Security & Auth APIs | Thousand API

JWT Decode

Decodes a JWT and returns the header, payload, and expiration status. Does not verify signatures. Useful for debugging token contents and expiry.

MCP tool: security.decode_jwt

GET /v1/jwt/decode

JWTs use Base64URL with three dot-separated parts. You can pass the token as a query parameter as-is, but URL-encode it if the token contains `+` or `=`.

Parameters:

Parameter	Type	Required	Description
token	string	✓	JWT token to decode

Request example:

curl "https://api.thousand-api.com/v1/jwt/decode?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMTIzIiwiZXhwIjoxNzE2MDAwMDAwfQ.signature" \
  -H "x-api-key: YOUR_API_KEY"

Response example:

{
  "header": { "alg": "HS256", "typ": "JWT" },
  "payload": { "sub": "user123", "exp": 1716000000 },
  "is_expired": false,
  "expires_at": "2024-05-18T00:00:00.000Z",
  "issued_at": null
}

URL Health Check

Checks a URL's HTTP status code, response time, and SSL certificate details. Combine with network.resolve_url to inspect the final destination of shortened URLs.

MCP tool: network.inspect_url

GET /v1/url/inspect

Parameters:

Parameter	Type	Required	Description
url	string	✓	URL to inspect (http/https only)

Request example:

curl "https://api.thousand-api.com/v1/url/inspect?url=https%3A%2F%2Fwww.thousand-api.com" \
  -H "x-api-key: YOUR_API_KEY"

Response example:

{
  "url": "https://www.thousand-api.com",
  "status_code": 200,
  "response_time_ms": 234,
  "reachable": true,
  "headers": {
    "content-type": "text/html",
    "x-frame-options": "DENY"
  },
  "ssl": {
    "valid": true,
    "expires_at": "2027-01-01T00:00:00.000Z",
    "days_remaining": 220,
    "issuer": "Amazon"
  }
}

Unit Conversion

Converts values between units for length, mass, temperature, area, volume, speed, and data sizes. No external APIs; accurate math via mathjs.

MCP tool: convert.unit

Categories: length (m, km, mile, foot, inch, etc.), mass (kg, g, lb, oz, etc.), temperature (celsius, fahrenheit, kelvin), area (m2, ha, acre, sqft, etc.), volume (l, ml, gallon, cup, etc.), speed (m/s, km/h, mph, knot, etc.), data (byte, KB, MB, GB, TB, KiB, MiB, etc.)

GET /v1/unit/convert

Parameters:

Parameter	Type	Required	Description
value	number	✓	Value to convert
from	string	✓	Source unit
to	string	✓	Target unit

Request example:

curl "https://api.thousand-api.com/v1/unit/convert?value=1&from=km&to=mile" \
  -H "x-api-key: YOUR_API_KEY"

Response example:

{
  "value": 1,
  "from": "km",
  "to": "mile",
  "result": 0.621371,
  "formula": "1 km = 0.621371 mile"
}

Hash Generation

Generate MD5, SHA-1, SHA-256, or SHA-512 hashes from text. Uses Node.js built-in crypto with no external dependencies.

MCP tool name: security.generate_hash

URL-encode the text query parameter when it contains spaces or special characters (e.g. hello world → hello+world or hello%20world).

GET /v1/hash/generate

Parameters:

Parameter	Type	Required	Description
text	string	✓	Text to hash (max 100KB)
algorithm	string	-	md5 / sha1 / sha256 / sha512 (default: sha256)

Request example:

curl "https://api.thousand-api.com/v1/hash/generate?text=hello+world&algorithm=sha256" \
  -H "x-api-key: YOUR_API_KEY"

Response example:

{
  "text": "hello world",
  "algorithm": "sha256",
  "hash": "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9",
  "length": 64
}

HMAC Sign & Verify

Generate or verify HMAC signatures. Supports SHA-256, SHA-512, SHA-1, and MD5. Uses Node.js built-in crypto with no external dependencies. Useful for validating GitHub, Stripe, and Slack webhook signatures.

