HTML Entities Encoder/Decoder API

POST

Neutralize unsafe characters in HTML to prevent XSS attacks.

HTML Entities Encoder/Decoder converts special characters into safe HTML entities or restores encoded strings back to standard text. Pass any HTML markup or text snippet to receive the converted string, a replacement count, and a list of modified characters.

Try it — live request, no key required

Request

POSTapi.apiverve.com/v1/htmlentities

Body

htmlstring

Verification

Format

No key required to try it. Get a key to use it in your app.

Example

{
  "status": "ok",
  "error": null,
  "data": {
    "action": "encode",
    "original": "<div class=\"test\">Hello & World</div>",
    "encoded": "&lt;div class=&quot;test&quot;&gt;Hello &amp; World&lt;&#x2F;div&gt;",
    "entities_replaced": [
      "<",
      "\"",
      ">",
      "&",
      "/"
    ],
    "count": 8
  }
}

About the HTML Entities Encoder/Decoder API

HTML Entities Encoder/Decoder works by converting characters like <, >, &, quotes, and slashes into their HTML entity equivalents or decoding them back to original characters. Essential for XSS prevention.

What people use it for

XSS Prevention: Encode user input before displaying in HTML to prevent cross-site scripting (XSS) attacks
Data Display: Decode HTML entities in stored content to display special characters correctly in web applications
Content Migration: Encode or decode HTML entities when migrating content between systems with different encoding requirements
API Integration: Properly encode HTML content before sending to APIs or decode entities received from external sources

Ways to call it

One endpoint, many ways in — REST with JSON, XML, YAML and CSV, plus GraphQL and an MCP interface for AI agents.

JSON: Default REST response
XML: Markup format
YAML: Human-readable
CSV: Tabular export
GraphQL: Query language
MCP: For AI agents

View all integrations →

Other ways to use HTML Entities Encoder/Decoder

Same data, same APIVerve account, same credit balance — one key works on all of them.

Give it to an AI agentConnect over MCP and your agent calls it as a native tool — Claude, Cursor, ChatGPT.on VerveKit Google Sheets or ExcelA =VERVE() formula fills a column — no script, no export, recalculates in place.on VerveSheets

Questions.

Common questions about the HTML Entities Encoder/Decoder API.

Read the docs →

Which characters does the API escape when encoding?

It converts characters like angle brackets, ampersands, quotation marks, and slashes into their standard HTML entity equivalents. This ensures user-supplied text can be displayed safely in browsers without being interpreted as executable markup.

Can I convert HTML entities back into plain characters?

Yes. The Decode HTML Entities endpoint reverses the transformation, converting entity representations back to their original special characters for editing, content migration, or downstream data processing.

Does the response show which characters were modified?

Yes. Every response includes a list of all characters or entity patterns replaced during the call, as well as a count of the total replacements made in your text.

Can I view the original text alongside the converted result?

Yes. Each response returns both the original input string and the resulting transformed string, allowing you to easily verify changes without retaining separate state in your code.

What would encoding 50,000 text snippets a month cost me?

That volume fits comfortably within the Starter plan at $29.99 per month. Each call uses 2 credits, so Starter covers up to 100,000 calls monthly, working out to about $0.30 per 1,000 calls. You can also test with 100 calls per month on the Free plan.

Request parameters — POST /v1/htmlentities

Sent as JSON in the request body. Premium parameters are accepted on every plan but only take effect on plans that include them. Anything not listed here is dropped rather than passed through.

Required

Parameter	Type	Example	Description
`html`Required	string	`<div>Hello & Welcome</div>`	The HTML content to encode

Optional

Parameter	Type	Example	Description
`action`Optional	string	`encode`	The action to perform `encodedecode` default encode

Example request

curl -X POST "https://api.apiverve.com/v1/htmlentities" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"html":"<div class=\"test\">Hello & World</div>","action":"encode"}'

Authentication

Send your key in the x-api-key header. That is the only auth step — no token exchange, and no per-endpoint scope to configure.

Header	When	Value
`x-api-key`Required	Every request	Your API key. Header names are case-insensitive, so `X-API-Key` is the same header.
`Authorization`Alternate	Instead of the above	`Bearer <key>` — for clients that only expose bearer auth. Resolves to the same account and the same billing.
`content-type`Required	POST body	`application/json`

401 is the only auth verdict

A 401 means the key is missing, invalid or expired. A 403 means the key is valid but not permitted here — blocked by a key restriction or an IP allow-list. Running out of credits is a 429.

