Apache-2.0 OSS, hosted no API key to try open endpoints

Litmus

A rendered-page receipt API. Give it a public URL; get back clean Markdown, a PDF of the exact render, and content hashes a reviewer can cite.

Not a scraper. Scraping any URL is a commodity with funded incumbents. The thing that is actually hard, and that nobody hands you, is proof of what a page said — rendered in a real browser, hashed, and reproducible. That is what this endpoint returns.

What is upstream, and what is ours. The browser is microsoft/playwright (Apache-2.0). The article extractor is mozilla/readability (Apache-2.0). HTML→Markdown is mixmark-io/turndown (MIT). We did not write those, and we say so everywhere. We host them, we make the receipts, and we run the browsers.

Try it — this form calls the live API from your browser

API

curl -X POST https://$HOST/v1/receipt \
  -H 'content-type: application/json' \
  -d '{"url":"https://example.com/notice"}'

Response shape:

{
  "ok": true,
  "final_url": "https://…", "http_status": 200,
  "fetched_at": "2026-10-08T04:40:00.000Z",
  "title": "…", "byline": "…", "excerpt": "…",
  "markdown": "# …",
  "word_count": 4210,
  "hashes": {
    "content_sha256":        "…",  // stable if content is stable
    "rendered_html_sha256":  "…",
    "render_pdf_sha256":     "…"
  },
  "artifact": { "type": "application/pdf", "bytes": 284113, "sha256": "…" },
  "renderer": { "browser": "chromium 155 (headless)", "driver": "microsoft/playwright (Apache-2.0)" }
}

Endpoints

Method	Path	Purpose
POST	`/v1/receipt`	Render a URL, return Markdown + PDF + hashes
GET	`/v1/receipt?url=…`	Same, query-string form
GET	`/v1/oss`	The upstream projects this is built on
GET	`/health`	Liveness + which OSS is mounted

Behaviour worth knowing before you rely on it

SSRF guard is on. Requests to loopback, private ranges (10/8, 172.16/12, 192.168/16), CGNAT (100.64/10) and cloud metadata (169.254.169.254) are rejected with 400. This is a public endpoint that fetches caller-supplied URLs; without that guard it would be an open proxy into the host's network.
content_sha256 is deterministic. Fetch the same unchanged page twice and the hash matches. That is what makes it a receipt and not a timestamp. Verified by an automated test, not by assertion.
No auto-filing, no auto-attestation. A receipt is evidence a human reviews. Anything that commits you to a regulator stays a human decision — that is the product, not a missing feature.
JS-rendered pages work (real Chromium), and we wait for load with a bounded timeout rather than network-idle, which hangs on pages that long-poll.

Status & pricing

Pre-launch. The API is running and free to call, with no key. Billing is not switched on yet — it is gated on a human signing up with a payment processor, which is a Board-level dependency, not a code problem. Until that is done there is no charge and no card is collected, and this page will say so.

Intended pricing once billing is live: free for 100 receipts/month, $20/mo for 2,000, $90/mo for 15,000, overage $0.006/receipt. Draft pricing, not yet collected.

Litmus is a hosted service built entirely on permissively-licensed open source. Upstream authors retain all copyright; see THIRD-PARTY-NOTICES.md in the source repo for full attribution and the Apache-2.0 §4 obligations.