# Intro Hey, I’m [Elliott](https://elliott.diy). I’m a cybersecurity student, reverse engineer, and general nerd who likes building fast, privacy-first tools that don’t suck. This API runs a bunch of background stuff I use every day. It was already working, so I figured: why not open it up to the rest of the internet? * No signups * No tracking * No fake “enterprise plans” If it helps you, great. If not, that’s fine too. ### What You’ll Find #### 🧠 AI * Chat completions * Optional image generation #### 🔍 VPN Recon * IP feeds for major providers * Combined `/vpn/all` * Live stats at `/vpn/stats` #### 🕵️ Tor Network * Exit nodes and relays * Obfs4 bridges *(restricted)* #### 🧼 Code Scanning * GitHub repo scanner * Detects stealers, miners, and webhook abuse ### Rate Limits & Access * No API key * Reasonable use is totally fine * Some endpoints are restricted to avoid abuse. See the FAQ ### Contact Found a bug? Want a feature? Just wanna say hi? 📬 # FAQ ## FAQ #### What’s the base URL? ``` https://api.elliott.diy/v1/ ``` All endpoints are nested under that path. #### Are any endpoints restricted? Yes. Some endpoints (like certain Tor bridges) are restricted to trusted sources due to the potential for abuse. Specifically, Tor bridge data can be misused to harm activists or bypass censorship in ways that endanger people. I'm not interested in enabling surveillance or helping repressive regimes block tools meant for privacy and human rights. If you have a legitimate reason to need access, you're welcome to reach out. Use the contact info on [elliott.diy](https://elliott.diy) or email me directly at . #### Is there caching? Yes. Some endpoints are cached for performance. Most VPN endpoints use a cache ttl of 6 hours. You’ll still get updated data regularly, just not on every single request. #### Can I use this in production? This is a side project. Stuff might break, move, or go offline. Use it at your own risk. That said, it's reasonably stable. #### Why are not all of your API's here? Not all of the API's my services use are publicly listed here due to all sorts of reasons. If you want to use one that's not listed please reach out. #### Who made this? It's run by Elliott — a cybersecurity student who builds random tools, breaks things on purpose, and cares a bit too much about seals. #### Is there a rate limit? Not officially, but abuse will get you blocked. Be cool. #### Where can I get updates? Check the Changelog page. #### Can I contribute? Not right now. If you’re interested in collab or ideas, reach out at . # Changelog This page documents notable changes and updates made to the API, including new endpoints, features, or behaviour modifications. *** ### 2025-06-09 * Added this change log section to GitBook. * Finalized `/tor/obfs4` endpoint documentation. ### 2025-06-08 * Cleaned up internal formatting across docs. * Combined Getting Started and Overview into a single landing page. * Renamed "Malware Scanning" section for clarity. ### 2025-06-07 * Reorganized VPN provider documentation. * Improved styling for API examples. * Added endpoint structure explanation to each provider. ### 2025-06-06 * Initial GitBook setup complete. * Basic structure for sections like VPN Providers, GitHub Scanning, and Tor added. * Sidebar and layout finalized. *** For older changes or internal revisions, feel free to reach out via the contact info on [elliott.diy](https://elliott.diy). # Chat Completion {% hint style="danger" %} **This feature is in beta.** It is free to use but may not be optimized for high-scale production environments. {% endhint %} ### **Introduction** This API provides an **AI-powered chat completion endpoint**. It takes user messages and generates responses using a lightweight AI model. The API **does not store user messages**—all responses are generated in real-time and discarded after processing. To be frank, I'm too broke to pay for D1 storage for your messages. *** ### **Endpoint** ```http POST https://api.elliott.diy/v1/ai/chat/completions ``` *** ### **Request Parameters** | Parameter | Type | Required | Description | | ---------- | ----- | -------- | -------------------------------------------------------------------------- | | `messages` | Array | ✅ Yes | A list of chat messages, where the last message is used for AI generation. | #### **Example Request** ```bash