Authentication
All API requests require an API-KEY header. Generate keys from Settings → API Keys in your dashboard. Each key is shown once on creation — store it securely. Multiple keys can be created and revoked independently.
POST /api/scan
API-KEY: your_api_key
Content-Type: multipart/form-data
file=@document.pdfRate limits
The API is rate-limited to 60 requests per minute per API key. Batch endpoints accept up to 500 items per request, so a single call can process hundreds of URLs or emails within the rate limit.
API key examples
- ✓Create a production key for your backend signup flow that calls the email scanning API.
- ✓Create a separate staging key so test traffic can be revoked without touching production.
- ✓Issue a dedicated key for a Google Sheets add-on or internal automation script.
- ✓Delete a key immediately when an integration is retired or a secret may have been exposed.
Endpoints
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/scan | Scan a file (PDF or Office document) |
| POST | /api/scan/url | Scan a single URL for threats |
| POST | /api/scan/email | Scan a single email address |
| POST | /api/scan/email/bulk | Scan up to 500 email addresses |
| POST | /api/submit-phishing-link | Submit a suspected phishing URL for review |
| GET | /api/brand-monitors | List your Brand Monitor entries |
| POST | /api/brand-monitors | Create a Brand Monitor |
| DELETE | /api/brand-monitors/{id} | Delete a Brand Monitor |
| POST | /api/brand-monitors/{id}/toggle | Pause or resume a Brand Monitor |
| GET | /api/block-list | List account block-list entries |
| POST | /api/block-list/check | Check an email or IP against the block list |
Credit usage
Credits are consumed per item scanned and shared across your workspace:
| Scan type | Credits |
|---|---|
| 1 credit | |
| URL | 5 credits |
| File / document | 20 credits |
Requests fail gracefully with an informative error if your credit balance is insufficient.
Batch scanning (web interface)
The web interface supports batches of up to 500 URLs or email addresses at a time via CSV or Excel upload. For API email cleanup jobs, use /api/scan/email/bulk to scan up to 500 addresses in one request; invalid email values return per-item errors without failing the whole batch.
OpenAPI documentation
Full API reference is available in OpenAPI format from your dashboard, with example requests, response schemas, and error codes for every endpoint.
Examples
- ✓Call POST /api/scan/email during account creation and reject disposable addresses before sending a verification email.
- ✓Call POST /api/scan/email/bulk from a CRM cleanup job to flag role accounts, public domains, and disposable addresses.
- ✓Call POST /api/scan/url before publishing user-submitted links in a marketplace or community platform.
- ✓Call POST /api/scan when a customer uploads a PDF invoice, then quarantine files with a Block rating.