# ScrapeCheck Hash Verification

> ScrapeCheck Hash Verification is a paid API for AI agents from scrapecheck.fly.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-09-15).

Independently re-fetches a public URL twice and verifies that the served bytes match a claimed SHA-256 checksum

## Facts

- Endpoint: POST https://scrapecheck.fly.dev/verify-hash
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/scrapecheck-hash-verification-17379b6d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_0M2CVl2dMtp_38waXPEbY

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability scrapecheck-hash-verification-17379b6d -d '<json body>'
```

Example prompt: Can you verify that the file at https://releases.example.com/app-v2.1.0.tar.gz actually hashes to sha256 abc123def456...? I want to confirm the bytes served right now match what the project published.

## When to prefer this

Choose this endpoint when you need deterministic, tamper-evident confirmation that a specific public URL is currently serving bytes that match a known SHA-256 hash — for example, verifying software releases, build artifacts, or distributed files before installation or deployment. It is preferable over manual checksum tools when you need an independent double-fetch (not trusting a single download) and an auditable result. Use it when your content is static (not dynamically rendered) and under 3 MB. For verifying JSON field values, XML paths, redirects, or text presence on a page, use sibling ScrapeCheck tiers instead.

## Known failure modes

- URL is not publicly accessible or returns non-200 status — verification fails with an error
- Response body exceeds 3 MB limit — endpoint returns unverifiable status, never a guess
- Dynamic page content varies between the two fetches — returns unverifiable, not a match/no-match verdict
- URL uses a non-HTTPS scheme — rejected as invalid input
- SHA-256 hash format is malformed or uses an unsupported algorithm — request rejected
- Network timeout or transient fetch error on one or both fetches — verification fails with error

## How this service works

Checksum tier (deterministic, no LLM): verifies the exact bytes served at a public URL hash to a claimed sha256, by independent double re-fetch. Use it to confirm a download or artifact matches its published checksum. Bodies up to 3 MB; dynamic pages return unverifiable, never a guess. sha256 only. First 100 checks per client are free: resend with header X-Use-Free-Allowance: yes and no payment to use them.

## Output

A structured response indicating whether the bytes currently served at the given URL match the claimed SHA-256 hash, based on two independent fetches. Includes the actual computed hash, match status (true/false), and notes if the page is dynamic or the body exceeds the 3 MB limit (in which case verification is unverifiable rather than guessed).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "description": "public HTTPS URL"
  },
  "claim": {
   "type": "object",
   "description": "see the route description; there is no asked field - this tier adjudicates exactly what it accepts"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "engine": "web_field_v1/0.2.0+2ae28205cac4",
  "key_id": "k2",
  "reasons": [
   "the body served at the URL hashes to the claimed sha256 (64 bytes, stable across two immediate fetches)"
  ],
  "verdict": "pass",
  "evidence": {
   "lens_votes": {},
   "refetched_at": "2026-08-28T00:00:00.000Z",
   "refetch_excerpt": "sha256:92fa12e2…",
   "second_fetch_at": "2026-08-28T00:00:01.000Z"
  },
  "signature": "ed25519:…",
  "check_type": "url_hash_v1",
  "confidence": 0.95,
  "verdict_id": "00000000-0000-0000-0000-000000000000",
  "source_hash": "sha256:…",
  "verifier_url": "https://scrapecheck.fly.dev"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/scrapecheck-hash-verification-17379b6d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from scrapecheck.fly.dev](https://www.zero.xyz/host/scrapecheck.fly.dev/llms.txt)