{
  "openapi": "3.1.0",
  "info": {
    "title": "Malware & Phishing URL Scanner API",
    "version": "v0.0.2",
    "description": "Check URLs, IPs, domains and hashes with local heuristics, optional VirusTotal, WHOIS and TLS inspection.",
    "x-pricing-model": "payg",
    "x-free-tier-calls": 0,
    "x-docs-url": "",
    "x-dakidarts-contract-status": "published",
    "x-dakidarts-execution-status": "source-only"
  },
  "servers": [
    {
      "url": "https://api.dakidarts.com/malware-url-scanner",
      "description": "Dakidarts direct gateway"
    }
  ],
  "tags": [
    {
      "name": "Operations",
      "description": "Operations endpoints sourced from the Malware & Phishing URL Scanner API implementation."
    },
    {
      "name": "Analysis",
      "description": "Analysis endpoints sourced from the Malware & Phishing URL Scanner API implementation."
    },
    {
      "name": "Batch operations",
      "description": "Batch operations endpoints sourced from the Malware & Phishing URL Scanner API implementation."
    },
    {
      "name": "Vt",
      "description": "Vt endpoints sourced from the Malware & Phishing URL Scanner API implementation."
    },
    {
      "name": "Whois",
      "description": "Whois endpoints sourced from the Malware & Phishing URL Scanner API implementation."
    },
    {
      "name": "Ssl",
      "description": "Ssl endpoints sourced from the Malware & Phishing URL Scanner API implementation."
    },
    {
      "name": "Patterns",
      "description": "Patterns endpoints sourced from the Malware & Phishing URL Scanner API implementation."
    },
    {
      "name": "Validate",
      "description": "Validate endpoints sourced from the Malware & Phishing URL Scanner API implementation."
    }
  ],
  "paths": {
    "/status": {
      "get": {
        "summary": "Ping",
        "description": "Returns malware scanner service health and API version.",
        "operationId": "malware-url-scanner_get_status",
        "tags": [
          "Operations"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Ping",
        "description": "Returns malware scanner service health and API version.",
        "operationId": "malware-url-scanner_post_status",
        "tags": [
          "Operations"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "api": {
                      "byok": "External provider keys (e.g. VirusTotal) are supplied per-request in the 'x-apikey' header.",
                      "docs": "https://...",
                      "name": "Malware Scanner API",
                      "version": "v0.0.2",
                      "base_url": "https://malware-scanner.p.rapidapi.com",
                      "subscriptions": "Managed via the RapidAPI dashboard."
                    },
                    "meta": {
                      "docs": "https://...",
                      "name": "Malware Scanner API",
                      "version": "v0.0.2"
                    },
                    "status": "API is online",
                    "success": true,
                    "endpoints": [
                      {
                        "path": "/status",
                        "method": "GET/POST",
                        "version": "v0.0.1",
                        "description": "Health check & API meta"
                      },
                      {
                        "path": "/scan",
                        "method": "GET/POST",
                        "version": "v0.0.1",
                        "description": "Composite URL scan (local heuristics + optional VirusTotal)"
                      },
                      {
                        "path": "/scan/bulk",
                        "method": "POST",
                        "version": "v0.0.2",
                        "description": "Batch-scan up to 50 URLs"
                      }
                    ]
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "api": {
            "byok": "External provider keys (e.g. VirusTotal) are supplied per-request in the 'x-apikey' header.",
            "docs": "https://...",
            "name": "Malware Scanner API",
            "version": "v0.0.2",
            "base_url": "https://malware-scanner.p.rapidapi.com",
            "subscriptions": "Managed via the RapidAPI dashboard."
