Threat API

Access and matching

Create an API key in the Threat API section of your dashboard. Send it in the X-API-Key header. Save it immediately: the full key is displayed only once. Never embed a secret in public client code. Revoke compromised keys and rotate them.

Lookups normalize internationalized domain names and check the exact host first, then its registrable parent using the public suffix list. A listing for a specific subdomain does not list its parent or siblings. The response domain identifies the matched record; match is exact or parent. Domains in explanatory text are defanged, such as malicious[.]example.

Using a company key

Send your fp_co_ company key in the X-API-Key header with the read scope. Company keys use higher daily limits according to your plan and include feeds and synchronization. These requests consume the separate company Threat API allowance, rather than the free-key quotas described below. The current plan must enable Company API access.

Keep keys on trusted servers. See the access tiers & limits for current limits and the Company API documentation for key handling and scopes.

Endpoint reference

Base URL: https://ugapgzpffrykyglevlhz.supabase.co/functions/v1/threat-api

• GET /v1/domains/{domain} — a single lookup. Returns domain, listed, status, category, first_reported_at, confirmed_at, neutralized_at, last_checked_at and match when listed. Unlisted results contain domain and listed:false.
• POST /v1/check — JSON domains array, 1–100 entries. Returns an array in request order. Each domain consumes a lookup.
• GET /v1/domains?since=ISO&cursor=&limit=1000 — key required; chronological changes and next_cursor. Keep since fixed while following the opaque, URL-encoded cursor until null. Save the last updated_at for the next synchronization, deduplicating inclusive boundary records. A listed:false tombstone removes a previous listing.
• GET /v1/feed.json — active domains as a JSON array.
• GET /v1/feed.txt — active domains, one per line. Both feeds exclude neutralized entries and use a ten-minute private cache.

The database refreshes every ten minutes. Timestamps describe source reports and projection changes, not a live safety scan. last_checked_at changes only when a listing changes. No reporter information, channel names, team information or internal report identifiers are returned.

Examples

Set BASE to the base URL above and FP_KEY to your secret; replace example.org with the host you want to check.

curl "$BASE/v1/domains/example.org" -H "X-API-Key: $FP_KEY"

Limits and errors

Free keys allow 60 lookups per minute and 1,000 per UTC day. Feed downloads allow 24 requests per UTC day per key, separately from lookup quotas. Synchronization pages count as one lookup request. Without a key, up to 20 domain lookups per hour per IP are allowed; feeds and synchronization require a key. Each account may have three active keys.

Errors use JSON with error and message fields: 400 invalid input, 401 missing or invalid credentials, 403 forbidden, 404 unknown route, 409 key limit, 429 quota exceeded, and 500/503 service failures. Back off on quota or temporary errors; do not retry invalid input unchanged.

Terms and corrections

Free use is permitted with attribution: Data: Fraudpol. Data is supplied without warranty, including warranties of accuracy, completeness or fitness for purpose. Investigate independently and do not use a listing as the sole basis for legal action. Threat status can change; refresh your local copy and process removals. Do not attempt to identify reporters or bypass access controls.

Domain owners can request a listing review with supporting evidence. Requests are reviewed by a human, and a decision is sent to the supplied email address.