Skip to content

Check API

For agents, not for people

One POST request returns what is wrong on a live host in plain words: the TLS handshake result, missing or weakened security headers, cookie flags, server version disclosure and conventionally exposed admin, debug and environment paths. Nothing is installed and there is no SDK to wire up. The same check is also available as an MCP tool if your agent already speaks MCP; both share one rate budget.

Endpoint

POST https://rheono.dev/api/check-app

No API key. Body: JSON with one field, url.

Call it

curl -sS -X POST https://rheono.dev/api/check-app \
  -H 'content-type: application/json' \
  -d '{"url": "https://app.example.com"}'

A check answers in a few seconds and probes nothing that changes state. Only send a domain you own or are authorized to test.

The response

  • url

    The URL that was checked.

  • status

    HTTP status the host answered the page request with, or null.

  • tls

    What the TLS handshake gave back: valid, expired, hostname-mismatch, self-signed, untrusted, absent or unknown.

  • findings

    What is exposed right now, each with an id, a severity (high, medium, low, info), a title and a detail line.

  • checkedPaths

    The conventional paths the check looked at (admin, debug and environment paths).

  • summary

    The same findings in plain words, one paragraph.

Errors

  • 400

    The body has no usable host in url. Fix the input and retry.

  • 429

    Too many checks from one client this minute. Retry-After says how long to wait.

  • 500

    The check did not finish. Retry shortly.

What a run touches

A check is plain web requests to the host you name: a TLS handshake, a request for the page, a handful of conventional paths, and the header data that comes back. No logins, no payloads, no port scan. Private, loopback and cloud-metadata addresses are refused, so the server cannot be turned into a probe of your own network. The same scan policy and opt-out apply whether the check was started by an agent or by a person.

Beyond the shallow pass

This endpoint is the first look. A full engagement runs a deeper read-only probe, at about one request per second, and the report arrives by email. Start from the pentest page or the free check.

Questions or a broken connection: sales@rheono.dev.