Check URL Status
web.check_url_status
Overview
You send a public http(s) URL and we probe it with a bounded HEAD or GET through our SSRF-safe HTTP client, then hand back the status code, the content type, and how many body bytes came back. Before every hop we resolve the host and refuse loopback, link-local, any-local, RFC 1918 private, and cloud-metadata addresses, so a redirect chain cannot walk into your internal network. Transport problems come back as ok:false with a short error code instead of an exception. We never return the page body, so pass HTML you already have to the web.extract_* skills when you need to parse a page.
You want to verify a link without opening a path into your own network, and without paying for a browser to render the page.
Reliability
The same URL can answer differently from one minute to the next, because the answer belongs to the remote site rather than to us; retry freely, since a probe changes nothing. Egress is guarded on the first request and on every redirect hop: we resolve the host and refuse loopback, link-local, any-local, RFC 1918 private, IPv4-mapped equivalents of those, and the 169.254.169.254 cloud-metadata address, and we accept only http and https. Failures never throw — you get ok:false with error BLOCKED (refused address, unresolvable host, or more redirects than allowed), NETWORK_ERROR (connection failure, timeout, or TLS problem), or INTERRUPTED (the probe was cancelled); the first two are worth one retry only if you expect the remote side to change. Bad input is rejected outright and retrying will not help: a non-http(s) URL, a URL over 8192 characters, a method other than HEAD or GET, or maxRedirects, timeoutMs, or readBodyBytes outside their ranges.
Context footprint
You get back a handful of scalars and two flags — never the page body, so the response stays small however large the page was. A successful call costs 2 execution credits.
When to use it
When you want to know whether a public URL responds, and what it serves back.
When you need the page body itself or browser rendering; this probe returns metadata only.
Runs on the platform's shared outbound HTTP client, which resolves and screens every hop before connecting.
Scope
Non-goals
- Does not render pages or run JavaScript
- Does not reach loopback, link-local, private, or cloud-metadata addresses
- Does not return the page body for parsing
- Does not return response-body content
Properties
Capabilities
Cost & billing
Flat rate per invocation
File handling
How we handle your data
What this means
This skill sends required payload data to an external service to complete execution.
Squillify guarantees
- Uses an external service
- This skill sends required payload data to an external service.
- Squillify does not permanently store submitted payloads.
- Telemetry records metadata only, not submitted content.
- Submitted payloads are not used for training.
- Submitted payloads are not reviewed by humans.
- This skill does not target sensitive data.
- The response does not contain submitted content.
Your responsibility
Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.
Input schema
| Field | Type | Required | Description |
|---|---|---|---|
| url | string | Yes | Absolute public HTTP or HTTPS URL to probe. |
| method | string | No | HTTP method used on the initial request and every followed redirect. |
| followRedirects | boolean | No | Whether to follow validated public redirects. |
| maxRedirects | integer | No | Maximum redirect hops when redirect following is enabled. |
| timeoutMs | integer | No | Per-hop response timeout in milliseconds. |
| readBodyBytes | integer | No | Maximum response-body bytes read for GET; HEAD always reads zero. |
Output schema
| Field | Type | Required | Description |
|---|---|---|---|
| ok | boolean | Yes | Whether an HTTP response was received. |
| status | integer | Yes | Final HTTP status, or zero when no usable response was received. |
| finalUrl | string | No | Final validated URL after followed redirects. |
| contentType | string | No | Final response Content-Type header when present. |
| contentLength | integer | No | Response-body bytes actually read. |
| bodyTruncated | boolean | No | Whether a GET body exceeded the requested read prefix. |
| error | string | No | Stable reason no usable response was returned. |
| metadata | object | Yes | Closed receipt object containing ssrfProtected and followedRedirects execution properties. |
API contract
POST /v1/executecurl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"web.check_url_status","input":{"url":"https://example.com/"}}'import { Squillify } from "@squillify/sdk";
const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });
const { output } = await sq.execute("web.check_url_status", {"url":"https://example.com/"});Errors
| Code | HTTP | Retryable | Description |
|---|---|---|---|
| VALIDATION_ERROR | 400 | No | The request payload failed schema validation. |
| UNAUTHORIZED | 401 | No | Missing or invalid API key. |
| SKILL_NOT_ACCESSIBLE | 403 | No | The API key is not granted access to this skill. |
| SKILL_NOT_AVAILABLE_FOR_PLAN | 403 | No | This skill is not included in your current plan. |
| PLAN_ELIGIBILITY_UNAVAILABLE | 503 | Yes | Plan eligibility could not be decided. Retry after backoff. |
| SKILL_NOT_FOUND | 404 | No | The requested skill or version does not exist. |
| TENANT_RATE_LIMITED | 429 | Yes | Request rate limit exceeded. Retry after backoff. |
| QUOTA_EXCEEDED | 429 | Yes | Plan quota exhausted. Retryable once the quota period resets. |
| EXECUTION_TIMEOUT | 504 | Yes | Execution exceeded the allowed time budget. |
Other limits
| Limit | Value |
|---|---|
| Recommended inline bytes | 32 KiB |
Limitations
- Does not render pages or run JavaScript
- Does not reach loopback, link-local, private, or cloud-metadata addresses
- Does not return the page body for parsing
- Does not return response-body content
- Downloading HTML for extraction — pass HTML you hold to the web.extract_* skills
- Browser-accurate rendering, or checks that depend on JavaScript
- Reaching an internal host, which we always refuse
How to call
POST /v1/execute (requires authentication)
{
"skillKey": "web.check_url_status",
"input": {
"url": "https://example.com/"
}
}Examples
Public URL responds with 200
{
"url": "https://example.com/"
}{
"metadata": {
"ssrfProtected": true,
"followedRedirects": true
},
"bodyTruncated": false,
"finalUrl": "https://example.com/",
"status": 200,
"contentLength": 1256,
"contentType": "text/html; charset=UTF-8",
"ok": true
}Loopback address refused before any request
{
"url": "http://127.0.0.1/admin"
}{
"ok": false,
"metadata": {
"ssrfProtected": true,
"followedRedirects": true
},
"error": "BLOCKED",
"status": 0
}Recommended use cases
- Check that a link responds before you store or publish it
- Spot-check uptime, or learn what content type a URL serves
- Confirm a redirect chain resolves to a reachable public target
Avoid for
- Downloading HTML for extraction — pass HTML you hold to the web.extract_* skills
- Browser-accurate rendering, or checks that depend on JavaScript
- Reaching an internal host, which we always refuse
Related skills
Composable with
Safety & privacy
- Your payloads are never stored permanently.
- Telemetry captures metadata only — never your payload contents.
- We never train models on your payloads.
- No human reviews your payloads.