# RPKI Validity Checker — 2s.io

> RPKI Validity Checker — 2s.io is a paid API for AI agents from 2s.io, paid per call via x402, $0.00144/call, status unknown (last checked 2026-09-15).

Validates whether a given BGP origin AS is authorized to announce a specific IP prefix using RPKI Route Origin Authorizations (ROAs), and signals potential hijack risk.

## Facts

- Endpoint: GET https://2s.io/api/net/rpki-validity
- Price: $0.00144/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/rpki-validity-checker-2s-io-e885a65f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_xyXof6IwRywcfV34CKruG

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability rpki-validity-checker-2s-io-e885a65f
```

Example prompt: Check if AS15169 is RPKI-authorized to originate the prefix 8.8.8.0/24, and tell me whether there's a hijack signal.

## When to prefer this

Use this endpoint when you need ground-truth RPKI validation for a specific BGP origin ASN and IP prefix pair, especially to detect potential route hijacks or unauthorized announcements. Prefer this over manual RIPEstat queries when automating network security checks, BGP monitoring, or IP reputation pipelines. It is particularly useful for security tooling that needs to verify whether observed BGP routes are covered by valid ROAs.

## Known failure modes

- Missing required 'asn' or 'prefix' query parameter returns an error
- Malformed CIDR prefix (e.g. missing mask) causes a parse error
- ASN provided without 'AS' prefix may be rejected depending on format handling
- Prefix not found in RPKI data returns status 'not-found' rather than an error
- Payment failure (insufficient USDC) returns HTTP 402
- RIPEstat upstream unavailability may cause delayed or failed response

## How this service works

RPKI Route Origin Validation for a (BGP origin AS, prefix) pair — answers whether an AS is legitimately authorized to originate a prefix. Pass asn (e.g. AS15169) and prefix (CIDR, e.g. 8.8.8.0/24). Returns status (valid = a ROA authorizes it; invalid = a ROA exists but does NOT authorize this origin — a possible hijack/route-leak that RPKI-enforcing networks will drop; unknown = no covering ROA), a hijackSignal boolean, the validating ROAs (origin, prefix, maxLength), and a plain-English description. Live RIR/RPKI data via RIPEstat (keyless) — un-derivable by an LLM. The core BGP-security check; complements net.asn.

## Output

Returns a JSON object with an array of RPKI validation results for the queried ASN and prefix, including: validity status (valid/invalid/not-found), a human-readable description, a boolean hijack signal, and an array of validating ROAs showing origin ASN, prefix, validity, and max prefix length. Also includes the total count and data source attribution from RIPE NCC RIPEstat.

## Example request

```json
{
 "input": {
  "type": "http",
  "method": "GET",
  "queryParams": {
   "asn": "AS15169",
   "prefix": "8.8.8.0/24"
  }
 }
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "required": [
      "asn",
      "prefix"
     ],
     "properties": {
      "asn": {
       "type": "string",
       "description": "Origin AS number (AS15169 or 15169)."
      },
      "prefix": {
       "type": "string",
       "description": "CIDR prefix, e.g. 8.8.8.0/24."
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "schema": {
  "type": "object",
  "properties": {
   "ok": {
    "type": "boolean"
   },
   "items": {
    "type": "array",
    "items": {
     "type": "object",
     "properties": {
      "asn": {
       "type": "integer"
      },
      "prefix": {
       "type": "string"
      },
      "status": {
       "type": "string"
      },
      "description": {
       "type": "string"
      },
      "hijackSignal": {
       "type": "boolean"
      },
      "validatingRoas": {
       "type": "array",
       "items": {
        "type": "object",
        "properties": {
         "origin": {
          "type": "integer"
         },
         "prefix": {
          "type": "string"
         },
         "validity": {
          "type": "string"
         },
         "maxLength": {
          "type": "integer"
         }
        }
       }
      }
     }
    }
   },
   "total": {
    "type": "integer"
   },
   "source": {
    "type": "object",
    "properties": {
     "url": {
      "type": "string"
     },
     "license": {
      "type": "string"
     },
     "provider": {
      "type": "string"
     }
    }
   }
  }
 },
 "example": {
  "ok": true,
  "items": [
   {
    "asn": 15169,
    "prefix": "8.8.8.0/24",
    "status": "valid",
    "description": "A valid ROA authorizes this AS to originate this prefix.",
    "hijackSignal": false,
    "validatingRoas": [
     {
      "origin": 15169,
      "prefix": "8.8.8.0/24",
      "validity": "valid",
      "maxLength": 24
     }
    ]
   }
  ],
  "total": 1,
  "source": {
   "url": "https://stat.ripe.net/docs/data_api",
   "license": "RIPEstat data is free to use (RIPE NCC).",
   "provider": "RIPE NCC — RIPEstat RPKI Validation"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/rpki-validity-checker-2s-io-e885a65f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)