tags, and pass a seed for a repeatable sample. Pure generation; nothing is stored.", "tags": [ "Text" ], "parameters": [ { "name": "paragraphs", "in": "query", "required": false, "description": "How many paragraphs (1\u201320). Wins over sentences/words if several are set.", "schema": { "type": "integer" }, "example": "3" }, { "name": "sentences", "in": "query", "required": false, "description": "How many sentences (1\u2013100)", "schema": { "type": "integer" }, "example": "8" }, { "name": "words", "in": "query", "required": false, "description": "How many words (1\u2013500)", "schema": { "type": "integer" }, "example": "50" }, { "name": "start", "in": "query", "required": false, "description": "Begin with classic Lorem ipsum\u2026 (default true)", "schema": { "type": "boolean", "default": true } }, { "name": "html", "in": "query", "required": false, "description": "Also return an html field with
wrappers",
"schema": {
"type": "boolean",
"default": false
}
},
{
"name": "seed",
"in": "query",
"required": false,
"description": "Repeatable sample (integer or short string)",
"schema": {
"type": "string"
},
"example": "42"
}
],
"responses": {
"200": {
"description": "JSON result"
},
"400": {
"$ref": "#/components/responses/Error"
},
"429": {
"$ref": "#/components/responses/Limited"
}
}
}
},
"/v1/qr.svg": {
"get": {
"summary": "QR code as SVG (usable as an )",
"description": "Encode text into a QR code and return image/svg+xml. Same generator as Tooltern's /api/qr and /qr-code page. Text travels in the URL \u2014 don't put secrets here. Nothing is stored or logged.",
"tags": [
"Design"
],
"parameters": [
{
"name": "text",
"in": "query",
"required": true,
"description": "Payload to encode (URL or text), up to 1200 UTF-8 bytes",
"schema": {
"type": "string"
},
"example": "hello"
},
{
"name": "ec",
"in": "query",
"required": false,
"description": "Error correction: L\u22487%, M\u224815%, Q\u224825%, H\u224830%",
"schema": {
"type": "string",
"enum": [
"L",
"M",
"Q",
"H"
]
}
},
{
"name": "border",
"in": "query",
"required": false,
"description": "Quiet-zone modules, 1\u20138",
"schema": {
"type": "integer",
"default": 2
}
},
{
"name": "box",
"in": "query",
"required": false,
"description": "Module size 1\u201320 (affects SVG millimetre scale)",
"schema": {
"type": "integer",
"default": 10
}
},
{
"name": "fg",
"in": "query",
"required": false,
"description": "Dark-module hex colour like 000000 or #1f6f5c",
"schema": {
"type": "string"
},
"example": "000000"
},
{
"name": "bg",
"in": "query",
"required": false,
"description": "Light-module / background hex colour",
"schema": {
"type": "string"
},
"example": "ffffff"
}
],
"responses": {
"200": {
"description": "SVG image (image/svg+xml)"
},
"400": {
"$ref": "#/components/responses/Error"
},
"429": {
"$ref": "#/components/responses/Limited"
}
}
}
},
"/v1/qr": {
"get": {
"summary": "QR code as JSON wrapping the SVG string",
"description": "Same QR as /v1/qr.svg, but the SVG is a string inside JSON \u2014 handy for scripts that already speak JSON. Prefer /v1/qr.svg when you can use it as an image URL.",
"tags": [
"Design"
],
"parameters": [
{
"name": "text",
"in": "query",
"required": true,
"description": "Payload to encode (URL or text), up to 1200 UTF-8 bytes",
"schema": {
"type": "string"
},
"example": "hello"
},
{
"name": "ec",
"in": "query",
"required": false,
"description": "Error correction: L\u22487%, M\u224815%, Q\u224825%, H\u224830%",
"schema": {
"type": "string",
"enum": [
"L",
"M",
"Q",
"H"
]
}
},
{
"name": "border",
"in": "query",
"required": false,
"description": "Quiet-zone modules, 1\u20138",
"schema": {
"type": "integer",
"default": 2
}
},
{
"name": "box",
"in": "query",
"required": false,
"description": "Module size 1\u201320 (affects SVG millimetre scale)",
"schema": {
"type": "integer",
"default": 10
}
},
{
"name": "fg",
"in": "query",
"required": false,
"description": "Dark-module hex colour like 000000 or #1f6f5c",
"schema": {
"type": "string"
},
"example": "000000"
},
{
"name": "bg",
"in": "query",
"required": false,
"description": "Light-module / background hex colour",
"schema": {
"type": "string"
},
"example": "ffffff"
}
],
"responses": {
"200": {
"description": "JSON result"
},
"400": {
"$ref": "#/components/responses/Error"
},
"429": {
"$ref": "#/components/responses/Limited"
}
}
}
},
"/v1/hash": {
"get": {