Response — POST /v1/htmlentities

Every APIVerve endpoint returns the same three top-level keys, so one response handler covers your whole integration: status, error and data. Only data changes shape.

Sample response

{
  "status": "ok",
  "error": null,
  "data": {
    "action": "encode",
    "original": "<div class=\"test\">Hello & World</div>",
    "encoded": "&lt;div class=&quot;test&quot;&gt;Hello &amp; World&lt;&#x2F;div&gt;",
    "entities_replaced": [
      "<",
      "\"",
      ">",
      "&",
      "/"
    ],
    "count": 8
  }
}

Response fields

Paths are relative to data. Premium fields are absent rather than zeroed on plans that do not include them, so check for presence instead of comparing to 0.

Field	Type	Example	Description
`action`	string	`"encode"`	The action performed on the HTML content
`original`	string	`"<div class="test">Hello & World</div>"`	The original HTML content before encoding
`encoded`	string	`"<div class="test">Hello & World</div>"`	The HTML content with entities encoded
`entities_replaced`	array	`[<, ...]`	Array of special characters that were replaced
`count`	number	`8`	Total number of entity replacements made

Response headers

Every response carries your balance, so your own code always knows where it stands without polling anything. All four are exposed to browsers through CORS.

Header	What it carries
`x-api-remaining-credits`	Credits left in the current cycle
`x-api-credits-used`	Credits spent in the current cycle
`x-api-max-credits`	The allowance for the cycle
`x-api-version`	Version of the endpoint that answered

Errors

Read the HTTP status first, then error for the specific reason. The body names the parameter that has to change.

Status	Meaning	What to do
`400`	Input was rejected	Read `error`; it names the parameter that has to change.
`401`	Key missing or invalid	Check the header name and the key value.
`403`	Key valid, but not permitted here	A key restriction or an IP allow-list — never a bad key.
`429`	Rate limited, or out of credits	Read `error` to tell them apart, then back off or top up.

What a call costs — 2 credits per call

Credits are shared across every APIVerve API — one balance, one key, one bill. Failed requests never count against it, so a rejected input costs nothing.

Plan	Per month	Credits	HTML Entities Encoder/Decoder calls	Per 1,000 calls
Free	Free	200	100	Free
Starter	$29.99	200,000	100,000	$0.30
Pro	$99.99	1,000,000	500,000	$0.20
Mega	$299.99	4,000,000	2,000,000	$0.15

Calls are what the credits buy at this API's rate — spend them here, on any of the other APIs, or across both. Nothing is reserved per endpoint.

Compare all pricing tiers →

Call it from cURL — POST /v1/htmlentities

No SDK to install — this is a plain HTTPS call to /v1/htmlentities with your key in the x-api-key header. Swap in a real key and it runs as-is.

cURL

1
2

curl "https://api.apiverve.com/v1/htmlentities" \
  -H "x-api-key: YOUR_API_KEY"

Resources

GitHubapiverve/htmlentities-apiSource, issues and the examples this page is built from.ReferenceHTML Entities Encoder/Decoder API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

@apiverve/htmlentitiesnpm APIVerve.API.HTMLEntitiesEncoderDecoderNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Node.js — POST /v1/htmlentities

Install the Node.js SDK, then call the HTML Entities Encoder/Decoder API with your key. The client wraps the same HTTPS request, so anything it returns is what the endpoint returns.

Install — npm

npm install @apiverve/htmlentities

Node.js

const res = await fetch("https://api.apiverve.com/v1/htmlentities", {
  headers: { "x-api-key": "YOUR_API_KEY" },
});
const { data } = await res.json();
console.log(data);

Resources

npm@apiverve/htmlentitiesThe published Node.js client, versioned and signed.GitHubapiverve/htmlentities-apiSource, issues and the examples this page is built from.ReferenceHTML Entities Encoder/Decoder API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

APIVerve.API.HTMLEntitiesEncoderDecoderNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Python — POST /v1/htmlentities

No SDK to install — this is a plain HTTPS call to /v1/htmlentities with your key in the x-api-key header. Swap in a real key and it runs as-is.

