API

Every report the site produces is available programmatically. There is no account and no API key. You pay per request in USDC on Algorand using x402, the HTTP 402 payment protocol, so a script or an agent can buy a single report without signing up for anything.

Endpoints

Endpoint	Price	Behaviour
GET /api/v1/report/{target}	$0.01	Returns a recent report if one exists, otherwise scans.
GET /api/v1/scan/{target}	$0.02	Always collects fresh. Takes up to a minute.

A target is a domain, an IPv4 address, a CIDR block, or an ASN. A request that is refused before the paywall, such as an invalid target, is never charged.

How the payment works

Request without payment and you get 402 Payment Required with the terms in a PAYMENT-REQUIRED header, base64 encoded. Your client signs a USDC transfer, retries with a PAYMENT-SIGNATURE header, and a facilitator verifies and settles it on Algorand before the handler runs. The facilitator pays the network fee, so you need USDC and nothing else. The libraries below do all of this for you.

Quick start

Node · TypeScript

npm install @x402/fetch @x402/avm algosdk

pay-and-fetch.ts

import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
import { ExactAvmScheme } from "@x402/avm/exact/client";
import { toClientAvmSigner, ALGORAND_MAINNET_GENESIS_HASH } from "@x402/avm";
import algosdk from "algosdk";

// An Algorand account holding USDC and opted in to asset 31566704.
const account = algosdk.mnemonicToSecretKey(process.env.ALGO_MNEMONIC!);
const signer = toClientAvmSigner(Buffer.from(account.sk).toString("base64"));

const pay = wrapFetchWithPaymentFromConfig(fetch, {
  schemes: [
    {
      network: `algorand:${ALGORAND_MAINNET_GENESIS_HASH}`,
      client: new ExactAvmScheme(signer),
    },
  ],
});

const res = await pay("https://hogum.com/api/v1/report/example.com");
const report = await res.json();
console.log(report.score, report.grade, report.counts);

Without a library

Any language can do this; the terms are just base64 JSON in a header.

see what a request costs

curl -sD - -o /dev/null https://hogum.com/api/v1/report/example.com \
  | grep -i '^payment-required:' \
  | cut -d' ' -f2 | base64 -d | jq .accepts[0]

what comes back

{
  "scheme": "exact",
  "network": "algorand:wGHE2Pwdvd7S12BL5FaOP20EGYesN73ktiC1qzkkit8=",
  "amount": "10000",
  "asset": "31566704",
  "payTo": "…58 characters…",
  "maxTimeoutSeconds": 300,
  "extra": { "asset": 31566704, "decimals": 6, "feePayer": "…" }
}

Build an atomic group paying amount of that asset to payTo, sign it, and retry the request with the payload in PAYMENT-SIGNATURE.

Response

200 OK

{
  "target":      { "value": "example.com", "kind": "domain" },
  "score":       42,                     // 0-100, higher is worse
  "grade":       "Moderate",
  "counts":      { "critical": 0, "high": 1, "medium": 2, "low": 1, "info": 1 },
  "collectedAt": "2026-09-07T09:00:00.000Z",
  "cached":      true,                   // served from a recent scan
  "report": {
    "subdomains":   ["www.example.com"],
    "hosts":        [{ "ip": "…", "ports": [80, 443], "vulns": ["CVE-…"] }],
    "tls":          { "protocol": "TLSv1.3", "daysLeft": 120, "authorized": true },
    "web":          { "https": true, "headers": { "hsts": "…" } },
    "email":        { "spfAll": "-all", "dmarcPolicy": "reject" },
    "dns":          { "dnssec": true, "caa": [] },
    "domain":       { "registrar": "…", "daysToExpiry": 449 },
    "findings":     [{ "severity": "high", "category": "email", "title": "No DMARC record" }]
  }
}

Things that catch people out

Encode a CIDR slash. /api/v1/report/45.33.32.0%2F24. A literal slash is a second path segment and returns 400.
The network id is the full genesis hash, not the truncated CAIP-2 form. Mainnet is algorand:wGHE2Pwd…kit8=. Some libraries export a shortened constant that facilitators do not recognise.
USDC is asset 31566704 on mainnet and 10458941 on testnet. Your account must be opted in to receive or send it.
You do not need ALGO for fees. The facilitator sponsors them, so a wallet holding only USDC works.
Scans are not instant. The fresh endpoint can take a minute, which is why the terms allow 300 seconds.

Free alternatives

Every report is also a public web page at hogum.com/scan/{target}. The paid API exists for structured access and guaranteed freshness, not to gate anything.