Security & Secrets Tier 2 Ready POST /v1/ssrf-firewall

SSRF Protection & URL Validator API — Block Private IPs & Cloud Metadata

Validate URLs and redirect chains against SSRF, private IPs, and cloud metadata targets. Validate untrusted URLs before your AI agent or webhook fetcher requests them. Blocks RFC1918, loopback, IPv6 mapped, octal/decimal IPs, and cloud metadata.

Try It Live in Your Browser · No API Key Required

1. Interactive Sandbox & Sample JSON Output

200 OK · Ready

Editable Request JSON (`POST /v1/ssrf-firewall`)

Live 200 OK Response Envelope

{
  "ok": true,
  "data": {
    "allowed": false,
    "risk_level": "blocked",
    "advisory": true,
    "note": "Advisory pre-check and redirect inspector; DNS rebinding requires enforcing SSRF checks at your actual HTTP client / fetcher hop.",
    "static_check": {
      "allowed": false,
      "category": "link_local_metadata",
      "reason": "169.254.0.0/16 link-local / cloud metadata range is blocked",
      "normalized_url": null,
      "hostname": "169.254.169.254"
    },
    "dns_ips": [
      "169.254.169.254"
    ],
    "blocked_dns_ips": [
      "169.254.169.254"
    ],
    "redirect_chain": []
  },
  "meta": {
    "request_id": "req_ssrf_01",
    "ms": 1
  }
}

Get API Key on RapidAPI Get API Key on Zyla Hub Download OpenAPI 3.0.3 Spec

2. Quickstart Code Examples

Full TypeScript & Python SDK →

curl -X POST "https://api.tinplate.dev/v1/ssrf-firewall" \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY" \
  -d '{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/"}'

import { TinplateClient } from "@tinplate/sdk"; // npm install @tinplate/sdk

const tinplate = new TinplateClient({
  rapidApiKey: process.env.RAPIDAPI_KEY!,
});

const { data, meta } = await tinplate.call("/v1/ssrf-firewall", {
  "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
});
console.log(`[${meta.ms} ms]`, data);

import requests

response = requests.post(
    "https://api.tinplate.dev/v1/ssrf-firewall",
    headers={
        "Content-Type": "application/json",
        "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
    },
    json={
  "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
}
)
print(response.json())

const response = await fetch("https://api.tinplate.dev/v1/ssrf-firewall", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
  },
  body: JSON.stringify({
  "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
}),
});
const result = await response.json();
console.log(result);

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "tinplate_ssrf_firewall",
    "arguments": {
      "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
    }
  }
}

OpenAPI 3.0.3 Schema Contract

Request Parameters & Response Schema Reference

Request Body Parameters (`POST /v1/ssrf-firewall`)

Parameter	Type & Constraints	Description
`url`required	`string` minLen: 1, maxLen: 2048	Target URL to evaluate for SSRF risk.
`check_dns`optional	`boolean`	Resolve A/AAAA records via DoH and check resolved IPs (default true).
`inspect_redirects`optional	`boolean`	Follow redirects via private fetcher to inspect redirect chain (default false).

Response `data` Object Fields (`200 OK`)

Field	Type	Description
`allowed`	`boolean`	Field 'allowed'
`risk_level`	`"safe" \| "blocked" \| "high_risk"`	Field 'risk_level'
`advisory`	`true`	Field 'advisory'
`note`	`string`	Field 'note'
`static_check`	`object`	Field 'static_check'
`dns_ips`	`string[]`	Field 'dns_ips'
`blocked_dns_ips`	`string[]`	Field 'blocked_dns_ips'
`redirect_chain`	`object[]`	Field 'redirect_chain'

3. What Agent URL & SSRF Firewall API Detects & Validates

Blocks AWS/GCP/Azure/Alibaba cloud metadata endpoints (169.254.169.254, fd00:ec2::254, metadata.google.internal)
Catches RFC1918 private networks, loopback (127.0.0.0/8, ::1), CGNAT (100.64.0.0/10), and link-local ranges
Defeats parser bypasses: decimal/octal/hex IP encodings (0x7f000001, 2130706433), IPv4-mapped IPv6 (::ffff:127.0.0.1), nip.io/sslip.io wildcard DNS
Optional DNS resolution and redirect-chain inspection via isolated Fetcher Worker

Honest Engineering Boundaries

4. Known Limitations & Test Verification

Release Version: v1.0.7 · Last Verified / Benchmarked: 14 November 2026 · Latency Note: Sub-millisecond figures measure in-Worker V8 compute time (typical client HTTPS network RTT to the nearest Cloudflare PoP is 15–65 ms) · See Full Portfolio Benchmarks & Corpora →

Pre-flight URL and DNS validation mitigates SSRF risk, but Time-of-Check to Time-of-Use (TOCTOU) DNS rebinding requires pinning the resolved IP in your own HTTP client or using Tinplate's isolated fetcher.
Tested v1.0.4 (14 November 2026).

5. Marketplace Plans & Payload Quotas

Plan	Monthly Price	Included Requests	Rate Limit	Max Request Payload	Best For
BASIC	$0.00 / month	500 / month (hard limit)	10 req / min	64 KB	Evaluation, local development & CI smoke tests
PRO	$9.99 / month	15,000 / month	60 req / min	128 KB	Solo developers & production apps
ULTRA	$29.99 / month	100,000 / month	300 req / min	256 KB	Growing SaaS & multi-agent pipelines
MEGA	$79.99 / month	500,000 / month	1,000 req / min	256 KB	High-volume enterprise workloads

Subscribe on RapidAPI Subscribe on Zyla Hub Full Pricing Details

6. Frequently Asked Questions

Does it catch decimal, octal, and IPv6-mapped localhost bypasses?

Yes. It normalizes integer, octal, hex, shorthand IPv4, and IPv4-mapped IPv6 addresses before checking CIDR blocklists.

What about wildcard DNS services like nip.io or sslip.io?

Wildcard DNS rebinding domains (nip.io, sslip.io, xip.io, localtest.me) and embedded private IPs in hostnames are detected and blocked.

Why do AI agents need an SSRF firewall?

Any agent with a 'browse_url' or 'fetch_webhook' tool can be tricked via indirect prompt injection into querying internal Kubernetes or cloud metadata endpoints.

Zero Payload Logging

7. Data Handling, Privacy & Marketplace Proxy Disclosure

Stateless URL analysis; zero payload logging.

Worker Zero-Logging Guarantee: Cloudflare Workers Observability and invocation logging are disabled in configuration (observability.enabled = false, head_sampling_rate = 0, invocation_logs = false). Payloads are processed strictly in volatile V8 memory and never logged or stored by Tinplate.

Marketplace Proxies vs. Direct Bearer Key: Requests sent via RapidAPI or Zyla API Hub pass through those marketplaces' proxy infrastructure (subject to their respective privacy policies). Security-sensitive workloads requiring end-to-end zero-intermediary processing can connect directly to https://api.tinplate.dev using a Direct Bearer Key (Authorization: Bearer <API_KEY>). Read our full Privacy Notice and OpenAPI 3.0.3 JSON Schema.