Developers

URL review API

Bring the Cintrix URL checker into your own apps. Pro plan, 5,000 requests a month.

Overview

Available on the Pro plan only.
5,000 requests a month per Pro account, shared across your keys and separate from your URL checker allowance. Resets on the 1st of each month at 00:00 UTC.
One endpoint today: POST /api/public/v1/url-review. It runs the same heuristic review as the in-app URL checker.
There is no password API. The password tools only run in your browser.

Authentication

Create keys on the Developer page (up to 5 active keys). The full key is shown once when you create it; Cintrix stores only a fingerprint, so a lost key can't be recovered — revoke it and create a new one. Revoking takes effect immediately and can't be undone. Send the key as a bearer token and keep it on your server, never in browser or app code.

Authorization: Bearer cx_...

URL review

Request

JSON body with one field, url: a full http:// or https:// link, up to 2,048 characters. The link is checked as text — it is never visited, resolved, stored or logged.

curl -X POST https://cintrixshield.com/api/public/v1/url-review \
  -H "Authorization: Bearer cx_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/login"}'

Response

HTTP/1.1 200
X-RateLimit-Limit: 5000
X-RateLimit-Remaining: 4999
X-RateLimit-Reset: 2026-12-01T00:00:00+00:00

{
  "risk": "Low",            // "Low" | "Caution" | "High"
  "score": 0,               // 0–100, higher = more warning signs
  "findings": [
    { "id": "https", "severity": "info",
      "title": "Uses HTTPS", "detail": "..." }
  ],
  "disclaimer": "Heuristic review of the link text only. ..."
}

The result flags common warning signs in a link's structure. It is not threat intelligence and not a guarantee that a link is safe or unsafe.

Quota

Each request with a valid Pro key counts once, including requests with an invalid link (422).
Requests rejected before that — bad key, not Pro, malformed body — don't count.
Every counted response includes X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset.
Usage per key and for your account is shown on the Developer page.

Errors

Errors return JSON in this shape:

{ "error": { "code": "quota_exceeded", "message": "Monthly API allowance used." } }

Status	Code	Meaning
400	invalid_request	Body isn't {"url": "..."} JSON, or has extra fields.
401	unauthorized	Missing, malformed, unknown or revoked API key.
403	plan_required	The key's account isn't on the Pro plan.
413	payload_too_large	Request body over 8 KB.
415	unsupported_media_type	Content-Type isn't application/json.
422	invalid_url	Not a valid http(s) link (counts as a request).
429	quota_exceeded	This month's 5,000 requests are used.
503	unavailable	Temporary server problem. Retry later.

Not available yet

Webhooks, SDKs and integrations aren't built. This page will be updated if they are.

Manage API keys Compare plans