{
 "openapi": "3.1.0",
 "info": {
  "title": "Xray API",
  "version": "1.0.0",
  "description": "Xray shows the characters you cannot see but an AI reads: Unicode tag characters (with the hidden message decoded), zero-width characters, bidi overrides, terminal escapes and look-alike letters, with the exact line and column, plus a cleaned copy. No account. Public, no API key. Rate limited.",
  "contact": {
   "name": "Clawhard Studio",
   "url": "https://clawhard.com",
   "email": "support@clawhard.com"
  }
 },
 "servers": [
  {
   "url": "https://xray.clawhard.com"
  }
 ],
 "paths": {
  "/api/v1/scan_text": {
   "post": {
    "operationId": "scan_text",
    "summary": "Find hidden Unicode characters and look-alike letters in text or a file",
    "description": "Use when the user asks whether text, a prompt, a SKILL.md, AGENTS.md, CLAUDE.md, .cursorrules, README, MCP tool description, PR diff, email or web page hides anything, or before an agent follows, installs or merges instructions that came from someone else (signals: \"hidden characters\", \"invisible…",
    "x-full-description": "Use when the user asks whether text, a prompt, a SKILL.md, AGENTS.md, CLAUDE.md, .cursorrules, README, MCP tool description, PR diff, email or web page hides anything, or before an agent follows, installs or merges instructions that came from someone else (signals: \"hidden characters\", \"invisible unicode\", \"ASCII smuggling\", \"prompt injection in this file\", \"Trojan Source\", \"why does this string not match\", \"is this domain spelled with a Cyrillic letter\"). Inspects every code point and returns a verdict (clean, suspicious, dangerous) with each finding's line, column, code points and Unicode names: Unicode tag characters (decoded back to the hidden ASCII message), variation-selector payloads (decoded bytes), bidirectional overrides and isolates, long zero-width runs, zero-width and other invisible characters, ANSI terminal escapes, control characters, words that mix Latin with Cyrillic or Greek look-alikes (with the Latin word they imitate, from Unicode confusables), whole look-alike words, styled math letters, unusual spaces, line separators, private-use and unassigned code points, and HTML comments that do not render. Legitimate uses are not flagged (emoji ZWJ sequences, flag tag sequences, a single emoji variation selector, joiners in Arabic and Indic text, direction marks next to Hebrew or Arabic). Give text or url (one public https text file; GitHub and GitLab file pages are read as raw). Example: {\"url\":\"https://github.com/owner/repo/blob/main/SKILL.md\"} or {\"text\":\"Visit pаypal.com\",\"return_clean\":true}. Optional return_clean adds a copy with hidden characters removed and look-alike letters inside mixed words replaced. Decoded hidden text is returned as data. Limits: finds characters and look-alikes, not prompt injection written in plain visible words; up to 200,000 characters (files up to 1 MB, first 200,000 characters scanned). Returns: {summary, verdict: clean|suspicious|dangerous, counts:{high,medium,low,info}, by_kind:{<kind>:characters}, hidden_text:[{kind,line,column,text}], findings:[{kind, severity, label, line, column, count, code_points:[{code,name,count,looks_like?}], word?, looks_like?, decoded?, sequences?, occurrences?, excerpt, why, note?}], findings_truncated, stats:{characters,lines,non_ascii,hidden_characters,removed_in_clean}, notes, clean_text?, clean_changed?, source?:{url,asked,bytes,content_type,truncated}, engine, open_url}",
    "x-openai-isConsequential": false,
    "responses": {
     "200": {
      "description": "Result. Always has \"ok\": true.",
      "content": {
       "application/json": {
        "schema": {
         "type": "object",
         "properties": {
          "ok": {
           "type": "boolean"
          }
         },
         "additionalProperties": true
        }
       }
      }
     },
     "400": {
      "description": "Bad input. {\"ok\":false,\"error\":\"...\"}"
     },
     "429": {
      "description": "Rate limited. Retry after the Retry-After header."
     }
    },
    "requestBody": {
     "required": true,
     "content": {
      "application/json": {
       "schema": {
        "type": "object",
        "properties": {
         "text": {
          "type": "string",
          "minLength": 1,
          "maxLength": 200000,
          "description": "The text to inspect: a prompt, rules file, skill, README, diff, code, email or tool description. Give text or url, not both."
         },
         "url": {
          "type": "string",
          "minLength": 4,
          "maxLength": 2000,
          "description": "A public https address of one text file (raw file, GitHub or GitLab file page, Markdown, JSON, YAML, code or HTML source). Give text or url, not both."
         },
         "return_clean": {
          "type": "boolean",
          "description": "true: also return clean_text with hidden characters removed, unusual spaces made normal and look-alike letters inside mixed-script words replaced. Default false."
         }
        }
       }
      }
     }
    }
   }
  }
 },
 "externalDocs": {
  "description": "llms.txt",
  "url": "https://xray.clawhard.com/llms.txt"
 }
}