{"data":{"status":"fail","items":[{"index":0,"valid":true,"canonical":"https://example.com/a/b/~foo?id=7","host":"example.com","hostUnicode":"example.com","registrableDomain":"example.com","removedParams":["utm_source","gclid"],"findings":[{"ruleId":"tracking-params-removed","severity":"info","detail":"Removed: utm_source, gclid."},{"ruleId":"fragment-dropped","severity":"info","detail":"Fragment removed; it is never sent to the server."}]},{"index":1,"valid":true,"canonical":"https://evil.example/login","host":"evil.example","hostUnicode":"evil.example","registrableDomain":"evil.example","removedParams":[],"findings":[{"ruleId":"userinfo-lookalike","severity":"risk","detail":"Userinfo \"paypal.com\" reads like a host but the request goes to evil.example."}]},{"index":2,"valid":true,"canonical":"https://xn--pple-43d.com/","host":"xn--pple-43d.com","hostUnicode":"аpple.com","registrableDomain":"xn--pple-43d.com","removedParams":[],"findings":[{"ruleId":"idn-host","severity":"warn","detail":"Host contains internationalized labels; Unicode form: аpple.com."},{"ruleId":"idn-mixed-script","severity":"risk","detail":"Unicode safety rules USC003, USC019, USC017 fired on host аpple.com."}]},{"index":3,"valid":true,"canonical":"https://shop.example/login?next=https://evil.example/steal","host":"shop.example","hostUnicode":"shop.example","registrableDomain":"shop.example","removedParams":[],"findings":[{"ruleId":"open-redirect-shape","severity":"risk","detail":"Parameter \"next\" = \"https://evil.example/steal\": absolute URL to evil.example, a different registrable domain than shop.example."}]}],"riskCount":3,"witnesses":[{"ruleId":"userinfo-lookalike","detail":"Userinfo \"paypal.com\" reads like a host but the request goes to evil.example.","path":"urls[1]","index":1,"actual":"https://evil.example/login"},{"ruleId":"idn-mixed-script","detail":"Unicode safety rules USC003, USC019, USC017 fired on host аpple.com.","path":"urls[2]","index":2,"actual":"https://xn--pple-43d.com/"},{"ruleId":"open-redirect-shape","detail":"Parameter \"next\" = \"https://evil.example/steal\": absolute URL to evil.example, a different registrable domain than shop.example.","path":"urls[3]","index":3,"actual":"https://shop.example/login?next=https://evil.example/steal"}],"versions":{"engine":"url-canonicalize 1","urlParser":"WHATWG URL Living Standard, last updated 2026-10-19, fetched 2026-11-04; UTS #46 via the runtime URL parser","punycode":"RFC 3492 decoder (https://www.rfc-editor.org/rfc/rfc3492); ToASCII is the runtime URL parser","publicSuffixSubset":"https://publicsuffix.org/list/public_suffix_list.dat 2026-10-31_14-17-28_UTC commit 73f8cc7 (subset), fetched 2026-11-04","trackingParams":"Mozilla query-stripping Remote Settings (fetched 2026-11-04, newest record 2023-09-14); Google Analytics utm_ names (support.google.com/analytics/answer/10917952, fetched 2026-11-04)","unicodeRules":"micro/strings.ts scanStrings (USC001-USC019)"},"limits":["Registrable domain uses a public-suffix subset, not the full list; pass publicSuffixes for suffixes it lacks.","Open-redirect detection reads parameter names from a fixed list and compares registrable domains; it cannot know the server's allow-list.","A clean result means none of these rules fired, not that the destination is safe.","Tracking parameter list is a snapshot (Mozilla Remote Settings records dated up to 2023-09-14)."],"deterministic":true},"_provenance":{"version":"writerslogic-provenance/1","issuer":"did:web:agents.writerslogic.com","verify":{"endpoint":"POST /api/v1/verify-provenance","did":"did:web:agents.writerslogic.com"},"manifest":{"format":"application/json","instance_id":"xmp:iid:36319c54-b949-4777-9382-97d3aa2d45b1","claim_generator_info":[{"name":"WritersLogic x402 Agent Hub","version":"2.0.0"}],"title":"URL canonicalizer and lookalike-host check","assertions":[{"label":"c2pa.actions.v2","data":{"actions":[{"action":"c2pa.created","when":"2026-11-06T01:30:30.046Z","softwareAgent":{"name":"writerslogic-agent-hub/url-canonicalize","version":"2.0.0"},"digitalSourceType":"http://cv.iptc.org/newscodes/digitalsourcetype/algorithmicMedia","parameters":{"endpoint":"POST /api/v1/url-canonicalize","inputDigest":{"alg":"sha256","hash":"60d360309cc1a4faef7231d5416531588598cc69646caf5da95f6ceffa5746d9","canonicalization":"JCS"}}}]}},{"label":"c2pa.hash.data","data":{"alg":"sha256","hash":"3f078697a0ec3865515d4c1c75c8560c969d145db3271095afdd59c2342ba02f","name":"jcs-canonical-json(data)"}}]},"credential":{"@context":["https://www.w3.org/ns/credentials/v2"],"id":"urn:uuid:2a38732a-9d27-4c13-9e4d-ae1c5d566565","type":["VerifiableCredential","AgentOutputCredential"],"issuer":"did:web:agents.writerslogic.com","validFrom":"2026-11-06T01:30:30.046Z","credentialSubject":{"id":"urn:sha256:3f078697a0ec3865515d4c1c75c8560c969d145db3271095afdd59c2342ba02f","agent":"url-canonicalize","endpoint":"POST /api/v1/url-canonicalize","outputDigest":{"alg":"sha256","value":"3f078697a0ec3865515d4c1c75c8560c969d145db3271095afdd59c2342ba02f","canonicalization":"JCS"},"inputDigest":{"alg":"sha256","value":"60d360309cc1a4faef7231d5416531588598cc69646caf5da95f6ceffa5746d9","canonicalization":"JCS"},"manifestDigest":{"alg":"sha256","value":"f241be2ea486d0f29015256be6e368eceb823a99d9f941872830098616f92543","canonicalization":"JCS"},"ingredients":[],"payment":{"scheme":"api-key","network":"eip155:8453","payer":"sample"}},"proof":{"type":"DataIntegrityProof","cryptosuite":"eddsa-jcs-2022","created":"2026-11-06T01:30:30.046Z","verificationMethod":"did:web:agents.writerslogic.com#key-1","proofPurpose":"assertionMethod","proofValue":"z27kbiJGo8UWrmXV4F3f1pFkeWmBRHyuioYB4V5cv6bUt95uSz3d25bt49dJ6Ly9q8sG4FNt5hV8iL5eYYfUZk7oo"}},"ethSignature":{"type":"EIP-191","signer":"did:pkh:eip155:8453:0x3DBd42560cA7a7E448A2c7DfC9E785526189411f","address":"0x3DBd42560cA7a7E448A2c7DfC9E785526189411f","message":"writerslogic-provenance:d76f242e3712ce6feb7965a0e5f07e9768f8f1909a2881b71b4c0fb8309919a6","signature":"0x79279346120acfe3b06c3ba4f236e5be6d8520a12ff61c927b452764c268fc551e4895956923ee1278d4b4c372099aa5b5e41f656a2f81d74ee1d954696fe4931c"}}}