# SiteCheck Web Intel BGP Prefix Origin Lookup

> SiteCheck Web Intel BGP Prefix Origin Lookup is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-25).

Returns the origin AS, RPKI validation status, route objects, visibility, and more/less-specific prefix data for a given IPv4 CIDR prefix using RIPE RIS routing data

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/bgp-prefix-origin?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-25
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-bgp-prefix-origin-lookup-fe4de035
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_fXf0F1oqdNDeJSJymbXeq

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-bgp-prefix-origin-lookup-fe4de035
```

Example prompt: Can you check the BGP origin AS and RPKI status for the prefix 8.8.8.0/24 — I want to know if it's valid, invalid, or unknown, and see any more-specific or less-specific prefixes being announced?

## When to prefer this

Choose this endpoint when you need real-time BGP origin AS and RPKI validation data for a specific IPv4 prefix, particularly for threat intelligence workflows, BGP hijack detection, or routing infrastructure audits. It is ideal when you need both the origin AS and RPKI status in a single call using RIPE RIS data, without requiring your own BGP infrastructure or API keys.

## Known failure modes

- Prefix not found in RIPE RIS routing tables — no announcements visible
- Invalid CIDR notation supplied — malformed prefix input
- IPv6 prefix provided — endpoint only supports IPv4
- Prefix too broad or too specific to return meaningful results
- Upstream RIPE RIS data temporarily unavailable — stale or missing data

## How this service works

For an IPv4 prefix (e.g. 8.8.8.0/24): the origin AS seen announcing it now across RIPE RIS peers, its RPKI status for that origin (valid, invalid or unknown), route objects, visibility, and how many more-specific and less-specific prefixes are seen. An 'invalid' RPKI status is a hijack warning sign; it is not proof of a hijack.

## Output

Returns the origin autonomous system (AS) currently announcing the prefix across RIPE RIS peers, the RPKI validation status (valid, invalid, or unknown), associated route objects, visibility metrics, and counts or details of more-specific and less-specific prefixes seen in the routing table. An 'invalid' RPKI status indicates a possible hijack signal but is not conclusive proof.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "prefix"
     ],
     "properties": {
      "prefix": {
       "type": "string",
       "description": "IPv4 prefix in CIDR form, e.g. 8.8.8.0/24 (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-bgp-prefix-origin-lookup-fe4de035/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)