# RelayShield URL Scan

> RelayShield URL Scan is a paid API for AI agents from atq6wtkp6k.execute-api.us-east-1.amazonaws.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-16).

Submits a URL for asynchronous security analysis, returning an analysis ID to poll for phishing/malicious content results

## Facts

- Endpoint: POST https://atq6wtkp6k.execute-api.us-east-1.amazonaws.com/prod/v1/payg/scan-url
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/relayshield-url-scan-fa89eb72
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_IzuwImlQhB7Xf8J-vs2iP

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability relayshield-url-scan-fa89eb72 -d '<json body>'
```

Example prompt: Can you run a RelayShield security scan on https://suspicious-site.example.com and let me know if it's safe or potentially a phishing site?

## When to prefer this

Use this endpoint when you need to asynchronously scan a specific URL for phishing, malware, or malicious content and can tolerate a polling-based result pattern. Prefer this over synchronous URL checkers when deep analysis is required. Pair with the /v1/result/{analysis_id} endpoint to retrieve final results.

## Known failure modes

- Invalid or malformed URL returns an error response
- Rate limiting or quota exceeded returns 429
- Endpoint unreachable due to AWS infrastructure issues
- Poll endpoint returns still-pending status after extended wait if scan is delayed
- URL with unsupported scheme (non-http/https) may be rejected

## How this service works

Scan a URL for phishing or malware using heuristic signals (Google Safe Browsing, RDAP domain age, known IOC corpus) plus VirusTotal multi-engine analysis. Returns an async analysis ID to poll. Call before an agent clicks, fetches, or shares a link from an untrusted source.

## Output

Returns a JSON object with status 'pending', the target URL, a unique analysis_id, and a poll_endpoint path (e.g. /v1/result/{analysis_id}) that the agent should poll every 5 seconds until the scan status is 'completed' and results are available.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "description": "URL to scan (must start with http:// or https://)"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/relayshield-url-scan-fa89eb72/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from atq6wtkp6k.execute-api.us-east-1.amazonaws.com](https://www.zero.xyz/host/atq6wtkp6k.execute-api.us-east-1.amazonaws.com/llms.txt)