RFC 9116 fields & locations

Code snippets

curl "https://api.oanor.com/securitytxt-api/v1/meta" \
  -H "x-oanor-key: oanor_test_..."

await fetch("https://api.oanor.com/securitytxt-api/v1/meta", {
  headers: { "x-oanor-key": "oanor_test_..." }
});

$ch = curl_init("https://api.oanor.com/securitytxt-api/v1/meta");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-oanor-key: oanor_test_..."]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$out = curl_exec($ch);

import requests
requests.get(
    "https://api.oanor.com/securitytxt-api/v1/meta",
    headers={"x-oanor-key": "oanor_test_..."}
)

Example response

A real response from this endpoint, captured by the latest health check.

{
    "data": {
        "note": "Fetch and parse a domain's RFC 9116 security.txt — the machine-readable file at /.well-known/security.txt that tells security researchers how to report vulnerabilities. /v1/check?url=google.com locates the file (canonical .well-known path with legacy root fallback), parses every field (Contact, Expires, Encryption, Acknowledgments, Preferred-Languages, Canonical, Policy, Hiring, CSAF), and reports whether it is valid (has a Contact and a single non-expired Expires), whether it is PGP-signed, whether it has expired (with days remaining) and a list of issues with advice. /v1/raw returns the raw file. The request is made server-side; private/internal targets are refused (SSRF-guarded). Ideal for security audits, vendor-assessment, attack-surface reviews and disclosure-policy compliance checks. A security.txt parser/validator — distinct from the HTTP security-header grader (secheaders), the SSL/TLS certificate check (sslcheck) and host reachability (hostcheck). No key, no cache.",
        "spec": "RFC 9116 (security.txt)",
        "fields": [
            "Contact (required, repeatable)",
            "Expires (required)",
            "Encryption",
            "Acknowledgments",
            "Preferred-Languages",
            "Canonical",
            "Policy",
            "Hiring",
            "CSAF"
        ],
        "endpoints": [
            "/v1/check",
            "/v1/raw",
            "/v1/meta"
        ],
        "locations": [
            "/.well-known/security.txt",
            "/security.txt (legacy)"
        ]
    },
    "meta": {
        "timestamp": "2026-06-01T23:40:51.072Z",
        "request_id": "3aeaeed6-67ac-4d16-a683-0ea2a68d94e5"
    },
    "status": "ok",
    "message": "Meta retrieved",
    "success": true
}