          },
          "meta": {
            "docs": "https://...",
            "name": "Malware Scanner API",
            "version": "v0.0.2"
          },
          "status": "API is online",
          "success": true,
          "endpoints": [
            {
              "path": "/status",
              "method": "GET/POST",
              "version": "v0.0.1",
              "description": "Health check & API meta"
            },
            {
              "path": "/scan",
              "method": "GET/POST",
              "version": "v0.0.1",
              "description": "Composite URL scan (local heuristics + optional VirusTotal)"
            },
            {
              "path": "/scan/bulk",
              "method": "POST",
              "version": "v0.0.2",
              "description": "Batch-scan up to 50 URLs"
            }
          ]
        }
      }
    },
    "/scan": {
      "get": {
        "summary": "Scan",
        "description": "Combines local URL analysis with optional VirusTotal checks for a URL.",
        "operationId": "malware-url-scanner_get_scan",
        "tags": [
          "Analysis"
        ],
        "parameters": [
          {
            "name": "url",
            "in": "query",
            "required": true,
            "description": "URL (or bare domain) to scan",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-apikey",
            "in": "header",
            "required": false,
            "description": "Optional VirusTotal API key for external checks (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-virustotal-apikey",
            "in": "header",
            "required": false,
            "description": "Accepted alias for the optional VirusTotal API key.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Scan",
        "description": "Combines local URL analysis with optional VirusTotal checks for a URL.",
        "operationId": "malware-url-scanner_post_scan",
        "tags": [
          "Analysis"
        ],
        "parameters": [
          {
            "name": "x-apikey",
            "in": "header",
            "required": false,
            "description": "Optional VirusTotal API key for external checks (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-virustotal-apikey",
            "in": "header",
            "required": false,
            "description": "Accepted alias for the optional VirusTotal API key.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "url": {
                    "type": "string"
                  }
                },
                "required": [
                  "url"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      }
    },
    "/scan/bulk": {
      "post": {
        "summary": "Scan Bulk",
        "description": "Scans a batch of up to 50 URLs and returns per-URL verdicts.",
        "operationId": "malware-url-scanner_post_scan_bulk",
        "tags": [
          "Batch operations"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "meta": {
                      "docs": "https://...",
                      "name": "Malware Scanner API",
                      "version": "v0.0.2"
                    },
                    "results": [
                      {
                        "url": "https://example.com",
                        "analysis": {
                          "checks": {},
                          "reason": "No suspicious indicators found",
                          "status": "safe"
                        }
                      },
                      {
                        "url": "https://secure-login-bank.example",
                        "analysis": {
                          "checks": {},
                          "reason": [
                            "Contains suspicious keyword(s): secure, login, bank"
                          ],
                          "status": "suspicious"
                        }
                      }
                    ],
                    "scanned": 2,
                    "success": true,
                    "vt_key_used": false,
                    "invalid_urls": [
                      "bad url"
                    ]
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "urls": {
                    "type": "array",
                    "items": {
                      "type": "string"
                    }
                  }
                },
                "required": [
                  "urls"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "meta": {
            "docs": "https://...",
            "name": "Malware Scanner API",
            "version": "v0.0.2"
          },
          "results": [
            {
              "url": "https://example.com",
              "analysis": {
                "checks": {},
                "reason": "No suspicious indicators found",
                "status": "safe"
              }
            },
            {
              "url": "https://secure-login-bank.example",
              "analysis": {
                "checks": {},
                "reason": [
                  "Contains suspicious keyword(s): secure, login, bank"
                ],
                "status": "suspicious"
              }
            }
          ],
          "scanned": 2,
          "success": true,
          "vt_key_used": false,
          "invalid_urls": [
            "bad url"
          ]
        }
      }
    },
    "/scan/report": {
      "get": {
        "summary": "Scan Report",
        "description": "Returns the previously cached `/scan` result (including its `cached_at` timestamp).",
        "operationId": "malware-url-scanner_get_scan_report",
        "tags": [
          "Analysis"
        ],
        "parameters": [
          {
            "name": "url",
            "in": "query",
            "required": true,
            "description": "The URL whose cached report you want",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-apikey",
            "in": "header",
            "required": false,
