Reference
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
url |
string | yes | Public URL. Without a scheme https is assumed. |
Example request
curl -s "https://api2.globus.studio/v2/http-check?url=https://globus.studio/"
A browser hides almost everything about the response it receives. This endpoint shows it: the status code, every redirect, the protocol version, the time to first byte, the compression and the security headers, for a URL the client owns or wants to inspect.
Redirects, one hop at a time
The chain is followed manually, one request per hop, up to five. Each entry keeps the source URL, the target and the status code, so a loop or an unnecessary hop between HTTP and HTTPS is visible instead of summarised. The final response supplies the headers, timing and size.
curl -s "https://api2.globus.studio/v2/http-check?url=https%3A%2F%2Fglobus.studio%2F"Security headers as data
HSTS is parsed into max_age, include_subdomains and preload, not returned as one string. The CSP flag also reports whether frame-ancestors is present, because X-Frame-Options and CSP overlap. X-Content-Type-Options, Referrer-Policy and Permissions-Policy are read separately.
The issues array holds the readable part: no HSTS, a max-age below six months, no CSP, no nosniff, no frame protection, an uncompressed HTML response, a chain longer than five hops, or a final status above 399.
Timing and limits
ttfb_ms is measured by the client library, and total_ms covers the whole exchange. Compression is detected from the response header after the body is decoded, so size_bytes is the readable size rather than the transfer size.
Only public addresses on ports 80 and 443 are contacted. Private, loopback and reserved targets are refused before any connection opens, which keeps the endpoint out of internal networks. The body limit is 256 KB and answers are cached for ten minutes.
Related
The full parameter table, every error code and a live request are on the documentation page. It opens in the same language as this page and needs no account.
A longer walkthrough, with the checks that matter and the limits worth planning for: HTTP headers and redirects: what the browser does not show.