MCP tool name: security.generate_hmac

POST /v1/crypto/hmac

Parameters:

Parameter	Type	Required	Description
mode	string	✓	sign (generate) / verify (compare)
algorithm	string	✓	sha256 / sha512 / sha1 / md5
secret	string	✓	HMAC secret key (max 64KB)
message	string	✓	Message to sign or verify (max 64KB)
encoding	string	-	hex / base64 (default: hex)
signature	string	-	Signature to verify (required when mode is verify)

Response fields (mode: sign):

Parameter	Type	Description
mode	string	sign
algorithm	string	HMAC algorithm used
encoding	string	Output encoding (hex / base64)
signature	string	Generated HMAC signature

Response fields (mode: verify):

Parameter	Type	Description
mode	string	verify
algorithm	string	HMAC algorithm used
encoding	string	Output encoding (hex / base64)
verified	boolean	Whether the signature matched (timing-safe compare)

Sign example (GitHub Webhooks style):

Request example:

curl -X POST "https://api.thousand-api.com/v1/crypto/hmac" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "mode": "sign",
    "algorithm": "sha256",
    "secret": "your-webhook-secret",
    "message": "{\"action\":\"opened\",\"number\":1}"
  }'

Response example:

{
  "mode": "sign",
  "algorithm": "sha256",
  "encoding": "hex",
  "signature": "a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456"
}

Verify example (incoming webhook validation):

Request example:

curl -X POST "https://api.thousand-api.com/v1/crypto/hmac" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "mode": "verify",
    "algorithm": "sha256",
    "secret": "your-webhook-secret",
    "message": "{\"action\":\"opened\",\"number\":1}",
    "signature": "sha256=abc123..."
  }'

Response example:

{
  "mode": "verify",
  "algorithm": "sha256",
  "encoding": "hex",
  "verified": true
}

Base64-encoded output example:

Request example:

curl -X POST "https://api.thousand-api.com/v1/crypto/hmac" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "mode": "sign",
    "algorithm": "sha256",
    "secret": "my-secret",
    "message": "hello world",
    "encoding": "base64"
  }'

Response example:

{
  "mode": "sign",
  "algorithm": "sha256",
  "encoding": "base64",
  "signature": "K8D9a2..."
}

TOTP Generate & Validate

Generates and validates RFC 6238 TOTP (time-based one-time password) codes using deterministic HMAC-SHA1 and time-step math. Compatible with Google Authenticator and similar apps. Optional timestamp (UNIX seconds) overrides the evaluation time for RFC 6238 test vectors. QR code / otpauth:// URI generation is out of scope — pair with convert.get_qrcode if needed.

MCP tool name: security.generate_totp

POST /v1/security/totp

Parameters:

Parameter	Type	Required	Description
action	string	✓	generate (create a code) / validate (verify a code)
secret	string	✓	Base32-encoded shared secret (A-Z2-7; lowercase, spaces, and padding allowed)
code	string	-	Code to verify (required when action is validate; length must match digits)
period	integer	-	Time-step size in seconds (default: 30)
digits	integer	-	Code length 6–8 (default: 6)
window	integer	-	Allowed time-step skew (±). Validate only. Default 1, max 10
timestamp	number	-	UNIX seconds to evaluate (optional). Omit for current time; use for RFC 6238 vectors and deterministic replay

Response fields for action: generate:

Parameter	Type	Description
action	string	generate
code	string	Generated TOTP code (zero-padded)
expires_in	integer	Seconds remaining in the current time step

Response fields for action: validate:

Parameter	Type	Description
action	string	validate
valid	boolean	Whether the code matched within the allowed window
matched_window	integer \| null	Matching offset (−window…+window), or null if no match

Generate example:

Request example:

curl -X POST "https://api.thousand-api.com/v1/security/totp" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "generate",
    "secret": "GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ"
  }'

Response example:

{
  "action": "generate",
  "code": "483920",
  "expires_in": 18
}

Validate example:

Request example:

curl -X POST "https://api.thousand-api.com/v1/security/totp" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "validate",
    "secret": "GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ",
    "code": "483920",
    "window": 1
  }'

Response example:

{
  "action": "validate",
  "valid": true,
  "matched_window": 0
}

UUID Generate & Validate

Generate cryptographically secure UUID v4 strings and validate UUID format (versions 1-5). Uses Node.js crypto.randomUUID() only; no external dependencies.