            "description": "Optional VirusTotal API key for external checks (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-virustotal-apikey",
            "in": "header",
            "required": false,
            "description": "Accepted alias for the optional VirusTotal API key.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Scan Report",
        "description": "Returns the previously cached `/scan` result (including its `cached_at` timestamp).",
        "operationId": "malware-url-scanner_post_scan_report",
        "tags": [
          "Analysis"
        ],
        "parameters": [
          {
            "name": "x-apikey",
            "in": "header",
            "required": false,
            "description": "Optional VirusTotal API key for external checks (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-virustotal-apikey",
            "in": "header",
            "required": false,
            "description": "Accepted alias for the optional VirusTotal API key.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "meta": {
                      "docs": "https://...",
                      "name": "Malware Scanner API",
                      "version": "v0.0.2"
                    },
                    "input": "https://example.com",
                    "success": true,
                    "analysis": {
                      "checks": {},
                      "reason": "No suspicious indicators found",
                      "status": "safe",
                      "cached_at": "2026-08-27T22:47:19.417668"
                    }
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "url": {
                    "type": "string"
                  }
                },
                "required": [
                  "url"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "meta": {
            "docs": "https://...",
            "name": "Malware Scanner API",
            "version": "v0.0.2"
          },
          "input": "https://example.com",
          "success": true,
          "analysis": {
            "checks": {},
            "reason": "No suspicious indicators found",
            "status": "safe",
            "cached_at": "2026-08-27T22:47:19.417668"
          }
        }
      }
    },
    "/vt/url": {
      "get": {
        "summary": "Vt Url Endpoint",
        "description": "Looks up a URL in VirusTotal and returns its analysis.",
        "operationId": "malware-url-scanner_get_vt_url",
        "tags": [
          "Vt"
        ],
        "parameters": [
          {
            "name": "url",
            "in": "query",
            "required": true,
            "description": "URL to analyze with VirusTotal.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-apikey",
            "in": "header",
            "required": true,
            "description": "VirusTotal API key required for this endpoint (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-virustotal-apikey",
            "in": "header",
            "required": false,
            "description": "Accepted alias for the VirusTotal API key.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Vt Url Endpoint",
        "description": "Looks up a URL in VirusTotal and returns its analysis.",
        "operationId": "malware-url-scanner_post_vt_url",
        "tags": [
          "Vt"
        ],
        "parameters": [
          {
            "name": "x-apikey",
            "in": "header",
            "required": true,
            "description": "VirusTotal API key required for this endpoint (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-virustotal-apikey",
            "in": "header",
            "required": false,
            "description": "Accepted alias for the VirusTotal API key.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "meta": {
                      "docs": "https://...",
                      "name": "Malware Scanner API",
                      "version": "v0.0.2"
                    },
                    "input": "https://example.com",
                    "success": true,
                    "analysis": {
                      "url": "https://example.com",
                      "reason": "No engines flagged",
                      "status": "safe",
                      "engines": [
                        {
                          "engine": "Fortinet",
                          "method": "blacklist",
                          "result": "clean",
                          "category": "harmless"
                        }
                      ],
                      "provider": "virustotal",
                      "reputation": 100,
                      "detection_stats": {
                        "timeout": 0,
                        "harmless": 70,
                        "malicious": 0,
                        "suspicious": 0,
                        "undetected": 10,
                        "total_engines": 80
                      },
                      "last_modification_date": 1735689600
                    }
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "url": {
                    "type": "string"
                  }
                },
                "required": [
                  "url"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "meta": {
            "docs": "https://...",
            "name": "Malware Scanner API",
            "version": "v0.0.2"
          },
          "input": "https://example.com",
          "success": true,
          "analysis": {
            "url": "https://example.com",
            "reason": "No engines flagged",
            "status": "safe",
            "engines": [
              {
                "engine": "Fortinet",
                "method": "blacklist",
                "result": "clean",
                "category": "harmless"
              }
            ],
            "provider": "virustotal",
            "reputation": 100,
            "detection_stats": {
              "timeout": 0,
              "harmless": 70,
