HTML sanitiser

curl -X POST "$DOATHING_API/v1/markup/html-sanitize" \
  -H "x-api-key: $DOATHING_KEY" \
  -H "content-type: application/json" \
  -d '{"text": "<p onclick=\"steal()\">Hello</p><script>alert(1)</script>"}'

Scripts, event handlers and dangerous URLs removed against an allowlist you control.

Sanitise HTML against a tag and attribute allowlist, removing scripts, handlers and unsafe URLs.

Input

Send either a text string or a file object. A file is decoded as UTF-8 and must be one of text/html, text/plain.

Response

The result carries your remaining balance alongside it, so you can track spend without a second call.

{
  "text": "<p>Hello</p>",
  "modified": true,
  "bytes_in": 52,
  "bytes_out": 12,
  "request_id": "37f01edb-0163-42a1-ac51-0acaef979800",
  "credits_remaining": 96
}

Cost

2 credits per call, whether it is run from the site or from the API — the credential differs, the price does not. A new account starts with 20 credits.

A rejected request still costs a credit: the authorizer decrements before the tool validates. A call rejected for a missing or invalid key is free.