Chain Tracer API

Endpoint

• Up to 5 URLs per request, 30 requests per minute per IP.
• SSRF-protected, 20-hop limit, 15 s per hop, 55 s overall.
• Body: { "url": "…" } or { "urls": [] }

Code examples

curl -X POST "https://rca.api.crosx.in/v1/trace" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"url":"https://example.com"}'

const res = await fetch("https://rca.api.crosx.in/v1/trace", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": `Bearer ${process.env.REDIRECT_TRACER_API_KEY}`,
  },
  body: JSON.stringify({ url: "https://example.com" }),
});
const data = await res.json();
console.log(data);

curl "https://rca.api.crosx.in/"

$ch = curl_init("https://rca.api.crosx.in/v1/trace");
curl_setopt_array($ch, [
  CURLOPT_POST => true,
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "Authorization: Bearer YOUR_API_KEY",
  ],
  CURLOPT_POSTFIELDS => json_encode(["url" => "https://example.com"]),
]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);
print_r($data);

Try it now

Response shape

{
  "success": true,
  "result": {
    "startUrl": "https://example.com",
    "finalUrl": "https://example.com",
    "finalDestinationConfirmed": true,
    "hops": [],
    "issues": [],
    "tracking": {
      "diffs": []
    },
    "error": null
  }
}

Each hop is labelled with its mechanism: http-redirect, meta-refresh, javascript-redirect, browser-navigation or final-response. When a hop cannot be safely followed, the exact reason is returned instead of a fake completion, and finalDestinationConfirmed is false.

The AWS API requires a Bearer API key for trace requests. The root endpoint (GET /) provides a health check. Trace requests use POST /v1/trace with a JSON body containing a url field.

The API returns JSON responses. Invalid or missing API keys are rejected. Check the HTTP status and response body when handling errors.