              "malicious": 0,
              "suspicious": 0,
              "undetected": 10,
              "total_engines": 80
            },
            "last_modification_date": 1735689600
          }
        }
      }
    },
    "/vt/hash": {
      "get": {
        "summary": "Vt Hash Endpoint",
        "description": "Looks up an MD5, SHA-1, or SHA-256 file hash in VirusTotal.",
        "operationId": "malware-url-scanner_get_vt_hash",
        "tags": [
          "Vt"
        ],
        "parameters": [
          {
            "name": "hash",
            "in": "query",
            "required": true,
            "description": "MD5, SHA-1, or SHA-256 file hash to analyze.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-apikey",
            "in": "header",
            "required": true,
            "description": "VirusTotal API key required for this endpoint (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-virustotal-apikey",
            "in": "header",
            "required": false,
            "description": "Accepted alias for the VirusTotal API key.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Vt Hash Endpoint",
        "description": "Looks up an MD5, SHA-1, or SHA-256 file hash in VirusTotal.",
        "operationId": "malware-url-scanner_post_vt_hash",
        "tags": [
          "Vt"
        ],
        "parameters": [
          {
            "name": "x-apikey",
            "in": "header",
            "required": true,
            "description": "VirusTotal API key required for this endpoint (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-virustotal-apikey",
            "in": "header",
            "required": false,
            "description": "Accepted alias for the VirusTotal API key.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "meta": {
                      "docs": "https://...",
                      "name": "Malware Scanner API",
                      "version": "v0.0.2"
                    },
                    "input": "44d88612fea8a8f36de82e1278abb02f",
                    "success": true,
                    "analysis": {
                      "md5": "44d88612fea8a8f36de82e1278abb02f",
                      "hash": "44d88612fea8a8f36de82e1278abb02f",
                      "sha1": "d2d2...",
                      "magic": "PE32 executable",
                      "reason": "Flagged by 57 engines",
                      "sha256": "8d0e...",
                      "status": "malicious",
                      "engines": [
                        {
                          "engine": "McAfee",
                          "method": "blacklist",
                          "result": "EICAR",
                          "category": "malicious"
                        }
                      ],
                      "provider": "virustotal",
                      "file_type": "exe",
                      "reputation": -800,
                      "known_names": [
                        "evil.exe"
                      ],
                      "detection_stats": {
                        "timeout": 0,
                        "harmless": 0,
                        "malicious": 57,
                        "suspicious": 0,
                        "undetected": 13,
                        "total_engines": 70
                      },
                      "file_size_bytes": 214,
                      "last_modification_date": 1735689600
                    },
                    "hash_type": "md5"
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "hash": {
                    "type": "string"
                  }
                },
                "required": [
                  "hash"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "meta": {
            "docs": "https://...",
            "name": "Malware Scanner API",
            "version": "v0.0.2"
          },
          "input": "44d88612fea8a8f36de82e1278abb02f",
          "success": true,
          "analysis": {
            "md5": "44d88612fea8a8f36de82e1278abb02f",
            "hash": "44d88612fea8a8f36de82e1278abb02f",
            "sha1": "d2d2...",
            "magic": "PE32 executable",
            "reason": "Flagged by 57 engines",
            "sha256": "8d0e...",
            "status": "malicious",
            "engines": [
              {
                "engine": "McAfee",
                "method": "blacklist",
                "result": "EICAR",
                "category": "malicious"
              }
            ],
            "provider": "virustotal",
            "file_type": "exe",
            "reputation": -800,
            "known_names": [
              "evil.exe"
            ],
            "detection_stats": {
              "timeout": 0,
              "harmless": 0,
              "malicious": 57,
              "suspicious": 0,
              "undetected": 13,
              "total_engines": 70
            },
            "file_size_bytes": 214,
            "last_modification_date": 1735689600
          },
          "hash_type": "md5"
        }
      }
    },
    "/vt/ip": {
      "get": {
        "summary": "Vt Ip Endpoint",
        "description": "Looks up an IPv4 or IPv6 address in VirusTotal.",
        "operationId": "malware-url-scanner_get_vt_ip",
        "tags": [
          "Vt"
        ],
        "parameters": [
          {
            "name": "ip",
            "in": "query",
            "required": true,
            "description": "IPv4 or IPv6 address to analyze.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-apikey",
            "in": "header",
            "required": true,
            "description": "VirusTotal API key required for this endpoint (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-virustotal-apikey",
            "in": "header",
            "required": false,
            "description": "Accepted alias for the VirusTotal API key.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Vt Ip Endpoint",
        "description": "Looks up an IPv4 or IPv6 address in VirusTotal.",