MCP tool names: security.generate_uuid, security.validate_uuid

GET /v1/uuid/generate

Parameters:

Parameter	Type	Required	Description
count	integer	-	Number to generate (1-100, default 1)
version	string	-	UUID version (v4 only, default v4)

Response fields:

Parameter	Type	Description
version	string	Generated UUID version (v4)
count	integer	Number of UUIDs generated
uuids	string[]	Array of generated UUIDs

Generate multiple UUIDs (count: 3):

Request example:

curl "https://api.thousand-api.com/v1/uuid/generate?count=3&version=v4" \
  -H "x-api-key: YOUR_API_KEY"

Response example:

{
  "version": "v4",
  "count": 3,
  "uuids": [
    "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    "6ecc5f60-7e11-4f4a-9b2c-1a2b3c4d5e6f",
    "a1b2c3d4-e5f6-4789-ab01-234567890abc"
  ]
}

POST /v1/uuid/validate

Parameters:

Parameter	Type	Required	Description
values	string[]	✓	Strings to validate (1-100 items)

Response fields:

Parameter	Type	Description
results	object[]	Per-input validation results
results[].value	string	Input value echoed back
results[].valid	boolean	Whether the string is a valid UUID
results[].version	integer \| null	Version 1-5 when valid
results[].variant	string \| null	e.g. RFC 4122 when valid
all_valid	boolean	True when every result is valid

Validate a mix of valid and invalid strings:

Request example:

curl -X POST "https://api.thousand-api.com/v1/uuid/validate" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "values": [
      "550e8400-e29b-41d4-a716-446655440000",
      "not-a-uuid",
      "12345"
    ]
  }'

Response example:

{
  "results": [
    {
      "value": "550e8400-e29b-41d4-a716-446655440000",
      "valid": true,
      "version": 4,
      "variant": "RFC 4122"
    },
    {
      "value": "not-a-uuid",
      "valid": false,
      "version": null,
      "variant": null
    },
    {
      "value": "12345",
      "valid": false,
      "version": null,
      "variant": null
    }
  ],
  "all_valid": false
}

MCP workflow (generate → validate):

1. Generate IDs with security.generate_uuid:
   { "count": 2 }

2. Validate returned uuids with security.validate_uuid:
   { "values": ["<uuid-1>", "<uuid-2>"] }

→ When all_valid is true, the IDs are RFC 4122-compliant.

Barcode Validate & Convert

Validates ISBN-10, ISBN-13, JAN-13 (EAN-13), and UPC-A barcodes and converts between ISBN-10 and ISBN-13. Check digits use standard algorithms (ISBN-10: weighted sum mod 11; EAN-13: alternating 1/3 weights mod 10). No external dependencies.

MCP tool: security.validate_barcode

Supported barcode types

Parameter	Description
ISBN-10	10-digit book code; check digit 0-9 or X (=10)
ISBN-13	13-digit book code; EAN-13 starting with 978 or 979
JAN-13	13-digit Japanese product code (EAN-13 not starting with 978/979)
UPC-A	12-digit North American product code (validated as EAN-13 with leading 0)

GET /v1/validate/barcode

Parameters:

Parameter	Type	Required	Description
code	string	✓	Barcode to validate (hyphens optional, max 100 chars)
type	string	-	Barcode type hint (auto-detected when omitted): ISBN-10, ISBN-13, JAN-13, EAN-13, UPC-A

