# SiteSignal Security.txt Policy Snapshot

> SiteSignal Security.txt Policy Snapshot is a paid API for AI agents from phases-prot-shine-royal.trycloudflare.com, paid per call via x402, $0.02/call, status down (last checked 2026-09-15).

Fetches and parses a public RFC 9116 security.txt file from any URL, extracting contacts, expiry, policy, encryption, canonical, hiring, extension, HTTP, and hash evidence.

## Facts

- Endpoint: GET https://phases-prot-shine-royal.trycloudflare.com/x402/security-txt
- Price: $0.02/call
- Payment: x402
- Status: down
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitesignal-security-txt-policy-snapshot-789215b7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_XlqbHEQesTJ952BGUkKzb

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitesignal-security-txt-policy-snapshot-789215b7
```

Example prompt: Can you fetch and parse the security.txt policy for https://example.com — I want to see the security contacts, expiry date, encryption key, and any policy or hiring URLs listed there.

## When to prefer this

Use this endpoint when you need to programmatically discover responsible disclosure contacts, encryption keys, or policy details for a public website by parsing its RFC 9116 security.txt. Prefer this over manual DNS lookups or generic scrapers when you specifically need structured security policy data including expiry, contacts, and hash evidence in a single call.

## Known failure modes

- Target site does not host a security.txt file — returns empty or not-found result
- security.txt exists but is malformed or non-RFC-9116-compliant — partial parse with available fields
- URL is unreachable or returns non-200 HTTP status — fetch error with HTTP status code
- Security.txt is expired — parsed but flagged as expired policy
- Redirects or non-standard locations may cause the file to be missed

## How this service works

Discover and parse a public RFC 9116 security.txt policy into contacts, expiry, policy, encryption, canonical, hiring, extension, HTTP, and hash evidence.

## Output

A structured snapshot of the parsed security.txt file including: security contact addresses (email, URL), policy expiration timestamp, linked security policy URL, PGP encryption key or URL, canonical URL for the security.txt itself, hiring/acknowledgment URLs, any extension fields, raw HTTP response evidence, and hash verification data — all sourced and linked back to the original document.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "format": "uri"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitesignal-security-txt-policy-snapshot-789215b7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from phases-prot-shine-royal.trycloudflare.com](https://www.zero.xyz/host/phases-prot-shine-royal.trycloudflare.com/llms.txt)