> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanurl.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Response Structure

## Overview

Every Scanurl.ai request returns a structured JSON response containing core decision fields and multiple layers of analysis.

The response is designed to be both:

* **Machine-Readable** (For integration)
* **Human-Interpretable** (For debugging and review)

| Field          | Type   | Description                      |
| :------------- | :----- | :------------------------------- |
| Status         | String | Indicates if scan was successful |
| final\_verdict | String | Final classification of the URL  |
| confidence     | String | Certainty level of the verdict   |
| risk\_score    | Number | Overall risk score (0 to 1)      |
| redirect\_info | Object | Redirect tracking details        |
| quick\_scan    | Object | URL-level analysis               |
| deep\_scan     | Object | Page-level analysis              |
| reputation     | Object | Infrastructure and domain checks |

## redirect\_info

This section provides information about how the URL behaves during navigation.

### Includes:

* initial\_url
* final\_url
* http\_chain
* js\_navigations
* redirect\_count

## quick\_scan

Represents fast URL-level analysis.

### Key fields:

* phishing\_probability
* risk\_level
* domain\_age
* reachable

**New Domain Signal**\
\
If the domain is recently registered (for example, less than 30 days old), it will be flagged as a new domain.

## deep\_scan

This section represents the detailed analysis of the webpage after it is loaded in a browser environment.

It captures page behavior, interaction patterns, and dynamic signals that are not visible from the URL alone.

### Includes:

* page\_risk
* ml\_score
* behavioral signals
* form and interaction analysis

## vision

This section contains visual and layout-based signals extracted from the rendered page.

It helps identify login interfaces, credential collection patterns, and other visual indicators of risk.

### Includes:

* login\_page\_detected
* credential\_layout\_detected
* OCR-based signals

## Reputation

This section provides domain-level trust information based on infrastructure and configuration checks.

It includes signals such as SSL validity, DNS setup, and hosting characteristics.

### Includes:

* SSL certificate details
* DNS configuration (SPF, DMARC)
* ASN and hosting information
* reputation\_score

## Example Response

```text theme={null}
Response -
{
    "success": true,
    "data": {
        "status": "success",
        "final_verdict": "Trusted",
        "confidence": "high",
        "risk_score": 0,
        "redirect_info": {
            "initial_url": "https://www.scanurl.ai/",
            "final_url": "https://www.scanurl.ai/",
            "http_chain": [
                "https://www.scanurl.ai/"
            ],
            "js_navigations": [
                "https://www.scanurl.ai/"
            ],
            "redirect_count": 0,
            "redirect_limit_exceeded": false
        },
        "quick_scan": {
            "domain_age": 10618,
            "reachable": true,
            "risk_level": "SAFE",
            "stage": "ml",
            "phishing_probability": 0.00016953381224745623
        },
        "deep_scan": {
            "verdict": "Trusted",
            "confidence": "high",
            "url_risk": 0,
            "page_risk": 0,
            "final_score": 0,
            "ml_score": 0,
            "vision": {
                "login_page_detected": false,
                "credential_layout_detected": false,
                "vision_score": 0,
                "ocr_text_detected": true,
                "ocr_browser_warning": false,
                "ocr_access_block": false,
                "ocr_page_error": false,
                "ocr_under_construction": false,
                "ocr_adult_keywords_detected": false,
                "vision_available": true
            },
            "reputation": {
                "reputation_score": 0,
                "infrastructure_risk_level": "low",
                "reasons": [
                    "Hosted on trusted enterprise infrastructure",
                    "Domain older than 5 years (stability signal)"
                ],
                "ssl": {
                    "cert_present": true,
                    "cert_age_days": 82,
                    "cert_valid_days_remaining": 8,
                    "cert_issuer": "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1,O=DigiCert Inc,C=US",
                    "self_signed": false,
                    "cert_valid": true,
                    "cert_expired": false
                },
                "dns": {
                    "mx_present": true,
                    "spf_present": true,
                    "dmarc_present": true,
                    "dmarc_policy": "reject",
                    "dmarc_strict": true
                },
                "asn": {
                    "ip": "57.144.42.1",
                    "asn": "32934",
                    "asn_org": "NSO INDIA",
                    "hosting_provider": "Amazon Web Services, Inc",
                    "is_cloud_hosting": false,
                    "is_suspicious_hosting": false,
                    "is_cdn": false,
                    "is_enterprise_infra": true,
                    "is_cloud_vps": false
                }
            }
        }
    }
}
```

## Analysis Layers Summary

| Section     | What It Represents                      |
| :---------- | :-------------------------------------- |
| Quick\_Scan | Fast URL-level risk analysis            |
| deep\_scan  | Page behavior and interaction analysis  |
| vision      | Visual and UI-based signals             |
| reputation  | Domain and infrastructure trust signals |