API documentation
Scan URLs programmatically and get the full verdict JSON back. API access requires a Premium account.
Authentication
Create an API key on your account page (shown once — store it securely). Pass it as a Bearer token:
Authorization: Bearer <your-api-key>
Scan a URL
POST /api/v1/scan — submit a URL, receive the complete scan result (same shape as the web scanner).
curl -X POST https://YOUR-DOMAIN/api/v1/scan \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your-api-key>" \
-d '{"url": "https://suspicious-example.com/login"}'
Response
A successful scan returns HTTP 200 with the full result object:
{
"url": "https://suspicious-example.com/login",
"finalUrl": "https://suspicious-example.com/login",
"verdict": "suspicious", // "safe" | "suspicious" | "dangerous"
"score": 42, // 0–100, higher is safer
"reachable": true,
"https": true,
"redirects": [],
"domain": {
"host": "suspicious-example.com",
"registrableDomain": "suspicious-example.com",
"available": true,
"registrar": "Example Registrar",
"createdAt": "2026-09-01T00:00:00Z",
"expiresAt": "2027-09-01T00:00:00Z",
"ageDays": 43,
"ageYears": 0
},
"openphish": { "status": "clean" }, // "clean" | "match" | "unavailable"
"checks": [
{ "id": "https", "label": "HTTPS", "result": "pass", "detail": "..." }
],
"tech": {
"ip": "93.184.216.34",
"dns": { "a": ["93.184.216.34"], "aaaa": [], "mx": [], "txt": [] },
"tls": { "issuer": "..." },
"hostingHistory": null
},
"evidence": [
{ "signal": "Young domain", "level": "warning", "text": "..." }
],
"scanId": "abc123",
"scannedAt": "2026-10-14T17:00:00Z",
"remaining": 97
}
Honest gaps: any field we couldn't retrieve is returned as
null (or "available": false with an unavailableReason for domain data) — never invented. Check for null before trusting a value.
Errors
400— bad request (e.g. missing or malformed URL). Body:{"error": "…"}.401— missing or invalid API key.402— scan quota exhausted. Body includes{"error": "…", "upgrade": true}.429— rate limited; back off and retry.
Limits & fair use
API calls count against your plan's scan quota. Keep request rates reasonable — sustained high-volume use may be rate-limited to protect the service. Don't use the API to build a competing public scanning service without permission (see Terms).