Extract all links from a web page

**Method:** POST
**Apiosk URL:** https://gateway.apiosk.com/apyhub-extract-links/extract/links/url
**Request content type:** application/json
**Response content type:** application/json

What it does

Extracts all hyperlinks from the web page at the given URL and returns them as absolute URLs. If secure_mode is enabled, the URL is checked against a malicious-URL database before the page is fetched.

Request Body

| Parameter | Type | Mandatory | Description |
| --------- | ---- | --------- | ----------- |
| url | String | Yes | The URL of the page to extract links from. Protocol is optional — http:// is prepended if absent. |
| user_agent | String | No | Custom User-Agent header sent when fetching the URL. |
| secure_mode | Boolean | No | When true, the URL is checked against the malicious-URL database before fetching. Default: true. |
| accept_language | String | No | Custom Accept-Language header sent when fetching the URL. |

Response

Returns a JSON object with a required data field. On a normal response, data is an object containing a links array of strings with the absolute URLs found on the page. If the URL is detected as malicious, data is an object containing url as a string, threat as a string, and reported_malicious as a boolean.

| Parameter | Type | Mandatory | Description |
| --------- | ---- | --------- | ----------- |
| data | Object | Yes | Wrapper object for the result. It can contain either the extracted links or malicious-URL details, depending on the outcome. |
| data.links | String Array | No | Absolute URLs of all hyperlinks found on the page. |
| data.url | String | No | The URL that was flagged as malicious. |
| data.threat | String | No | Threat label returned for the malicious URL. |
| data.reported_malicious | Boolean | No | Indicates whether the URL was reported as malicious. |

Quickstart

Send a webpage URL to extract the links found on that page.

bash
curl -X POST "https://gateway.apiosk.com/apyhub-extract-links/extract/links/url" \
-H "PAYMENT-SIGNATURE: $PAYMENT_SIGNATURE" \
-H "Content-Type: application/json" \
-d '{
"url": "https://apyhub.com"
}'

What you'll get back

Returns a JSON object with a data field. On a normal response, data is an object containing a links array of absolute URLs found on the page; if the URL is flagged as malicious, data is an object with url, threat, and reported_malicious fields.

json
{
"data": {
"links": [
"https://apyhub.com/docs",
"https://apyhub.com/pricing"
]
}
}

Payment and authentication

Do not send an apy-token. Apiosk injects the APYHub credential server-side. The first unpaid request returns HTTP 402 Payment Required with a PAYMENT-REQUIRED header. Sign an accepted USDC payment and retry the same request with the proof in PAYMENT-SIGNATURE (or use an Apiosk/x402-aware agent client that performs this exchange automatically).

The $PAYMENT_SIGNATURE placeholder in the example is the signed proof obtained from that initial 402 response.

Source

Parameter definitions and limits were synchronized from [APYHub's official documentation](https://apyhub.com/apyhub/service/extract-links-from-webpage) on 2026-07-18.