Python

import requests

res = requests.get(
    "https://api.apiverve.com/v1/htmlentities",
    headers={"x-api-key": "YOUR_API_KEY"},
)
print(res.json()["data"])

Resources

Also published for

@apiverve/htmlentitiesnpm APIVerve.API.HTMLEntitiesEncoderDecoderNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from C# / .NET — POST /v1/htmlentities

Install the C# / .NET SDK, then call the HTML Entities Encoder/Decoder API with your key. The client wraps the same HTTPS request, so anything it returns is what the endpoint returns.

Install — NuGet

dotnet add package APIVerve.API.HTMLEntitiesEncoderDecoder

C# / .NET

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("x-api-key", "YOUR_API_KEY");

var json = await client.GetStringAsync("https://api.apiverve.com/v1/htmlentities");
Console.WriteLine(json);

Resources

NuGetAPIVerve.API.HTMLEntitiesEncoderDecoderThe published C# / .NET client, versioned and signed.GitHubapiverve/htmlentities-apiSource, issues and the examples this page is built from.ReferenceHTML Entities Encoder/Decoder API docsEvery parameter, every response field, and the errors.ParametersWhat this call acceptsRequired and optional inputs, with example values.

Also published for

@apiverve/htmlentitiesnpm

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Go — POST /v1/htmlentities

No SDK to install — this is a plain HTTPS call to /v1/htmlentities with your key in the x-api-key header. Swap in a real key and it runs as-is.

req, _ := http.NewRequest("GET", "https://api.apiverve.com/v1/htmlentities", nil)
req.Header.Set("x-api-key", "YOUR_API_KEY")

res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))

Resources

Also published for

@apiverve/htmlentitiesnpm APIVerve.API.HTMLEntitiesEncoderDecoderNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from PHP — POST /v1/htmlentities

No SDK to install — this is a plain HTTPS call to /v1/htmlentities with your key in the x-api-key header. Swap in a real key and it runs as-is.

PHP

$ch = curl_init("https://api.apiverve.com/v1/htmlentities");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-api-key: YOUR_API_KEY"]);

$response = curl_exec($ch);
echo $response;

Resources

Also published for

@apiverve/htmlentitiesnpm APIVerve.API.HTMLEntitiesEncoderDecoderNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Call it from Ruby — POST /v1/htmlentities

No SDK to install — this is a plain HTTPS call to /v1/htmlentities with your key in the x-api-key header. Swap in a real key and it runs as-is.

Ruby

require "net/http"

uri = URI("https://api.apiverve.com/v1/htmlentities")
req = Net::HTTP::Get.new(uri)
req["x-api-key"] = "YOUR_API_KEY"

res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

Resources

Also published for

@apiverve/htmlentitiesnpm APIVerve.API.HTMLEntitiesEncoderDecoderNuGet

Only the languages APIVerve ships a client for are listed — the rest call the endpoint directly over HTTPS.

Data Conversion

View all 33 →

All articles →

Extract Clean Content from Any WebpageTurn messy web pages into clean Markdown. Perfect for content migration, archiving, AI training data, and building read-later tools.Read

Generate PDFs from HTML with an APIConvert HTML to PDF programmatically. Tutorial covering invoices, reports, receipts, and certificates with code examples.Read

Automating Visual Testing With ScreenshotsCatch visual bugs before users do. Here's how to add screenshot-based testing to your workflow.Read

HTML Entities Encoder/Decoder API

Try it — live request, no key required

About the HTML Entities Encoder/Decoder API

What people use it for

Ways to call it

Other ways to use HTML Entities Encoder/Decoder

Questions.

Request parameters — POST /v1/htmlentities

Required

Optional

Authentication

Response — POST /v1/htmlentities

Response fields

Response headers

Errors

What a call costs — 2 credits per call

Call it from cURL — POST /v1/htmlentities

Resources

Also published for

Call it from Node.js — POST /v1/htmlentities

Resources

Also published for

Call it from Python — POST /v1/htmlentities

Resources

Also published for

Call it from C# / .NET — POST /v1/htmlentities

Resources

Also published for

Call it from Go — POST /v1/htmlentities

Resources

Also published for

Call it from PHP — POST /v1/htmlentities

Resources

Also published for

Call it from Ruby — POST /v1/htmlentities

Resources

Also published for

Zero-code embed — one snippet, no backend

Changelog — HTML Entities Encoder/Decoder API

Data Conversion

Related articles

Ready to build with HTML Entities Encoder/Decoder? Start with 200 free credits — one key unlocks all 300+ APIs.

Explore the catalog