# Submit URL for verification

> Submit a URL for verification. URLs are automatically checked against Google Web Risk API. Safe URLs are auto-approved, malicious URLs are blocked. URL shorteners (bit.ly, t.co, etc.) are always blocked.

`POST https://api.zavu.dev/v1/urls`

Submit a URL for verification. URLs are automatically checked against Google Web Risk API. Safe URLs are auto-approved, malicious URLs are blocked. URL shorteners (bit.ly, t.co, etc.) are always blocked.

**Important:** SMS, one-way SMS and voice messages containing URLs require those URLs to be verified before the message can be sent; a URL that is not yet known is checked when the message is sent. Email, WhatsApp, Telegram, Instagram and Messenger messages are not checked. This endpoint allows pre-verification of URLs.

## Body

- `url` (string, required): The URL to submit for verification.

## Responses

### 200

URL already verified.

- `url` (object, required)
  - `id` (string, required)
  - `url` (string, required): The verified URL.
  - `domain` (string, required): Domain extracted from the URL.
  - `status` (string, required): Status of a verified URL. One of: `pending`, `approved`, `rejected`, `escalated`, `malicious`.
  - `approvalType` (string): How the URL was approved or rejected. One of: `manual`, `auto_web_risk`.
  - `createdAt` (string<date-time>, required)
  - `updatedAt` (string<date-time>)

### 201

URL verified and approved.

- `url` (object, required)
  - `id` (string, required)
  - `url` (string, required): The verified URL.
  - `domain` (string, required): Domain extracted from the URL.
  - `status` (string, required): Status of a verified URL. One of: `pending`, `approved`, `rejected`, `escalated`, `malicious`.
  - `approvalType` (string): How the URL was approved or rejected. One of: `manual`, `auto_web_risk`.
  - `createdAt` (string<date-time>, required)
  - `updatedAt` (string<date-time>)

### 400

Invalid request.

- `code` (string, required)
- `message` (string, required)
- `details` (object)

### 401

Unauthorized.

- `code` (string, required)
- `message` (string, required)
- `details` (object)

### 403

URL blocked (malicious, rejected, or shortener).

- `code` (string, required)
- `message` (string, required)
- `details` (object)

## Example

```bash
curl -X POST "https://api.zavu.dev/v1/urls" \
  -H "Authorization: Bearer $ZAVUDEV_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://example.com/page"
}'
```

```typescript
import Zavudev from "@zavudev/sdk";

const zavu = new Zavudev({ apiKey: process.env.ZAVUDEV_API_KEY });

const result = await zavu.urls.submitForVerification({
  url: "https://example.com/page",
});

console.log(result);
```