        "operationId": "malware-url-scanner_post_vt_ip",
        "tags": [
          "Vt"
        ],
        "parameters": [
          {
            "name": "x-apikey",
            "in": "header",
            "required": true,
            "description": "VirusTotal API key required for this endpoint (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-virustotal-apikey",
            "in": "header",
            "required": false,
            "description": "Accepted alias for the VirusTotal API key.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "meta": {
                      "docs": "https://...",
                      "name": "Malware Scanner API",
                      "version": "v0.0.2"
                    },
                    "input": "8.8.8.8",
                    "success": true,
                    "analysis": {
                      "ip": "8.8.8.8",
                      "asn": 15169,
                      "reason": "No engines flagged",
                      "status": "safe",
                      "country": "US",
                      "engines": [],
                      "network": "8.8.8.0/24",
                      "as_owner": "GOOGLE",
                      "provider": "virustotal",
                      "reputation": 300,
                      "detection_stats": {
                        "timeout": 0,
                        "harmless": 20,
                        "malicious": 0,
                        "suspicious": 0,
                        "undetected": 60,
                        "total_engines": 80
                      },
                      "last_modification_date": 1735689600,
                      "regional_internet_registry": "ARIN"
                    }
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "ip": {
                    "type": "string"
                  }
                },
                "required": [
                  "ip"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "meta": {
            "docs": "https://...",
            "name": "Malware Scanner API",
            "version": "v0.0.2"
          },
          "input": "8.8.8.8",
          "success": true,
          "analysis": {
            "ip": "8.8.8.8",
            "asn": 15169,
            "reason": "No engines flagged",
            "status": "safe",
            "country": "US",
            "engines": [],
            "network": "8.8.8.0/24",
            "as_owner": "GOOGLE",
            "provider": "virustotal",
            "reputation": 300,
            "detection_stats": {
              "timeout": 0,
              "harmless": 20,
              "malicious": 0,
              "suspicious": 0,
              "undetected": 60,
              "total_engines": 80
            },
            "last_modification_date": 1735689600,
            "regional_internet_registry": "ARIN"
          }
        }
      }
    },
    "/vt/domain": {
      "get": {
        "summary": "Vt Domain Endpoint",
        "description": "Looks up a domain in VirusTotal.",
        "operationId": "malware-url-scanner_get_vt_domain",
        "tags": [
          "Vt"
        ],
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": true,
            "description": "Domain name to analyze.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-apikey",
            "in": "header",
            "required": true,
            "description": "VirusTotal API key required for this endpoint (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-virustotal-apikey",
            "in": "header",
            "required": false,
            "description": "Accepted alias for the VirusTotal API key.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Vt Domain Endpoint",
        "description": "Looks up a domain in VirusTotal.",
        "operationId": "malware-url-scanner_post_vt_domain",
        "tags": [
          "Vt"
        ],
        "parameters": [
          {
            "name": "x-apikey",
            "in": "header",
            "required": true,
            "description": "VirusTotal API key required for this endpoint (BYOK).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "x-virustotal-apikey",
            "in": "header",
            "required": false,
            "description": "Accepted alias for the VirusTotal API key.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "meta": {
                      "docs": "https://...",
                      "name": "Malware Scanner API",
                      "version": "v0.0.2"
                    },
                    "input": "example.com",
                    "success": true,
                    "analysis": {
                      "domain": "example.com",
                      "reason": "No engines flagged",
                      "status": "safe",
                      "engines": [],
                      "provider": "virustotal",
                      "registrar": "IANA",
                      "popularity": {
                        "rank": 1,
                        "source": "alexa"
                      },
                      "reputation": 100,
                      "creation_date": 808963200,
                      "detection_stats": {
                        "timeout": 0,
                        "harmless": 10,
                        "malicious": 0,
                        "suspicious": 0,
                        "undetected": 70,
                        "total_engines": 80
                      },
                      "last_dns_records": []
                    }
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "domain": {
                    "type": "string"
                  }
                },
                "required": [
                  "domain"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "meta": {
            "docs": "https://...",
            "name": "Malware Scanner API",
            "version": "v0.0.2"
          },
          "input": "example.com",
          "success": true,
          "analysis": {
