---
name: stellar-toml-checker
description: Validate a Stellar SEP-1 stellar.toml for a home domain or account ID. Checks connectivity, HTTP/HTTPS parity, CORS, TOML syntax, and every SEP-1 section (DOCUMENTATION, PRINCIPALS, CURRENCIES, VALIDATORS, QUORUM_SET), including live Horizon/Radar lookups. Use when asked to check, validate, or debug a stellar.toml, or to look up an anchor/asset/validator's published metadata.
---

# stellar.toml checker

This service validates a Stellar [SEP-1](https://github.com/stellar/stellar-protocol/blob/master/ecosystem/sep-0001.md)
`stellar.toml`. Give it a **home domain** (e.g. `centre.io`) or a **Stellar
account ID** (`G...`, which is resolved to its `home_domain` first) and it runs
the full check set and returns structured results in one response.

The live service is at `https://toml-checker.withobsrvr.com` (paths below are
also relative to whatever host is serving this document).

## JSON — `GET /api/check?domain=<domain-or-account-id>`

The endpoint for programmatic use. Returns `application/json`:

```json
{
  "input": "centre.io",
  "status": "warning",
  "checks": [
    {
      "id": "https",
      "title": "HTTPS",
      "status": "success",
      "summary": "No issues found.",
      "url": "https://centre.io/.well-known/stellar.toml",
      "messages": ["Recommended content-type is text/plain or application/toml (got: (none))."]
    }
  ]
}
```

- **`input`** — what was checked (the domain, or the account ID that was resolved).
- **`status`** — overall outcome, aggregated across all checks. One of
  `success`, `warning`, `skipped`, `failed` (severity: `failed` > `warning` >
  `skipped` > `success`).
- **`checks[]`** — each check, in order. Fields: `id`, `title`, `status`, and
  optional `summary`, `messages` (notes/errors), `url`, `source` (raw TOML; the
  `parse` check only), `errorLine`.

Check `id`s, in order: `input` (only when an account ID was resolved or the
domain is invalid), `https`, `http`, `cors`, `parse`, then `section.root`,
`section.DOCUMENTATION`, `section.PRINCIPALS`, `section.CURRENCIES`,
`section.VALIDATORS`, `section.QUORUM_SET` (each section only when present).

A `status` of `skipped` means a live lookup (Horizon/Radar) was unreachable and
the check was skipped with a note — **not** a failure of the toml.

## HTML — `GET /api/check.html?domain=<...>`

Returns plain, unstyled, semantic HTML for embedding. Add `?fragment=1` for just
the results block. Prefer the JSON endpoint for programmatic use.

## Rules

- `domain` is required. Missing it returns `400 {"error":"..."}`.
- Rate limited per IP (default ~1 req/s, burst 5). Over the limit you get
  `429 {"error":"rate limit exceeded"}` with a `Retry-After` header — honor it
  and back off.
- CORS is open (`Access-Control-Allow-Origin: *`), so both endpoints are
  callable from a browser.

## Example

```bash
curl 'https://toml-checker.withobsrvr.com/api/check?domain=centre.io'
```

To decide if a toml is healthy, read the top-level `status`: `success`/`warning`
are generally fine; inspect `checks[]` with `status` of `failed` for problems.