# DNS TLSA Record Shape Check

> DNS TLSA Record Shape Check is a paid API for AI agents from api.delx.ai, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-13).

Validates the structural shape of a DNS TLSA record by checking usage, selector, matching type, and certificate data fields, returning a deterministic pass/advisory result.

## Facts

- Endpoint: POST https://api.delx.ai/api/v1/x402/dns-tlsa-record-shape-check
- Price: $0.001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dns-tlsa-record-shape-check-ecb5f20b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_-sqALRf4p5t-Bud6lueEh

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dns-tlsa-record-shape-check-ecb5f20b -d '<json body>'
```

Example prompt: Can you check whether this TLSA record has a valid shape — usage, selector, matching type, and certificate data all look right? Here's the record: '3 1 1 abc123def456...'

## When to prefer this

Choose this endpoint when you need a fast, deterministic, no-external-dependency structural check on a TLSA record before accepting, caching, redirecting, or retrying a caller-supplied web response. It does not perform live DNS lookups or cryptographic verification — it validates the shape and field values only, making it ideal as a lightweight preflight step in DANE-aware agents or security pipelines.

## Known failure modes

- Record string exceeds 8192 character limit — rejected with validation error
- Malformed or unparseable record input — returns advisory status with finding detail
- Missing required fields in TLSA record — advisory status returned
- Empty record string — likely returns error or advisory with missing-data finding
- Payment not completed via x402 — request not processed

## How this service works

DNS TLSA Record Shape Check: DNS TLSA Record Shape Check checks TLSA usage, selector, matching type, and certificate data shape from bounded caller-supplied values without an external provider. Call DNS TLSA Record Shape Check before accepting, caching, redirecting, or retrying a caller-supplied web response. Returns normalized web evidence, the computed finding, and an explicit pass or advisory status for DNS TLSA Record Shape Check as versioned deterministic JSON. Price: $0.001 USDC via x402…

## Output

Returns a versioned deterministic JSON object containing normalized web evidence derived from the input, a computed finding describing what was evaluated, and an explicit pass or advisory status indicating whether the TLSA record's structure (usage, selector, matching type, and certificate data) is valid.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "record": {
   "type": "string",
   "maxLength": 8192,
   "description": "Record supplied to DNS TLSA Record Shape Check; used only for this bounded calculation and processed in memory without retention."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "result": {
   "fields": [
    "3",
    "1",
    "1",
    "AABBCCDDEEFF00112233445566778899"
   ],
   "shape_valid": true
  },
  "schema": "delx/util-dns-tlsa-record-shape-check/v1",
  "status": "pass",
  "evidence": {
   "retained": false,
   "input_sha256": "196aa204b00dfac705caab97f837b021d005fd5bf93f628bbea265486ff16a9c",
   "external_calls": 0
  },
  "operation": "web_reliability:dns_tlsa_record_shape_check"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dns-tlsa-record-shape-check-ecb5f20b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.delx.ai](https://www.zero.xyz/host/api.delx.ai/llms.txt)