Public API reference
Free Tools API for agents
Use 17 public, no-auth operations for DNS, domain-registration, HTTP, and TLS inspection. The generated catalog keeps operation metadata and response references in a compact agent-readable form.
Published and last reviewed by Approximated. Derived from OpenAPI version 2026-08-05.
Calling the API
The production server is https://cloud.approximated.app. Each operation uses GET, query-string parameters, and no API key. Encode user-supplied values as query parameters.
DNS records
curl --get 'https://cloud.approximated.app/api/tools/dns-records' \
--data-urlencode 'domain=example.com' \
--data-urlencode 'types=a,aaaa,mx'Website status
curl --get 'https://cloud.approximated.app/api/tools/status' \
--data-urlencode 'url=https://example.com/'Interpret responses before acting
- HTTP
200does not always mean the inspected target succeeded. Status, header, and redirect operations can return blocks or transport failures indata.error. - DNS propagation contains per-resolver failures inside a successful response.
consistentcompares successful resolvers, and is currently true even when zero resolvers succeed. - Subdomain discovery can return an empty, partial result with
data.error. Treattruncatedanderroras result-quality signals. - For SPF, DMARC, and DKIM, no record is a successful negative result rather than an HTTP error.
- In a multi-TLD availability result,
available: nullcan mean either an unsupported TLD or an RDAP network failure; the API does not distinguish the cause. A 502 applies only to single-domain lookup. - In DNS-record lookup, an individual resolver failure degrades that record type to an empty array inside HTTP 200. Only failure of every requested type returns 502, so an empty per-type answer is not conclusive by itself.
Rate limits and retries
Except for ping, requests are limited per IP by three buckets: 500 per day across Free Tools, 30 per minute across Free Tools, and 10 per minute for each tool. A denial returns HTTP 429, a body with error: "rate_limited" and scope tool, global, or daily, plus Retry-After seconds. Wait that many seconds before retrying. The ping operation is intentionally not rate-limited.
Safety boundaries
HTTP status, header, and redirect checks represent SSRF blocks in-band; every redirect hop is checked. TLS inspection reports private or unresolvable hosts as invalid input. Do not reinterpret those blocked results as proof that a target is down.
Operations
This table is generated from the same OpenAPI operations as the catalog. Consult each catalog record for full URLs, parameter schemas, response semantics, and schema references.
| Operation ID | Path | Query parameters | Summary |
|---|---|---|---|
| checkDkimRecord | /api/tools/dkim |
domain (required), selector (required) | Parse a DKIM selector record |
| checkDmarcRecord | /api/tools/dmarc |
domain (required) | Parse a domain's DMARC record |
| checkDnsPropagation | /api/tools/propagation |
domain (required) | Compare A records across public resolvers |
| checkDomainAvailability | /api/tools/availability |
domain (required), tlds | Check one domain or a base label across TLDs |
| checkSpfRecord | /api/tools/spf |
domain (required) | Parse a domain's SPF record |
| checkWebsiteStatus | /api/tools/status |
url (required) | Check an HTTP URL without following redirects |
| findSubdomains | /api/tools/subdomains |
domain (required) | Find subdomains from certificate transparency |
| getDomainAge | /api/tools/domain-age |
domain (required) | Calculate domain age from RDAP |
| inspectHttpHeaders | /api/tools/headers |
url (required) | Inspect response and security headers |
| inspectRedirectChain | /api/tools/redirects |
url (required) | Follow and inspect an HTTP redirect chain |
| inspectTlsCertificate | /api/tools/ssl |
host (required), port | Inspect a host's leaf TLS certificate |
| lookupCname | /api/tools/cname |
domain (required), target | Resolve a CNAME chain and optionally generate setup instructions |
| lookupDnsRecords | /api/tools/dns-records |
domain (required), types | Look up multiple DNS record types |
| lookupDomainRegistration | /api/tools/whois |
domain (required) | Look up domain registration using RDAP |
| lookupTxtRecords | /api/tools/txt |
domain (required) | Look up and categorize TXT records |
| pingFreeTools | /api/tools/ping |
none | Check free-tools API availability |
| reverseIpLookup | /api/tools/reverse-ip |
ip (required) | Perform a PTR lookup |
Sources and scope
The OpenAPI contract is authoritative for endpoints and schemas. catalog.json is deterministically generated from its Free Tools tag and does not replace it. The interactive pages provide human-facing interfaces to the same tool family.