"summary": "Hash a short text (MD5, SHA-1, SHA-2, SHA-3, BLAKE2b)",
"description": "Text travels in the URL, so don't hash secrets here. Use Tooltern's in-browser hash tool for anything private.",
"tags": [
"Text"
],
"parameters": [
{
"name": "text",
"in": "query",
"required": true,
"description": "Up to 4 KB of UTF-8 text",
"schema": {
"type": "string"
},
"example": "hello"
},
{
"name": "algo",
"in": "query",
"required": false,
"description": "Algorithm or 'all'",
"schema": {
"type": "string",
"enum": [
"md5",
"sha1",
"sha256",
"sha384",
"sha512",
"sha3-256",
"blake2b",
"all"
],
"default": "sha256"
}
}
],
"responses": {
"200": {
"description": "JSON result"
},
"400": {
"$ref": "#/components/responses/Error"
},
"429": {
"$ref": "#/components/responses/Limited"
}
}
}
},
"/v1/slug": {
"get": {
"summary": "Turn a title into a clean URL slug",
"description": "Accents are folded to plain letters (\u00e9 \u2192 e), apostrophes dropped, everything else that isn't a letter or digit becomes the separator.",
"tags": [
"Text"
],
"parameters": [
{
"name": "text",
"in": "query",
"required": true,
"description": "Up to 4 KB",
"schema": {
"type": "string"
},
"example": "H\u00e9llo, World\u2019s Best Caf\u00e9!"
},
{
"name": "sep",
"in": "query",
"required": false,
"description": "Separator: - or _",
"schema": {
"type": "string",
"enum": [
"-",
"_"
],
"default": "-"
}
},
{
"name": "max",
"in": "query",
"required": false,
"description": "Max length 1\u2013200",
"schema": {
"type": "integer",
"default": 80
}
}
],
"responses": {
"200": {
"description": "JSON result"
},
"400": {
"$ref": "#/components/responses/Error"
},
"429": {
"$ref": "#/components/responses/Limited"
}
}
}
},
"/v1/color": {
"get": {
"summary": "Colour formats (hex, RGB, HSL, OKLCH) and WCAG contrast",
"description": "Contrast uses the WCAG 2 relative-luminance formula; AA needs 4.5:1 for body text and 3:1 for large text, AAA needs 7:1 and 4.5:1.",
"tags": [
"Design"
],
"parameters": [
{
"name": "hex",
"in": "query",
"required": true,
"description": "Colour like 1f6f5c or #fff (encode # as %23)",
"schema": {
"type": "string"
},
"example": "1f6f5c"
},
{
"name": "against",
"in": "query",
"required": false,
"description": "Second colour for a contrast check",
"schema": {
"type": "string"
},
"example": "ffffff"
}
],
"responses": {
"200": {
"description": "JSON result"
},
"400": {
"$ref": "#/components/responses/Error"
},
"429": {
"$ref": "#/components/responses/Limited"
}
}
}
},
"/v1/http-status": {
"get": {
"summary": "Look up any HTTP status code: meaning, causes, fixes and retry advice",
"description": "Covers every registered code plus the non-standard ones people actually meet (nginx 444/499 and Cloudflare 520\u2013526). Prefer GET /v1/http-status/404 or ?code=404. Each answer includes phrase, category, plain summary, when_you_see_it, what_to_do, related codes, retry advice and default cacheability.",
"tags": [
"Web"
],
"parameters": [
{
"name": "code",
"in": "query",
"required": false,
"description": "A code like 404, a class like 5xx, or words from a name like 'too many'. Leave out for the full list. Path form /v1/http-status/{code} also works.",
"schema": {
"type": "string"
},
"example": "429"
}
],
"responses": {
"200": {
"description": "JSON result"
},
"400": {
"$ref": "#/components/responses/Error"
},
"429": {
"$ref": "#/components/responses/Limited"
}
}
}
},
"/v1/url/inspect": {
"get": {
"summary": "Link X-ray: who really owns a link, and its warning signs",
"description": "Finds the registrable domain (the real owner) with the full Public Suffix List, decodes international names, and lists warning signs with a severity: @ tricks, disguised IP addresses, look-alike letters from other alphabets, digits for letters, official words dressed up in front, redirect parameters, double file endings and more. Pure text analysis: the link is never fetched, resolved or stored.",
"tags": [
"Web"
],
"parameters": [
{
"name": "url",
"in": "query",
"required": true,
"description": "The link to inspect, up to 2 KB. It is never opened.",
"schema": {
"type": "string"
},
"example": "http://paypal.com.secure-login.top/verify?next=https://example.net/"
}
],
"responses": {
"200": {
"description": "JSON result"
},
"400": {
"$ref": "#/components/responses/Error"
},
"429": {
"$ref": "#/components/responses/Limited"
}
}
}
},
"/v1/cookie/parse": {
"get": {
