Netzwerkzeug Diagnostic API

Read-only, same-origin network diagnostics. Canonical endpoint: https://www.netzwerkzeug.ch/api/v1/ (POST JSON). Full API reference · OpenAPI 3.0 specification.

Contract

v1 uses POST JSON objects, strict field validation, no CORS, no-store responses, and the envelope {"ok":true,"data":{},"error":null}. No authentication is required. Only versioned v1 routes are public.

Actions

Action	Required	Optional	Purpose
`dns`	domain	—	A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV records
`reverse`	ip	—	PTR lookup
`http`	url	—	Validated HTTP/HTTPS metadata and redirects
`tls`	host	port (default 443)	Verified TLS certificate inspection
`port`	query	—	Allow-listed service/port mapping
`mac`	mac	—	MAC/OUI normalization and bundled vendor lookup
`mail`	domain	selector	MX, SPF, DMARC, MTA-STS, TLS-RPT and optional DKIM checks
`dnssec`	domain	—	Informational DS/DNSKEY presence

Limits and security

4096-byte query string; 2048-byte parameter; 1 MiB response.
Expensive actions: 5 per 10 seconds and 30 per 60 seconds per client IP. Other actions: 10 per 10 seconds and 60 per 60 seconds.
Maximum four concurrent expensive operations; HTTP 429 responses include Retry-After.
HTTP probes use 5-second connect and 10-second total timeouts, revalidate every redirect, and block private, reserved, loopback, local, and metadata targets.
No CORS headers; inputs are not intentionally persisted.

Examples

POST /api/v1/dns/   {"domain":"example.com"}
POST /api/v1/http-headers/   {"url":"https://example.com/"}
POST /api/v1/tls/   {"host":"example.com"}

Errors

Implemented codes: INVALID_INPUT, METHOD_NOT_ALLOWED, REQUEST_TOO_LARGE, RESPONSE_TOO_LARGE, RATE_LIMITED, and INTERNAL_ERROR.

Full source documentation is maintained in docs/API.md.