# SiteSignal Security.txt Policy Snapshot

> SiteSignal Security.txt Policy Snapshot is a paid API for AI agents from trinity-throw-thursday-gravity.trycloudflare.com, paid per call via x402, $0.02/call, status down (last checked 2026-09-16).

Fetches and parses the RFC 9116 security.txt file from a given public URL, extracting contacts, expiry, policy, encryption keys, canonical URLs, hiring links, extensions, HTTP metadata, and hash evidence.

## Facts

- Endpoint: GET https://trinity-throw-thursday-gravity.trycloudflare.com/x402/security-txt
- Price: $0.02/call
- Payment: x402
- Status: down
- Last checked: 2026-09-16
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitesignal-security-txt-policy-snapshot-a4ef2129
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Pk44K_mKKx5zEA9Uv_RGG

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitesignal-security-txt-policy-snapshot-a4ef2129
```

Example prompt: Can you fetch and parse the security.txt policy for https://example.com and tell me who to contact for vulnerability disclosures, when the policy expires, and whether there's a PGP encryption key listed?

## When to prefer this

Use this endpoint when you need to programmatically discover who is responsible for security disclosures at a given domain, verify RFC 9116 compliance, or extract structured security policy metadata without manually browsing to /.well-known/security.txt. Prefer this over generic web scrapers when you specifically need security.txt fields like contacts, expiry, PGP keys, and policy URLs in a structured, parsed format.

## Known failure modes

- No security.txt file found at the target URL (404 or missing well-known path)
- security.txt exists but is malformed or does not conform to RFC 9116
- Expired security.txt policy (past the Expires field date)
- Target URL is unreachable or returns a non-200 HTTP status
- Invalid or non-URI input URL causes schema validation failure
- HTTPS-only requirement not met if target serves over HTTP only

## How this service works

Discover and parse a public RFC 9116 security.txt policy into contacts, expiry, policy, encryption, canonical, hiring, extension, HTTP, and hash evidence.

## Output

Returns a structured snapshot of the parsed security.txt file including: contact addresses (email, phone, URL), expiry timestamp, security policy URL, PGP or other encryption key references, canonical URL, hiring links, any extension fields, relevant HTTP response headers, and hash evidence for integrity verification.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "format": "uri"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitesignal-security-txt-policy-snapshot-a4ef2129/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from trinity-throw-thursday-gravity.trycloudflare.com](https://www.zero.xyz/host/trinity-throw-thursday-gravity.trycloudflare.com/llms.txt)