"summary": "Set-Cookie explainer: will the browser accept this cookie, and why not?",
"description": "Reads Set-Cookie headers the way current browsers do (RFC 6265bis): every attribute explained in plain words, a verdict per cookie (accepted, rejected, deletes, or valid when no url is given), and each reason with a severity. Checks SameSite=None without Secure, Secure from http, Domain that doesn't cover the site or is a public suffix (full Public Suffix List), __Host- and __Secure- prefixes, 4096-byte size, Max-Age vs Expires, the 400-day cap, the default-path trap and session cookies missing HttpOnly. Pure text analysis: nothing is fetched or stored.",
"tags": [
"Web"
],
"parameters": [
{
"name": "header",
"in": "query",
"required": false,
"description": "One or more Set-Cookie header values, one per line (up to 30 lines, 8 KB). 'Set-Cookie:' in front is fine.",
"schema": {
"type": "string"
},
"example": "sid=abc123; Path=/; HttpOnly; SameSite=None"
},
{
"name": "url",
"in": "query",
"required": false,
"description": "The page or API address that sent the header, so Domain, Secure and the default Path can be checked",
"schema": {
"type": "string"
},
"example": "https://shop.example.co.uk/account/login"
},
{
"name": "cookie",
"in": "query",
"required": false,
"description": "Instead of header: a Cookie request header to split up and check for duplicates and size",
"schema": {
"type": "string"
},
"example": "sid=abc; theme=dark; sid=old"
}
],
"responses": {
"200": {
"description": "JSON result"
},
"400": {
"$ref": "#/components/responses/Error"
},
"429": {
"$ref": "#/components/responses/Limited"
}
}
}
},
"/v1/csp/parse": {
"get": {
"summary": "CSP header explainer: grade a Content-Security-Policy and check what it blocks",
"description": "Reads a Content-Security-Policy the way current browsers do: every directive explained in plain words, a grade (strong / okay / weak), findings with severity (unquoted keywords, missing semicolons, 'unsafe-inline', wildcards, missing object-src / base-uri / frame-ancestors, meta-tag traps), and an optional check that applies the fallback chains (script-src-elem \u2192 script-src \u2192 default-src, worker-src \u2192 child-src \u2192 \u2026) plus nonce/hash/'strict-dynamic' rules. Pure text analysis: nothing is fetched or stored. Pass hash= to get 'sha256-\u2026' / 'sha384-\u2026' sources for an inline snippet.",
"tags": [
"Web"
],
"parameters": [
{
"name": "header",
"in": "query",
"required": false,
"description": "A Content-Security-Policy value, a header dump (with or without the name), or a tag. Up to 8 KB.",
"schema": {
"type": "string"
},
"example": "default-src 'self'; script-src 'self' 'nonce-r4nd0m'; object-src 'none'; base-uri 'none'"
},
{
"name": "page",
"in": "query",
"required": false,
"description": "Document URL used by the optional check simulator (scheme+host+port)",
"schema": {
"type": "string"
},
"example": "https://app.example.com/"
},
{
"name": "check",
"in": "query",
"required": false,
"description": "Optional action to test: script, inline-script, attr, eval, style, inline-style, style-attr, img, font, connect, frame, media, worker, object, form, base, ancestor",
"schema": {
"type": "string"
},
"example": "script"
},
{
"name": "url",
"in": "query",
"required": false,
"description": "Resource / form / ancestor URL for the check (not needed for eval or inline kinds)",
"schema": {
"type": "string"
},
"example": "https://cdn.example.net/lib.js"
},
{
"name": "nonce",
"in": "query",
"required": false,
"description": "Nonce value to try against 'nonce-\u2026' sources (no quotes)",
"schema": {
"type": "string"
},
"example": "r4nd0m"
},
{
"name": "code",
"in": "query",
"required": false,
"description": "Inline script/style/attribute text for hash matching",
"schema": {
"type": "string"
},
"example": "startApp()"
},
{
"name": "hash",
"in": "query",
"required": false,
"description": "Optional: compute 'sha256-\u2026' and 'sha384-\u2026' sources for this exact text (up to 4 KB)",
"schema": {
"type": "string"
},
"example": "startApp()"
}
],
"responses": {
"200": {
"description": "JSON result"
},
"400": {
"$ref": "#/components/responses/Error"
},
"429": {
"$ref": "#/components/responses/Limited"
}
}
}
},
"/v1/frame/check": {
"get": {
"summary": "Clickjacking headers: who may embed this page in a frame?",
