Getting the scope
trust:read is not self-serve. It is granted at key-validation time only to developer keys whose partner holds an active consumer or trust data link, so the scope tracks a real commercial relationship rather than a checkbox. A key without it gets 403 missing_scope like any other scope on the platform — nothing about this endpoint is hidden, it is simply gated.
Endpoints
Submit one absolute http or https URL. Anything else — a bare hostname, a relative path, a non-web scheme — is refused with 400 bad_url rather than guessed at.
curl -X POST "https://api.bolrach.io/v1/trust/check-url" \
-H "Authorization: Bearer bt_your_key_here" \
-H "Content-Type: application/json" \
-d '{"url": "https://example.com"}'Request
{
"url": "https://example.com"
}Latency and timeouts
The engine performs a live fetch, so allow several seconds and set a client timeout of at least 30 seconds. If the engine does not answer within its own window the platform returns 502 trust_unavailable — that is the engine being slow or unreachable, not a verdict about the URL. Retry shortly; do not treat it as a pass or a fail.
Limits and errors
Plan rate limits are shared across the platform (plans table) and every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Errors use the platform envelope: bad_url (400), missing_key / invalid_key (401), missing_scope (403), rate_limited (429), trust_unavailable (502).
Changelog
| Date | Change |
|---|---|
| 2026-08-05 | Reference published. The endpoint was live and advertised in the API catalogue with no page behind it. |