Submitting URLs
A submission asks urlquery to open a URL in an isolated browser, record everything that happens, and publish the result as a report. This page explains how to submit, what each option changes, and how to choose options that produce useful evidence.
Where to submit
| Interface | Use it for |
|---|---|
| Submit on urlquery.net | Interactive analysis. You see the analysis progress and open the report when it finishes. |
POST /public/v2/submissions | Scripts and pipelines. See the Submission API. |
MCP submit_url and submit_status | Agents. See the MCP tool reference. |
Before you submit
Search first. If the URL or its host was analyzed recently, the existing report may already answer the question, and it does not tell anyone that you are looking.
curl --fail-with-body --get \
--header "x-apikey: ${URLQUERY_API_KEY}" \
--data-urlencode 'query=url.fqdn:login.example.com' \
https://api.urlquery.net/public/v2/reports/search
Submit only URLs you are authorized to analyze, and remove personal data and secrets first. See safe use.
Options
| Option | Values | Default | What it changes |
|---|---|---|---|
| URL | An http or https URL | Required | The page to open. The domain must resolve, and it must not resolve to a private network address. |
Visibility (access) | public, restricted, private | public | Who can see the report. See choosing visibility. Visibility also sets how long the report is kept; see data retention. |
Run time (run_time) | Seconds | 35 on the website, 26 through the API and MCP | How long the browser stays on the page. The website offers 35, 60, or 120 seconds; the API and MCP accept 20 to 200. |
User agent (useragent) | Any browser user-agent string | A current desktop Firefox | The browser identity the page sees. The website offers common presets. |
Device (device_type) | desktop, mobile, tablet | desktop | The device type reported to the page. The website always uses desktop. |
Tags (tags) | Letters, digits, and _ | None | Your own labels, stored as submit.tags. Use them to find your submissions later, for example submit.tags:case_1234 in a search. The API and MCP reject tags with other characters. |
Metadata (meta) | String key-value pairs | None | Your own context, such as a case ID. Visible only to you and your team. Never put secrets here. |
sanitize_url | true, false | false | Replaces a base64-encoded email address at the end of the URL path with a placeholder address. It does not remove any other personal data. |
Choosing options
Choosing visibility
| Choose | When |
|---|---|
public | The URL contains nothing confidential or personal, and the finding helps others. Public reports are kept longest. |
restricted | The URL or its content should not be broadly public, but sharing with accounts on plans with restricted access is acceptable. |
private | The URL relates to your organization, a customer, or a victim. Only you and your team can see the report. |
Visibility does not make a sensitive URL safe to submit: the analysis still visits it. See report visibility.
Choosing a run time
Most pages finish loading within the default. Increase the run time when:
- the page waits before redirecting or before showing content, as many phishing kits and fake CAPTCHA pages do;
- the page loads content in stages, such as a payload download after a countdown.
A longer run time takes longer to finish and captures more background traffic.
Choosing a user agent and device
Kits often show different content to different visitors, or nothing to automated ones. If a report looks empty or benign but you expect otherwise, submit again with a different user agent, for example a mobile browser for a URL sent by SMS. Compare the two reports' final page and traffic.
After you submit
The analysis moves through these states: queued, processing (the browser is visiting the URL), analyzing, and done or failed. A normal analysis finishes in about 30 seconds plus the run time, depending on load.
- The report ID is assigned when you submit. The report can be read once the analysis is done.
- A failed analysis produces no report. Common causes are errors while running the browser or a blocked domain. Submitting again later can succeed.
- The result is a report you can read on the website or through the Report API. Start with the overview.
Removing a report
If a report exposes personal or confidential data, use Request review on the report page. Choose a reason and whether you want the report deleted or made private, and leave a comment and contact address. The report is hidden from everyone, including you, as soon as the request is made, until it has been reviewed. You can also contact support.
The owner of a report can delete it with DELETE /public/v2/reports/{report_id}. It disappears from listings and search at once; stored content is removed later by retention.