"description": "Reads X-Frame-Options and CSP frame-ancestors the way current browsers do: every value explained in plain words, a grade (protected / okay / needs_work), findings (missing defence, ALLOW-FROM ignored, meta frame-ancestors ignored, broad *, CSP overrides XFO), and an optional check that answers whether a given parent may embed the page. Modern rule: when both headers are present, frame-ancestors wins. Pure text analysis: nothing is fetched or stored.",
"tags": [
"Web"
],
"parameters": [
{
"name": "header",
"in": "query",
"required": false,
"description": "X-Frame-Options and/or a CSP with frame-ancestors, a header dump, or a tag. Up to 8 KB.",
"schema": {
"type": "string"
},
"example": "X-Frame-Options: SAMEORIGIN\nContent-Security-Policy: frame-ancestors 'self' https://pay.example"
},
{
"name": "page",
"in": "query",
"required": false,
"description": "The page being framed (scheme+host+port). Needed for SAMEORIGIN / 'self' and for parent checks.",
"schema": {
"type": "string"
},
"example": "https://app.example.com/account"
},
{
"name": "parent",
"in": "query",
"required": false,
"description": "Optional parent / ancestor URL to simulate (omit with parent_kind=null for an opaque origin)",
"schema": {
"type": "string"
},
"example": "https://evil.example/"
},
{
"name": "parent_kind",
"in": "query",
"required": false,
"description": "Optional shortcut instead of parent: same, example, evil, sub, null, sandbox, url",
"schema": {
"type": "string"
},
"example": "evil"
}
],
"responses": {
"200": {
"description": "JSON result"
},
"400": {
"$ref": "#/components/responses/Error"
},
"429": {
"$ref": "#/components/responses/Limited"
}
}
}
},
"/v1/text/inspect": {
"get": {
"summary": "Text X-ray: code points, graphemes, UTF-8/16 lengths and invisible characters",
"description": "X-rays a short string the way Unicode sees it: grapheme clusters vs code points vs UTF-8 bytes vs JavaScript string.length (UTF-16 units), every character named and labelled (emoji, zero-width joiner, skin tone, flag letter, control\u2026), and findings for bidirectional overrides, invisible characters, look-alike letters from other alphabets, mixed scripts and characters that need 4-byte UTF-8. Optional form= returns a normalised copy; mojibake=1 previews the classic Windows-1252 misread. Pure text analysis: nothing is fetched or stored.",
"tags": [
"Web"
],
"parameters": [
{
"name": "text",
"in": "query",
"required": true,
"description": "The string to inspect, up to 4 KB of UTF-8. Never stored.",
"schema": {
"type": "string"
},
"example": "\ud83d\udc68\u200d\ud83d\udc69\u200d\ud83d\udc67 caf\u00e9"
},
{
"name": "form",
"in": "query",
"required": false,
"description": "Optional normalisation to return: nfc, nfd, nfkc or nfkd",
"schema": {
"type": "string"
},
"example": "nfc"
},
{
"name": "mojibake",
"in": "query",
"required": false,
"description": "If true, also show the UTF-8 bytes misread as Windows-1252",
"schema": {
"type": "boolean",
"default": false
}
}
],
"responses": {
"200": {
"description": "JSON result"
},
"400": {
"$ref": "#/components/responses/Error"
},
"429": {
"$ref": "#/components/responses/Limited"
}
}
}
},
"/v1/status": {
"get": {
"summary": "Is this API healthy? Version, uptime and today's request count",
"description": "",
"tags": [
"Meta"
],
"parameters": [],
"responses": {
"200": {
"description": "JSON result"
},
"400": {
"$ref": "#/components/responses/Error"
},
"429": {
"$ref": "#/components/responses/Limited"
}
}
}
},
"/v1/http-status/{code}": {
"get": {
"summary": "Look up one HTTP status code by path",
"description": "Same payload as GET /v1/http-status?code={code}. Prefer this form when the code is a path segment.",
"tags": [
"Web"
],
"parameters": [
{
"name": "code",
"in": "path",
"required": true,
"description": "A code like 404, a class like 5xx, or words from a name like teapot.",
"schema": {
"type": "string"
},
"example": "404"
}
],
"responses": {
"200": {
"description": "JSON result"
},
"400": {
"$ref": "#/components/responses/Error"
},
"429": {
"$ref": "#/components/responses/Limited"
}
}
}
}
},
"components": {
"responses": {
"Error": {
"description": "Bad request",
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/Error"
}
}
}
},
"Limited": {
"description": "Rate limited; see Retry-After"
}
},
"schemas": {
"Error": {
"type": "object",
"properties": {
"error": {
"type": "object",
"properties": {
"code": {
"type": "string"
},
"message": {
"type": "string"
}
}
}
}
}
}
}
}