# Redirect Callback Validator

> Redirect Callback Validator is a paid API for AI agents from phion.systems, paid per call via x402, $0.002/call, status unknown (last checked 2026-09-14).

Validates HTTPS callback and redirect destination URLs against an explicit host allowlist to prevent open redirect and SSRF attacks

## Facts

- Endpoint: POST https://phion.systems/v1/paid/trust/redirect-callback-validator
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/redirect-callback-validator-4b7ed8a5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_O8yrglrpWanjk6LM_Vzsq

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability redirect-callback-validator-4b7ed8a5 -d '<json body>'
```

Example prompt: Before following this redirect to https://payments.example.com/callback, check it against my approved host allowlist — [payments.example.com, api.myapp.io] — and confirm it's safe to proceed.

## When to prefer this

Use this endpoint when an agent or automated workflow must follow a redirect or invoke a callback URL and needs a signed, auditable decision that the destination is authorized — especially in OAuth flows, payment callbacks, webhook dispatching, or any scenario where an attacker could manipulate the redirect target to cause open redirect or SSRF attacks. Prefer this over ad-hoc string matching when you need an explicit allowlist enforcement record.

## Known failure modes

- URL not on allowlist — returns rejection with the offending host
- Malformed or non-HTTPS URL — returns validation error
- Empty or missing allowlist — returns policy configuration error
- Subdomain mismatch when exact-host matching is enforced — returns rejection
- Network timeout or service unavailability — returns 5xx error

## How this service works

Validate HTTPS callback and redirect destinations against an explicit host allowlist

## Output

A validation decision indicating whether the callback or redirect destination URL matches an entry on the provided host allowlist, including which host was checked, whether it was approved or rejected, and any policy violations detected.

## Request schema (JSON Schema)

```json
{
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "type": "object"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/redirect-callback-validator-4b7ed8a5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from phion.systems](https://www.zero.xyz/host/phion.systems/llms.txt)