Response fields:

Parameter	Type	Description
input	string	Input code as provided
type	string	Detected type: ISBN-10, ISBN-13, JAN-13, or UPC-A
valid	boolean	Whether the check digit is correct
check_digit	string	Expected check digit character
normalized	string	Hyphen-stripped, uppercased code
conversions	object \| null	ISBN conversions (null for non-ISBN types)
conversions.isbn10	string \| null	ISBN-13→ISBN-10 (978 prefix only; 979 returns null)
conversions.isbn13	string \| null	ISBN-10→ISBN-13 conversion result

ISBN-13 validation example:

Request example:

curl "https://api.thousand-api.com/v1/validate/barcode?code=978-4-06-519981-7" \
  -H "x-api-key: YOUR_API_KEY"

Response example:

{
  "input": "978-4-06-519981-7",
  "type": "ISBN-13",
  "valid": true,
  "check_digit": "7",
  "normalized": "9784065199817",
  "conversions": {
    "isbn10": "4-06-519981-6",
    "isbn13": "978-4-06-519981-7"
  }
}

ISBN-10 validation example (check digit X):

Request example:

curl "https://api.thousand-api.com/v1/validate/barcode?code=0-8044-2957-X" \
  -H "x-api-key: YOUR_API_KEY"

Response example:

{
  "input": "0-8044-2957-X",
  "type": "ISBN-10",
  "valid": true,
  "check_digit": "X",
  "normalized": "080442957X",
  "conversions": {
    "isbn10": "0-8044-2957-X",
    "isbn13": "978-0-80-442957-6"
  }
}

Auto-detection example (type omitted):

Request example:

curl "https://api.thousand-api.com/v1/validate/barcode?code=4901234567894" \
  -H "x-api-key: YOUR_API_KEY"

Response example:

{
  "input": "4901234567894",
  "type": "JAN-13",
  "valid": true,
  "check_digit": "4",
  "normalized": "4901234567894",
  "conversions": null
}

Validate Luhn Check Digit

Validates check digits using the Luhn algorithm (mod 10). Used for credit card numbers, IMEI numbers, and other identifiers. No external dependencies.

MCP tool: security.validate_luhn

format hints (digit-count rules)

Parameter	Description
credit_card	13–19 digits (typical credit card numbers)
imei	Exactly 15 digits (IMEI numbers)
generic	1–99 digits (no digit-count check)

POST /v1/validate/luhn

Parameters:

Parameter	Type	Required	Description
value	string	✓	Number to validate (hyphens/spaces optional, max 200 chars)
format	string	-	Format hint (default: generic): credit_card, imei, or generic

Response fields:

Parameter	Type	Description
value	string	Input value as provided
normalized	string	Hyphen/space-stripped digit string
valid	boolean	Whether the Luhn check digit is correct
check_digit	string	Actual trailing check digit
expected_check_digit	string	Present only when valid is false; expected check digit
format	string	Request format (default: generic)
length	number	Digit count of normalized value
format_valid	boolean	Whether digit count matches the format hint (independent of Luhn validity)

Valid credit card number example:

Request example:

curl -X POST "https://api.thousand-api.com/v1/validate/luhn" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "value": "4532015112830366",
    "format": "credit_card"
  }'

Response example:

{
  "value": "4532015112830366",
  "normalized": "4532015112830366",
  "valid": true,
  "check_digit": "6",
  "format": "credit_card",
  "length": 16,
  "format_valid": true
}

Invalid number example (returns expected_check_digit):

Request example:

curl -X POST "https://api.thousand-api.com/v1/validate/luhn" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "value": "4532015112830367"
  }'

Response example:

{
  "value": "4532015112830367",
  "normalized": "4532015112830367",
  "valid": false,
  "check_digit": "7",
  "expected_check_digit": "6",
  "format": "generic",
  "length": 16,
  "format_valid": true
}

Security & auth