Check Content for Dangerous Substrings landing.repo.checkContent

If you are developing integrations for Bitrix24 using AI tools (Codex, Claude Code, Cursor), connect to the MCP server so that the assistant can utilize the official REST documentation.

Scope: landing

Who can execute the method: user with View access permission in the Sites section

The method landing.repo.checkContent checks content through a sanitizer.

Method Parameters

Required parameters are marked with *

Name
type

Description

content^*
string

Content to be checked

splitter
string

A delimiter that marks dangerous fragments in content.

Default: #SANITIZE#

Code Examples

How to Use Examples in Documentation

Example of content checking, where:

content — HTML to be checked
splitter — marker string for dangerous fragments

cURL (Webhook)

cURL (OAuth)

PHP

BX24.js

PHP CRest

curl -X POST \
          -H "Content-Type: application/json" \
          -d '{
            "content": "<div style=\"color:red\" onclick=\"alert(1)\"><iframe src=\"//evil.com\"></iframe></div>",
            "splitter": "#AAA#"
          }' \
          "https://**put.your-domain-here**/rest/**user_id**/**webhook_code**/landing.repo.checkContent.json"

curl -X POST \
          -H "Content-Type: application/json" \
          -d '{
            "content": "<div style=\"color:red\" onclick=\"alert(1)\"><iframe src=\"//evil.com\"></iframe></div>",
            "splitter": "#AAA#",
            "auth": "**put_access_token_here**"
          }' \
          "https://**put.your-domain-here**/rest/landing.repo.checkContent.json"

try
        {
        	const response = await $b24.callMethod(
        		'landing.repo.checkContent',
        		{
        			content: '<div style="color:red" onclick="alert(1)"><iframe src="//evil.com"></iframe></div>',
        			splitter: '#AAA#'
        		}
        	);
        
        	const result = response.getData().result;
        	console.info(result);
        }
        catch (error)
        {
        	console.error(error);
        }

try {
            $response = $b24Service
                ->core
                ->call(
                    'landing.repo.checkContent',
                    [
                        'content' => '<div style="color:red" onclick="alert(1)"><iframe src="//evil.com"></iframe></div>',
                        'splitter' => '#AAA#',
                    ]
                );
        
            $result = $response
                ->getResponseData()
                ->getResult();
        
            echo 'Success: ' . print_r($result, true);
        } catch (Throwable $e) {
            error_log($e->getMessage());
            echo 'Error checking content: ' . $e->getMessage();
        }

BX24.callMethod(
            'landing.repo.checkContent',
            {
                content: '<div style="color:red" onclick="alert(1)"><iframe src="//evil.com"></iframe></div>',
                splitter: '#AAA#'
            },
            function(result)
            {
                if (result.error())
                {
                    console.error(result.error());
                }
                else
                {
                    console.info(result.data());
                }
            }
        );

require_once('crest.php');
        
        $result = CRest::call(
            'landing.repo.checkContent',
            [
                'content' => '<div style="color:red" onclick="alert(1)"><iframe src="//evil.com"></iframe></div>',
                'splitter' => '#AAA#',
            ]
        );
        
        if (isset($result['error']))
        {
            echo 'Error: ' . $result['error_description'];
        }
        else
        {
            echo '<pre>';
            print_r($result['result']);
            echo '</pre>';
        }

Response Handling

HTTP Status: 200

{
            "result": {
                "is_bad": true,
                "content": "\u003Cdiv style=\u0022color:red\u0022 oncl#AAA#ick=\u0022alert(1)\u0022\u003E\u003Cifr#AAA#ame src=\u0022\/\/evil.com\u0022\u003E\u003C\/iframe\u003E\u003C\/div\u003E"
            },
            "time": {
                "start": 1774952664,
                "finish": 1774952665.017161,
                "duration": 1.0171608924865723,
                "processing": 0,
                "date_start": "2026-03-31T13:24:24+02:00",
                "date_finish": "2026-03-31T13:24:25+02:00",
                "operating_reset_at": 1774953265,
                "operating": 0
            }
        }