            "domain": "example.com",
            "reason": "No engines flagged",
            "status": "safe",
            "engines": [],
            "provider": "virustotal",
            "registrar": "IANA",
            "popularity": {
              "rank": 1,
              "source": "alexa"
            },
            "reputation": 100,
            "creation_date": 808963200,
            "detection_stats": {
              "timeout": 0,
              "harmless": 10,
              "malicious": 0,
              "suspicious": 0,
              "undetected": 70,
              "total_engines": 80
            },
            "last_dns_records": []
          }
        }
      }
    },
    "/whois": {
      "get": {
        "summary": "Whois Endpoint",
        "description": "Returns WHOIS registration information for a domain.",
        "operationId": "malware-url-scanner_get_whois",
        "tags": [
          "Whois"
        ],
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": true,
            "description": "Domain to look up",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Whois Endpoint",
        "description": "Returns WHOIS registration information for a domain.",
        "operationId": "malware-url-scanner_post_whois",
        "tags": [
          "Whois"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "meta": {
                      "docs": "https://...",
                      "name": "Malware Scanner API",
                      "version": "v0.0.2"
                    },
                    "input": "example.com",
                    "whois": {
                      "org": "Internet Assigned Numbers Authority",
                      "domain": "example.com",
                      "emails": [],
                      "status": [
                        "clientDeleteProhibited"
                      ],
                      "age_days": 11340,
                      "registrar": "IANA",
                      "name_servers": [
                        "a.iana-servers.net"
                      ],
                      "updated_date": "2024-08-14T00:00:00",
                      "creation_date": "1995-08-14T00:00:00",
                      "is_new_domain": false,
                      "expiration_date": "2026-08-14T00:00:00"
                    },
                    "success": true
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "domain": {
                    "type": "string"
                  }
                },
                "required": [
                  "domain"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "meta": {
            "docs": "https://...",
            "name": "Malware Scanner API",
            "version": "v0.0.2"
          },
          "input": "example.com",
          "whois": {
            "org": "Internet Assigned Numbers Authority",
            "domain": "example.com",
            "emails": [],
            "status": [
              "clientDeleteProhibited"
            ],
            "age_days": 11340,
            "registrar": "IANA",
            "name_servers": [
              "a.iana-servers.net"
            ],
            "updated_date": "2024-08-14T00:00:00",
            "creation_date": "1995-08-14T00:00:00",
            "is_new_domain": false,
            "expiration_date": "2026-08-14T00:00:00"
          },
          "success": true
        }
      }
    },
    "/ssl": {
      "get": {
        "summary": "Ssl Endpoint",
        "description": "Inspects the live TLS certificate for a domain.",
        "operationId": "malware-url-scanner_get_ssl",
        "tags": [
          "Ssl"
        ],
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": true,
            "description": "Domain whose live TLS certificate to inspect",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Ssl Endpoint",
        "description": "Inspects the live TLS certificate for a domain.",
        "operationId": "malware-url-scanner_post_ssl",
        "tags": [
          "Ssl"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "ssl": {
                      "valid": true,
                      "details": {
                        "issuer": "GTS CA 1C3",
                        "expired": false,
                        "subject": "www.google.com",
                        "valid_from": "May 27 00:00:00 2026 GMT",
                        "valid_until": "Aug 25 23:59:59 2026 GMT",
                        "expiring_soon": false,
                        "serial_number": "6A:8B:...",
                        "expires_in_days": 66
                      }
                    },
                    "meta": {
                      "docs": "https://...",
                      "name": "Malware Scanner API",
                      "version": "v0.0.2"
                    },
                    "input": "google.com",
                    "success": true
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "domain": {
                    "type": "string"
                  }
                },
                "required": [
                  "domain"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "ssl": {
            "valid": true,
            "details": {
              "issuer": "GTS CA 1C3",
              "expired": false,
              "subject": "www.google.com",
              "valid_from": "May 27 00:00:00 2026 GMT",
              "valid_until": "Aug 25 23:59:59 2026 GMT",
              "expiring_soon": false,
              "serial_number": "6A:8B:...",
              "expires_in_days": 66
            }
          },
          "meta": {
            "docs": "https://...",
            "name": "Malware Scanner API",
            "version": "v0.0.2"
          },
          "input": "google.com",
          "success": true
        }
      }
    },
    "/patterns": {
      "get": {
        "summary": "Patterns Endpoint",
        "description": "Returns domain-pattern and URL indicators used by the scanner.",
        "operationId": "malware-url-scanner_get_patterns",
