For developers

API reference

Start a check with a bearer key and poll the job. Three endpoints, no SDK required, and the same evidence and review priorities the panel shows.

Authentication

Every request carries an API key as a bearer token. Keys are created in the panel under Settings: up to five per account, each with a scope and an optional expiry of 7 to 90 days. A key is shown once at creation and stored only as a SHA-256 hash, so a copy of the database contains no usable credential.

Authorization: Bearer $KEY

Scopes are check, which may start a check, and read-only, which may not. A key that has expired or been revoked answers 401.

Endpoints

`GET /api/v1/check/{domain}`

Start a check. Answers 202 with a job URL to poll. A report from the last 24 hours is returned at once instead; add fresh=1 to force a new run. A read-only key cannot call this.

GET /api/v1/check/example.com
Authorization: Bearer $KEY

202 Accepted
{
  "job": "/api/v1/jobs/7f3a2c",
  "domain": "example.com",
  "status": "queued"
}

`GET /api/v1/jobs/{id}`

Poll a job. Answers 200 with the report once the job is done, or the current status while it runs. A job with no progress for eight minutes is reported as lost rather than left pending.

GET /api/v1/jobs/7f3a2c
Authorization: Bearer $KEY

200 OK
{
  "status": "done",
  "domain": "example.com",
  "finishedAt": "2026-09-17T09:14:22Z",
  "findings": [
    {
      "domain": "exmaple.com",
      "technique": "transposition",
      "registered": true,
      "createdAt": "2026-09-06",
      "addresses": ["192.0.2.24"],
      "mail": true,
      "priority": "elevated",
      "rule": "keyword or infrastructure on a registration under a year old"
    }
  ]
}

`GET /api/v1/domains`

List watched domains. Returns the domains on the account's watchlist with their latest report reference. Available to read-only keys.

GET /api/v1/domains
Authorization: Bearer $KEY

200 OK
{
  "domains": [
    { "domain": "example.com", "dailyRecheck": true, "toReview": 2 }
  ]
}

Rate limits

Limits are per key, per minute, and follow the plan. Exceeding one answers 429 with a retry-after header rather than dropping the request silently.

Plan	Limit
Basic	10 requests per minute
Pro	60 requests per minute
Business	120 requests per minute
Enterprise	600 requests per minute

Reading a finding

Each finding carries the evidence the check gathered and the review priority the published rules assigned to it, never a verdict. Where a source did not answer, the field is absent or null rather than reported as a negative: no registry record is not the same as available, and a timed-out lookup is not the same as nothing found.

The exact rule behind every priority is on the methodology page, and each finding names the rule that produced it so a result can be argued with rather than taken on trust.

Errors

400 the domain could not be normalised to a registrable name
401 the key is missing, expired or revoked
403 the key’s scope does not allow this call
404 no such job
429 the plan’s per-minute limit was exceeded