Returned Data

Name `type`	Description
result `object`	Result of the check more details
time `time`	Information about the request execution time

Type result

Name `type`	Description
is_bad `boolean`	Indicator of dangerous fragments in the content
content `string`	Content after being processed by the sanitizer

Error Handling

HTTP Status: 400

{
            "error": "ERROR_ARGUMENT",
            "error_description": "The value of an argument 'content' has an invalid type",
            "argument": "content"
        }

{
            "error": "ACCESS_DENIED",
            "error_description": "Insufficient permissions."
        }

Name `type`	Description
error `string`	String error code. It may consist of digits, Latin letters, and underscores
error_description `error_description`	Textual description of the error. The description is not intended to be shown to the end user in its raw form

Possible Error Codes

Code	Description	Value
`MISSING_PARAMS`	Not enough parameters for the call, missing: content	Method call without `content`
`ERROR_ARGUMENT`	The value of an argument 'content' has an invalid type	Parameter `content` passed in an incorrect type
`ACCESS_DENIED`	Insufficient permissions	User did not pass general access checks
`insufficient_scope`	Token lacks sufficient scope	Token does not contain `landing` scope

Statuses and System Error Codes

HTTP Status: 20x, 40x, 50x

The errors described below may occur when calling any method.

Status	Code Error Message	Description
`500`	`INTERNAL_SERVER_ERROR` Internal server error	An internal server error has occurred. Please contact the server administrator or Bitrix24 technical support
`500`	`ERROR_UNEXPECTED_ANSWER` Server returned an unexpected response	An internal server error has occurred. Please contact the server administrator or Bitrix24 technical support
`503`	`QUERY_LIMIT_EXCEEDED` Too many requests	The request intensity limit has been exceeded
`405`	`ERROR_BATCH_METHOD_NOT_ALLOWED` Method is not allowed for batch usage	The current method is not permitted for calls using batch
`400`	`ERROR_BATCH_LENGTH_EXCEEDED` Max batch length exceeded	The maximum length of parameters passed to the batch method has been exceeded
`401`	`NO_AUTH_FOUND` Wrong authorization data	Invalid access token or webhook code
`400`	`INVALID_REQUEST` Https required	The HTTPS protocol is required for method calls
`503`	`OVERLOAD_LIMIT` REST API is blocked due to overload	The REST API is blocked due to overload. This is a manual individual block; please contact Bitrix24 technical support to lift it
`403`	`ACCESS_DENIED` REST API is available only on commercial plans	The REST API is only available on commercial plans
`403`	`INVALID_CREDENTIALS` Invalid request credentials	The user associated with the access token or webhook used to call the method lacks the necessary permissions
`404`	`ERROR_MANIFEST_IS_NOT_AVAILABLE` Manifest is not available	The manifest is not available
`403`	`insufficient_scope` The request requires higher privileges than provided by the webhook token	The request requires higher privileges than those provided by the webhook token
`401`	`expired_token` The access token provided has expired	The provided access token has expired
`403`	`user_access_error` The user does not have access to the application	The user does not have access to the application. This means that the application is installed, but the portal administrator has restricted access to this application to specific users only
`500`	`PORTAL_DELETED` Portal was deleted	The public part of the site is closed. To open the public part of the site on an on-premise installation, disable the "Temporary closure of the public part of the site" option. Path to the setting: Desktop > Settings > Product Settings > Module Settings > Main Module > Temporary closure of the public part of the site

Continue Learning

Remove Block from Repository

Overview of Methods

Check Content for Dangerous Substrings landing.repo.checkContent

Method ParametersMethod Parameters

Code ExamplesCode Examples

Response HandlingResponse Handling

Returned DataReturned Data

Type resultType result

Error HandlingError Handling

Possible Error CodesPossible Error Codes

Statuses and System Error CodesStatuses and System Error Codes

Continue LearningContinue Learning