        "tags": [
          "Patterns"
        ],
        "parameters": [
          {
            "name": "domain",
            "in": "query",
            "required": true,
            "description": "Domain to inspect",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Patterns Endpoint",
        "description": "Returns domain-pattern and URL indicators used by the scanner.",
        "operationId": "malware-url-scanner_post_patterns",
        "tags": [
          "Patterns"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "meta": {
                      "docs": "https://...",
                      "name": "Malware Scanner API",
                      "version": "v0.0.2"
                    },
                    "input": "secure-login-bank.example",
                    "details": {
                      "tld": "example",
                      "domain": "secure-login-bank.example",
                      "punycode": false,
                      "all_numeric": false,
                      "long_domain": false,
                      "hyphen_cluster": false,
                      "suspicious_tld": false,
                      "keyword_matches": [
                        "secure",
                        "login",
                        "bank"
                      ],
                      "excessive_subdomains": false
                    },
                    "success": true,
                    "findings": [
                      "Contains suspicious keyword(s): secure, login, bank"
                    ],
                    "suspicious": true
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "domain": {
                    "type": "string"
                  }
                },
                "required": [
                  "domain"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "meta": {
            "docs": "https://...",
            "name": "Malware Scanner API",
            "version": "v0.0.2"
          },
          "input": "secure-login-bank.example",
          "details": {
            "tld": "example",
            "domain": "secure-login-bank.example",
            "punycode": false,
            "all_numeric": false,
            "long_domain": false,
            "hyphen_cluster": false,
            "suspicious_tld": false,
            "keyword_matches": [
              "secure",
              "login",
              "bank"
            ],
            "excessive_subdomains": false
          },
          "success": true,
          "findings": [
            "Contains suspicious keyword(s): secure, login, bank"
          ],
          "suspicious": true
        }
      }
    },
    "/validate": {
      "get": {
        "summary": "Validate Endpoint",
        "description": "Validates and normalizes a URL before scanning.",
        "operationId": "malware-url-scanner_get_validate",
        "tags": [
          "Validate"
        ],
        "parameters": [
          {
            "name": "url",
            "in": "query",
            "required": true,
            "description": "URL to validate/normalize",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object"
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true
      },
      "post": {
        "summary": "Validate Endpoint",
        "description": "Validates and normalizes a URL before scanning.",
        "operationId": "malware-url-scanner_post_validate",
        "tags": [
          "Validate"
        ],
        "parameters": [],
        "responses": {
          "200": {
            "description": "Successful response",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "example": {
                    "meta": {
                      "docs": "https://...",
                      "name": "Malware Scanner API",
                      "version": "v0.0.2"
                    },
                    "input": "example.com",
                    "parts": {
                      "path": "",
                      "port": null,
                      "query": "",
                      "netloc": "example.com",
                      "scheme": "https",
                      "fragment": "",
                      "hostname": "example.com",
                      "has_credentials": false
                    },
                    "valid": true,
                    "success": true,
                    "normalized": "https://example.com"
                  }
                }
              }
            }
          },
          "4XX": {
            "description": "Client error"
          },
          "5XX": {
            "description": "Upstream or gateway error"
          },
          "503": {
            "description": "No live upstream is configured. Sample responses are preview-only."
          }
        },
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "type": "object",
                "properties": {
                  "url": {
                    "type": "string"
                  }
                },
                "required": [
                  "url"
                ]
              }
            }
          }
        },
        "x-dakidarts-execution-status": "source-only",
        "x-dakidarts-source-contract": true,
        "x-dakidarts-sample-response": {
          "meta": {
            "docs": "https://...",
            "name": "Malware Scanner API",
            "version": "v0.0.2"
          },
          "input": "example.com",
          "parts": {
            "path": "",
            "port": null,
            "query": "",
            "netloc": "example.com",
            "scheme": "https",
            "fragment": "",
            "hostname": "example.com",
            "has_credentials": false
          },
          "valid": true,
          "success": true,
          "normalized": "https://example.com"
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "ApiKeyAuth": {
        "type": "apiKey",
        "in": "header",
        "name": "X-API-Key"
      }
    }
  },
  "security": [
    {
      "ApiKeyAuth": []
    }
  ]
}