No AI.

curl -X POST https://api.validex.space/v1/validate/web \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <your-payment-token>" \
  -d '{"target": "stripe.com"}'

GitHub activity, contributors, release cadence, issue and PR activity, repository age and popularity. No AI.

curl -X POST https://api.validex.space/v1/validate/engineering \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <your-payment-token>" \
  -d '{"target": "stripe.com"}'

Runs every category, then returns an AI-forward report: the verdict object (recommendation, executiveSummary, insights, suggestions, opportunities, riskFlags, categoryNarrative) appears before summary in the response. See response shape below.

curl -X POST https://api.validex.space/v1/validate/ai \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <your-payment-token>" \
  -d '{"target": "stripe.com"}'

Runs the full pipeline against 2-5 targets in parallel, no AI, and returns them ranked by overall score. One failing target never fails the others - it's reported under failed instead. Persists a Comparison row you can retrieve later by id.

curl -X POST https://api.validex.space/v1/validate/compare \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <your-payment-token>" \
  -d '{"targets": ["stripe.com", "github.com"]}'

Security and trust checks with AI analysis - includes a light crawl of the privacy policy, terms, and contact pages (see trust above), so it's not purely network-level. Scores-first response shape, with summary.executiveSummary mirrored from verdict for backward compatibility.

curl -X POST https://api.validex.space/v1/validate/quick \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <your-payment-token>" \
  -d '{"target": "stripe.com", "refresh": false}'

Every category with AI analysis - the complete report. Same scores-first shape as quick.

curl -X POST https://api.validex.space/v1/validate/full \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <your-payment-token>" \
  -d '{"target": "stripe.com"}'

Retrieves a previously generated report by the analysisId any of the single-target endpoints above returns. No payment required.

curl https://api.validex.space/v1/validate/val_thpqccyhgviwf52o4o7g1eld

Returns 200 with the stored report once completed or partial:

{ "success": true, "data": { "analysisId": "val_...", "status": "running" } }

or 404 if the id doesn't exist:

{ "success": false, "error": "Analysis not found." }

Retrieves a previously generated comparison by the comparisonId a compare call returns. No payment required.

curl https://api.validex.space/v1/validate/compare/cmp_thpqccyhgviwf52o4o7g1eld

{
  "success": true,
  "data": {
    "comparisonId": "cmp_...",
    "targets": ["stripe.com", "github.com"],
    "targetCount": 2,
    "ranking": [ /* same ranking array as the POST response */ ],
    "analysisIds": ["val_...", "val_..."],
    "createdAt": "2026-09-09T19:27:15.000Z"
  }
}

or 404 if the id doesn't exist:

{ "success": false, "error": "Comparison not found." }

Every paid endpoint above is gated by the x402 payment protocol. Call it without a PAYMENT-SIGNATURE header and you get back 402 with the exact payment requirements to satisfy, both in the JSON body and on a PAYMENT-REQUIRED response header (what spec-compliant x402 clients actually read from). amount matches that endpoint's price from the table above - this example shows security's:

{
  "x402Version": 2,
  "error": "Payment required",
  "accepts": [{
    "scheme": "exact",
    "network": "algorand:...",
    "amount": "50000",
    "asset": "10458941",
    "payTo": "...",
    "maxTimeoutSeconds": 300,
    "extra": { "decimals": 6 }
  }],
  "extensions": {
    "bazaar": { /* Bazaar discovery metadata, per-endpoint */ },
    "x402-merchant": { /* merchant identity - name, website, logo */ }
  }
}

Sign and broadcast that payment, then retry the same request with the resulting token in PAYMENT-SIGNATURE. AI agents don't need to do this by hand - @x402/axios and @x402/fetch intercept the 402, pay, and retry automatically.