# Delx Open Redirect Audit

> Delx Open Redirect Audit is a paid API for AI agents from api.delx.ai, paid per call via x402, $0.003/call, status unknown (last checked 2026-09-13).

Validates a redirect target URL against an exact hostname allowlist and returns a deterministic pass/fail JSON result

## Facts

- Endpoint: POST https://api.delx.ai/api/v1/x402/open-redirect-audit
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/delx-open-redirect-audit-062e76de
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_q1WBLXWfZk94MoFKRATW1

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability delx-open-redirect-audit-062e76de -d '<json body>'
```

Example prompt: Before we redirect the user to https://checkout.partner.com/complete, check it against our approved hostname allowlist of [checkout.partner.com, payments.acme.com] to make sure it's safe to proceed.

## When to prefer this

Choose this endpoint when you need a fast, stateless, deterministic preflight check for redirect safety inside an automated agent workflow — particularly when you have a known allowlist and need a machine-readable JSON verdict before acting. Prefer it over ad-hoc regex checks or general-purpose URL parsers when you want an auditable, reproducible security gate with no data retention and no upstream dependencies.

## Known failure modes

- Missing or malformed target URL returns a validation error
- Empty allowed_hosts array may result in automatic fail verdict
- Malformed hostname entries in allowlist may cause unexpected non-matches
- Non-URL strings passed as target may return parse errors
- Network or service errors return non-200 HTTP status

## How this service works

Check a redirect target against an exact hostname allowlist. Use it as a bounded preflight or analysis step inside an enterprise agent workflow before data, policy, integration, security, or commercial decisions reach production. Returns deterministic machine-readable JSON for $0.003 USDC via x402 on Base. Execution is first-party, local-only, stateless, memory-only, and has no paid upstream or input retention. Results are advisory; the caller remains responsible for authorization and productio…

## Output

A deterministic machine-readable JSON object indicating whether the redirect target's hostname appears in the provided allowlist, with a pass or fail verdict and relevant details about the match result. Stateless and advisory — no data is retained.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "target": {
   "type": "string",
   "description": "Input field: target."
  },
  "allowed_hosts": {
   "type": "array",
   "description": "Input field: allowed_hosts."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "schema": "delx/util-open-redirect-audit/v1",
  "allowed": false,
  "finding": "external_host_not_allowlisted",
  "target_host": "evil.example",
  "recommendation": "resolve relative paths and enforce exact host allowlist"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/delx-open-redirect-audit-062e76de/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.delx.ai](https://www.zero.xyz/host/api.delx.ai/llms.txt)