{"openapi":"3.1.0","info":{"title":"Subresource Integrity API","version":"1.0.0","description":"Generate Subresource Integrity (SRI) hashes for any web asset, so browsers can verify that a CDN-hosted script or stylesheet has not been tampered with. Pass a URL and the service fetches the asset and returns its sha256, sha384 and sha512 SRI hashes, the chosen integrity value (sha384 by default, or pass your preferred algorithm), the asset's size and content type, and a ready-to-paste <script> or <link> tag complete with the integrity and crossorigin attributes. A verify endpoint re-fetches the asset and tells you whether it still matches a known integrity string — catching silent CDN changes or supply-chain tampering before your users hit them. The request is made server-side; private and internal targets are refused (SSRF-guarded). Built for securing third-party scripts, supply-chain hardening, build pipelines and CSP/SRI compliance. A Subresource Integrity generator and verifier — distinct from raw cryptographic hashing of input data (hash), the HTTP security-header grader (secheaders) and the SSL/TLS certificate check (sslcheck). No upstream key, no cache.","contact":{"name":"PremiumApi","url":"https://www.oanor.com/by/premiumapi"}},"servers":[{"url":"https://api.oanor.com/sri-api","description":"oanor gateway"}],"tags":[{"name":"Subresource Integrity"},{"name":"Meta"}],"components":{"securitySchemes":{"oanorKey":{"type":"apiKey","in":"header","name":"x-oanor-key","description":"Get your key at https://www.oanor.com/developer/keys"}}},"security":[{"oanorKey":[]}],"paths":{"/v1/generate":{"get":{"operationId":"get_v1_generate","tags":["Subresource Integrity"],"summary":"SRI hashes + tag for an asset","description":"","parameters":[{"name":"url","in":"query","required":true,"description":"Asset URL (script/style/file)","schema":{"type":"string"},"example":"https://example.com"},{"name":"algorithm","in":"query","required":false,"description":"sha256, sha384 (default) or sha512","schema":{"type":"string"}}],"security":[{"oanorKey":[]}],"responses":{"200":{"description":"OK","content":{"application/json":{"example":{"data":{"url":"https://example.com/","html":{"script":"<script src=\"https://example.com/\" integrity=\"sha384-EUZfMlUFsH9OvEhNQdUYTotKnWJBzc1rEyZ486Wt8faO3LCu9bFskk2U1TtVUGNf\" crossorigin=\"anonymous\"></script>"},"hashes":{"sha256":"sha256-+5HXWmu0MHh6YbCuxeN09YADDyh44WE+q1ymMQ97u5o=","sha384":"sha384-EUZfMlUFsH9OvEhNQdUYTotKnWJBzc1rEyZ486Wt8faO3LCu9bFskk2U1TtVUGNf","sha512":"sha512-jhVrrTWMkaPdWTEr++g2+LUrutETjBntwr8rBlzD0dA66sYL2PRjAzPLvbCTm7kPRTX+kPcOBCekP96TyPBW/g=="},"algorithm":"sha384","final_url":"https://example.com/","integrity":"sha384-EUZfMlUFsH9OvEhNQdUYTotKnWJBzc1rEyZ486Wt8faO3LCu9bFskk2U1TtVUGNf","size_bytes":528,"content_type":"text/html"},"meta":{"timestamp":"2026-06-01T23:40:48.598Z","request_id":"3a8b92bd-a607-4ce0-b710-fbbdf0af2046"},"status":"ok","message":"SRI generated","success":true}}}},"401":{"description":"Missing or invalid x-oanor-key header"},"402":{"description":"Active subscription required"},"429":{"description":"Rate-limit or monthly quota reached"},"502":{"description":"Upstream did not respond"}}}},"/v1/verify":{"get":{"operationId":"get_v1_verify","tags":["Subresource Integrity"],"summary":"Verify a URL matches an integrity","description":"","parameters":[{"name":"url","in":"query","required":true,"description":"Asset URL","schema":{"type":"string"},"example":"https://example.com"},{"name":"integrity","in":"query","required":true,"description":"Expected sha256/384/512-... value","schema":{"type":"string"},"example":"sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"}],"security":[{"oanorKey":[]}],"responses":{"200":{"description":"OK","content":{"application/json":{"example":{"data":{"url":"https://example.com/","actual":"sha384-EUZfMlUFsH9OvEhNQdUYTotKnWJBzc1rEyZ486Wt8faO3LCu9bFskk2U1TtVUGNf","matches":false,"expected":"sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC","algorithm":"sha384","final_url":"https://example.com/"},"meta":{"timestamp":"2026-06-01T23:40:48.713Z","request_id":"b0a4f63f-6290-4caf-90a9-9feb4ade5a42"},"status":"ok","message":"SRI verified","success":true}}}},"401":{"description":"Missing or invalid x-oanor-key header"},"402":{"description":"Active subscription required"},"429":{"description":"Rate-limit or monthly quota reached"},"502":{"description":"Upstream did not respond"}}}},"/v1/meta":{"get":{"operationId":"get_v1_meta","tags":["Meta"],"summary":"Algorithms & limits","description":"","parameters":[],"security":[{"oanorKey":[]}],"responses":{"200":{"description":"OK","content":{"application/json":{"example":{"data":{"note":"Generate Subresource Integrity (SRI) hashes for any web asset so browsers can verify that a CDN-hosted script or stylesheet has not been tampered with. /v1/generate?url=https://code.jquery.com/jquery-3.7.1.min.js fetches the asset and returns its sha256, sha384 and sha512 SRI hashes, the chosen integrity value (sha384 by default; pass ?algorithm=), the asset's size and content type, and a ready-to-paste <script> or <link> tag complete with the integrity and crossorigin attributes. /v1/verify?url=...&integrity=sha384-... re-fetches the asset and tells you whether it still matches a known integrity string — catching silent CDN changes or supply-chain tampering. The request is made server-side; private/internal targets are refused (SSRF-guarded). Built for securing third-party scripts, supply-chain hardening, build pipelines and CSP/SRI compliance. A Subresource Integrity generator/verifier — distinct from raw cryptographic hashing of input data (hash), the HTTP security-header grader (secheaders) and the SSL/TLS certificate check (sslcheck). No key, no cache.","endpoints":["/v1/generate","/v1/verify","/v1/meta"],"max_bytes":10485760,"algorithms":["sha256","sha384","sha512"],"default_algorithm":"sha384"},"meta":{"timestamp":"2026-06-01T23:40:48.810Z","request_id":"3b85f858-0a8d-4452-bbb6-9ab39ed78d32"},"status":"ok","message":"Meta retrieved","success":true}}}},"401":{"description":"Missing or invalid x-oanor-key header"},"402":{"description":"Active subscription required"},"429":{"description":"Rate-limit or monthly quota reached"},"502":{"description":"Upstream did not respond"}}}}},"x-oanor-pricing":[{"slug":"free","name":"Free","price_cents_month":0,"monthly_call_quota":2300,"rps_limit":2,"hard_limit":true},{"slug":"starter","name":"Starter","price_cents_month":670,"monthly_call_quota":45500,"rps_limit":8,"hard_limit":true},{"slug":"pro","name":"Pro","price_cents_month":2130,"monthly_call_quota":234000,"rps_limit":20,"hard_limit":true},{"slug":"mega","name":"Mega","price_cents_month":5580,"monthly_call_quota":865000,"rps_limit":50,"hard_limit":true}],"x-oanor-marketplace-url":"https://www.oanor.com/api/sri-api"}