Getting started
Quickstart
From zero to a working integration in three steps. Each step unlocks more; stop wherever you have what you need.
1Look up a domain without a key
Send a GET request with the domain in the path. Without a key you get 20 lookups per hour per IP address, enough to try things out.
curl "https://ugapgzpffrykyglevlhz.supabase.co/functions/v1/threat-api/v1/domains/fake-bank-login.example"Unlisted domains return {"domain": "…", "listed": false}. A listed domain looks like this:
{
"domain": "fake-bank-login.example",
"listed": true,
"status": "active",
"category": "phishing-page",
"first_reported_at": "2026-10-04T18:01:02Z",
"confirmed_at": "2026-10-05T09:12:44Z",
"neutralized_at": null,
"last_checked_at": "2026-10-21T15:22:07Z",
"match": "exact"
}2Create a free key
Create a free account, open Dashboard → Threat API and create a key. It starts with fp_live_ and is shown only once, so store it in your secret manager right away.
Send it in the X-API-Key header. A free key gives you 1,000 lookups per day, batch checks of up to 100 domains, the full feeds and change synchronization.
curl -X POST "https://ugapgzpffrykyglevlhz.supabase.co/functions/v1/threat-api/v1/check" \
-H "X-API-Key: $FP_KEY" -H "Content-Type: application/json" \
-d '{"domains": ["fake-bank-login.example", "fraudpol.com"]}'3Connect your company workflow
On a company plan you create fp_co_ keys in Company dashboard → Developers. The same key works for the Threat API with higher limits and for the Company API: submit cases, follow their status, read Brand Shield findings and receive webhooks.
curl "https://ugapgzpffrykyglevlhz.supabase.co/functions/v1/blackwall-api/v1/status" -H "X-API-Key: $FP_COMPANY_KEY"The response shows your plan, the key's scopes and today's usage. Continue with the Company API reference or a tutorial.