curl -X POST https://api.elliott.diy/v1/ai/chat/completions/ \ -H "Content-Type: application/json" \ -d '{ "messages": [ { "role": "user", "content": "Hello, how are you?" } ] }' ``` *** ### **Response Format** * **Content-Type:** `application/json` * **Status Codes:** * `200 OK` – Successful response * `400 Bad Request` – Invalid JSON or missing messages * `500 Internal Server Error` – AI service is unavailable #### **Example Response** ```json { "id": "cfai-12345678-1234-5678-1234-567812345678", "object": "chat.completion", "created": 1710766200, "model": "elliott-1", "choices": [ { "index": 0, "message": { "role": "assistant", "content": "I'm doing great! How can I assist you?" }, "finish_reason": "stop" } ] } ``` *** ### **Response Fields** | Field | Type | Description | | ----------------- | ------- | ---------------------------------------------------- | | `id` | String | Unique identifier for the response. | | `object` | String | Always `"chat.completion"`. | | `created` | Integer | UNIX timestamp of when the response was generated. | | `model` | String | Always `"elliott-1"`. | | `choices` | Array | Contains AI-generated message(s). | | `message.role` | String | Always `"assistant"`. | | `message.content` | String | The AI-generated response. | | `finish_reason` | String | Indicates why the response stopped (e.g., `"stop"`). | *** ### **Model Information** * **Base Model Used:** `@hf/google/gemma-7b-it` * **Custom Model Name:** `"elliott-1"` (I'm so creative) * The model generates responses based on the **last user message** in the request. # Image Generation # GitHub Repo Scanner This endpoint scans a specified GitHub repository for potentially malicious code. It identifies risky executions, known encrypted payloads, obfuscated scripts and common malware patterns. The API provides detailed detections with file names, line numbers, and decoded content (if applicable). {% hint style="warning" %} This API is for non-commercial use. If you would like to use it in a commercial product or in a way that generates revenue, please contact me at ****. The service is not designed to scale for commercial demands, and I want to maintain a high quality of service for existing users. {% endhint %} *** ### **Endpoint** ```http https://api.elliott.diy/v1/malware/github?repo=/ ``` *** ### **Request Parameters** | Parameter | Type | Required | Description | | --------- | ------ | -------- | ------------------------------------------------------------- | | `repo` | string | ✅ Yes | The GitHub repository to scan, formatted as `/`. | *** ### **Example Request** ```bash curl "https://api.elliott.diy/v1/malware/github?repo=grobarqxd6996/Discord-Boost-Tool" ``` *** ### **Response Format** * **Content-Type:** `application/json` * **Status Codes:** * `200 OK`: Successfully analyzed the repository. * `400 Bad Request`: Invalid or missing repository name. * `500 Internal Server Error`: An error occurred during analysis. **Example Response (Defanged)** ```json { "detections": [ { "file": "muck-stealer.py", "line": 22, "content": "import subprocess; subprocess.run(['pip', 'install', 'cryptography'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL); ...", "decoded": null } ], "urls": null, "suspicious": true } ``` *** ### **Response Fields** | Field | Type | Description | | ------------ | -------------- | --------------------------------------------------------------------- | | `detections` | Array | List of detected suspicious code patterns. | | `file` | String | Name of the file where the detection occurred. | | `line` | Integer | Line number where the suspicious content was found. | | `content` | String | Snippet of the detected code. | | `decoded` | String or null | Decoded content if applicable. | | `urls` | Array or null | Extracted URLs (if any). | | `suspicious` | Boolean | Indicates whether the repository contains potentially malicious code. | *** ### **Usage Notes** * The API **flags suspicious patterns** but does not guarantee accuracy—manual review is recommended. * If `decoded` is `null`, the script may contain **encrypted or obfuscated** code that requires further analysis. * If the payload is heavily obfuscated the API may fail due to internal database constraints. * Designed to help detect **malware, info stealers, and automated threats** in repositories. # Supported Providers ## Supported VPN Providers These endpoints expose known VPN exit IPs for detection, filtering, or OSINT. Data is pulled from provider APIs and updated regularly. **Base path:** `https://api.elliott.diy/v1/vpn/` You can request either plaintext (default) or JSON output using the `?format=json` query parameter. *** ### Supported Endpoints | Provider | Endpoint | | ---------- | ----------------- | | PIA | `/vpn/pia` | | Mullvad | `/vpn/mullvad` | | Windscribe | `/vpn/windscribe` | | IVPN | `/vpn/ivpn` | | NordVPN | `/vpn/nordvpn` | Additional endpoints: * `/vpn/all` – returns all combined IPs * `/vpn/stats` – returns provider statistics *** ### Response Formats #### Plain Text (default) ```http GET /vpn/pia ``` ``` 138.199.32.166 62.133.47.18 84.239.5.9 ... ``` #### JSON format ```http GET /vpn/pia?format=json ``` ```json { "ips": [ "138.199.32.167", "138.199.32.162", "173.239.226.149", ... ] } ``` *** ### Statistics Endpoint ```http GET /vpn/stats ``` **Sample Response:** ```json { "total_ips": 52341, "providers": { "mullvad": 6381, "pia": 12984, "windscribe": 8042, "ivpn": 2670, "nordvpn": 22364 }, "last_updated": "2025-06-08T04:10:00Z" } ``` *** ### Update Frequency Feeds update approximately every 6 hours. *** ### Notes * Append `?format=json` for JSON responses * IP lists default to plain text * `/vpn/stats` always returns JSON # Exit Nodes ## Tor Exit Nodes This endpoint provides a list of known Tor exit nodes currently active on the Tor network. **Endpoint:**\ `https://api.elliott.diy/v1/tor/exit` *** ### Response Format You can choose between plain text or JSON output: * **Plaintext (default)**\ Each IP is listed on a new line. ``` https://api.elliott.diy/v1/tor/exit ``` * **JSON**\ Use the `?format=json` query parameter: ``` https://api.elliott.diy/v1/tor/exit?format=json ``` ```json { "ips": [ "185.220.101.4", "185.220.101.9" ] } ``` *** ### Notes * The list is pulled from the Tor Project's bulk exit list. * This data is cached for 6 hours to reduce load and provide fast responses. * Useful for filtering, blocking, or analyzing Tor-origin traffic. # Tor Relays (Non-Exit) This endpoint returns IP addresses for all known **non-exit** Tor relays — nodes that participate in the Tor network but do not allow traffic to leave to the open internet. **Endpoint:**\ `https://api.elliott.diy/v1/tor/relay` *** ### Response Format * **Plaintext (default)**\ Lists each IP on a new line: ``` https://api.elliott.diy/v1/tor/relay ``` * **JSON**\ Use `?format=json` to return a structured response: ``` https://api.elliott.diy/v1/tor/relay?format=json ``` ```json { "ips": [ "185.220.100.253", "185.220.101.40" ] } ``` *** ### Notes * Only includes relays **not flagged as Exit** by the Tor network. * Data is pulled from the full Tor consensus via the Tor Project. * Useful for detecting infrastructure used within the Tor network without implicating actual exit traffic. * Cache refreshed every 6 hours. * Use the Tor Exit Node list if you're only interested in endpoints where traffic leaves the Tor network. # Tor Bridges This endpoint returns IP addresses for known **Tor bridges**, which are designed to help users in censored regions access the Tor network. These bridges are deliberately harder to discover and may not always be complete or public. **Endpoint:**\ `https://api.elliott.diy/v1/tor/obfs4` Currently, only **obfs4** bridges are supported. *** ### Response Format * **Plaintext (default)**\ Each bridge IP on a new line: ``` https://api.elliott.diy/v1/tor/obfs4 ``` * **JSON**\ Add `?format=json` to receive a structured object: ``` https://api.elliott.diy/v1/tor/obfs4?format=json ``` ```json { "ips": [ "x.x.x.x", "y.y.y.y" ] } ``` *** ### Access Restrictions Due to the sensitive nature of bridge relays, this endpoint is **restricted** by default. Bridges are a critical tool for bypassing censorship in oppressive regimes, and I avoid contributing to bridge enumeration that could block access for vulnerable users. If you have a legitimate use case (e.g., research, censorship circumvention, threat intel), contact me via email or any listed method on [elliott.diy](https://elliott.diy) to request access. *** ### Notes * Only obfs4 bridges are currently supported. * Data is curated and not guaranteed to be comprehensive. * Intended for responsible use only. * Cache is refreshed every 6 hours.