# Hyrule Cloud Deep TLS Scan

> Hyrule Cloud Deep TLS Scan is a paid API for AI agents from cloud.hyrule.host, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-15).

Performs a comprehensive TLS/SSL analysis of a host including protocol versions, cipher suites, certificate chain, OCSP, HSTS, CAA records, and security headers

## Facts

- Endpoint: POST https://cloud.hyrule.host/v1/web/tls/deep
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/hyrule-cloud-deep-tls-scan-29c05427
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_7_FRMkcuiAhjgoSutBwl9

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability hyrule-cloud-deep-tls-scan-29c05427 -d '<json body>'
```

Example prompt: Run a deep TLS scan on api.example.com port 443 and check the certificate chain, cipher suites, protocol versions, HSTS, and security headers — give me a full SSL Labs-style audit report.

## When to prefer this

Use this endpoint when you need a comprehensive, multi-dimensional TLS audit similar to SSL Labs — covering not just certificate validity but also cipher suites, protocol versions, HSTS enforcement, CAA DNS records, OCSP, and HTTP security headers in one call. Prefer this over simple certificate checkers when you need actionable severity-graded findings across the full TLS stack, or when preparing for security compliance reviews.

## Known failure modes

- Host unreachable or connection refused — returns error status with connectivity finding
- Invalid or expired certificate causing scan partial results — returns warning/critical findings
- Host does not support TLS at all on given port — returns critical finding
- Timeout during deep scan — may return partial:true with incomplete findings
- Invalid hostname format — request rejected with validation error
- Port out of range (0 or >65535) — schema validation failure

## How this service works

Full-stack network infrastructure for AI agents on AS215932 (RIPE): IPv6-native VMs with SSH and automatic HTTPS subdomains, domain registration and DNS, a broad network-intelligence suite (BGP/routing, IP/ASN & reputation, DNS, RDAP/WHOIS, web & deep TLS, mail deliverability, port/NAT/CGNAT, VoIP/SIP), and proxied requests over Direct/Tor/I2P/Yggdrasil. Pay per request in USDC on Base via x402; VM checkout may also accept BTC/XMR when advertised. This OpenAPI document intentionally contains only the launch-ready, independently payable agent surface.

## Output

Returns a structured diagnostic response with an overall status (ok/info/warning/critical/error), a summary string, the normalized target host, a list of findings each with a code, message, and severity level, source health metadata, a request ID, and a timestamp. Optionally includes raw scan data if requested.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "host": {
   "type": "string",
   "title": "Host",
   "maxLength": 253,
   "minLength": 1
  },
  "port": {
   "type": "integer",
   "title": "Port",
   "default": 443,
   "maximum": 65535,
   "minimum": 1
  },
  "checks": {
   "type": "array",
   "items": {
    "enum": [
     "protocol_versions",
     "cipher_suites",
     "certificate_chain",
     "ocsp",
     "hsts",
     "caa",
     "security_headers"
    ],
    "type": "string",
    "title": "WebTLSDeepCheck"
   },
   "title": "Checks"
  },
  "include_raw": {
   "type": "boolean",
   "title": "Include Raw",
   "default": false
  },
  "scan_profile": {
   "type": "string",
   "title": "Scan Profile",
   "default": "ssl_labs_style"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "status": "ok",
  "target": {
   "type": "host",
   "input": "example.com",
   "normalized": "example.com"
  },
  "partial": false,
  "sources": {},
  "summary": "Deep TLS scan completed",
  "findings": [
   {
    "code": "example",
    "message": "No issue found",
    "severity": "ok"
   }
  ],
  "request_id": "diag_a1b2c3d4",
  "generated_at": "2026-07-15T00:00:00Z"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/hyrule-cloud-deep-tls-scan-29c05427/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from cloud.hyrule.host](https://www.zero.xyz/host/cloud.hyrule.host/llms.txt)