JSON validation, SHA-256 and text inspection API

Three deterministic utilities share POST /api/tools. AUN processes the input on its backend, without sending it to an LLM or an external utility provider. Each admitted request consumes one unit. All input must be a non-empty string; whitespace-only input is rejected.

Calculate a SHA-256 hash

curl 'https://agentutility.network/api/tools' \
  -H 'Content-Type: application/json' \
  --data '{"tool":"content-hash","input":"abc"}'

Expected result:

{"algorithm":"SHA-256","sha256":"ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad","utf8_bytes":3}

The exact UTF-8 input is hashed. Newlines, spaces and Unicode representations can change the hash. A hash does not establish author identity, authenticity, ownership or the safety of a file. This endpoint accepts text, not binary uploads.

Validate JSON syntax

POST /api/tools
Content-Type: application/json

{"tool":"json-validate","input":"{bad"}

Expected result: {"valid":false,"error":"Invalid JSON syntax"} with HTTP 200. Invalid JSON inside the input string is a completed validation result; malformed JSON in the outer HTTP body is HTTP 422.

Valid input returns valid, formatted, top_level_type and keys. This checks syntax through JavaScript JSON.parse; it does not validate a JSON Schema, business rules, uniqueness of object keys or numeric precision beyond JavaScript numbers. Formatting can round large numbers or collapse duplicate keys: retain the original input when exact preservation matters.

Inspect Unicode text

POST /api/tools
Content-Type: application/json

{"tool":"text-inspect","input":"è\nx"}

Expected result:

{"words":2,"characters":3,"lines":2,"utf8_bytes":4,"word_count_method":"Whitespace-delimited tokens; not language-aware"}

Characters counts Unicode code points, not visual graphemes. Emoji sequences and combining marks can contain multiple code points. Words are whitespace-delimited tokens, not linguistic words. Lines split on CRLF, CR or LF; a trailing newline adds a line.

Request and privacy limits

The total encoded HTTP JSON body is limited to 32 KB, including escaping and field names. Tool input validation additionally caps UTF-8 input at 50 KB, and JSON validation at 20,000 UTF-16 code units; the smaller applicable HTTP limit still governs. Wrong media type returns 415; oversized HTTP body returns 413; invalid tool or input returns 422.

Utility input is processed locally on the backend and omitted from application metric events. The optional order/receipt flow stores private inputs and results temporarily; infrastructure logs and backup retention are separate. Avoid submitting secrets unnecessarily. See the data-handling page for details.

Free access, quotas and automation

No payment or card is required. Anonymous trials share 100 units per UTC day. Automatically enrolled credentials receive 1,000 units per UTC month, inside the shared 10,000-unit monthly ceiling. These are maximum allowances, not reserved capacity. Usage failures after admission consume units. Rate, concurrency and antiabuse limits apply in addition to quotas: inspect HTTP 429 and Retry-After. See all quotas, privacy and abuse controls, and automatic credentials and scoped delegation.

For AI agents and developers

Use the machine-readable catalog and OpenAPI contract. Available task guides: DOI citation checks, public DNS, and JSON, hash and text utilities.

One live check of four examples records the actual response and timestamp. This is a smoke check, not a quality certification, ongoing monitor or availability guarantee.