← DashboardFree checkTrust & status
API reference

The API that returns data you can resell

A first-party, licence-clean exposure-intelligence API. Everything it returns is redistributable by you, redacted by design, and scored deterministically. Base URL is your own deployment — examples below use $BASE.

Three guarantees, enforced in code

◈ Redistributable

A licence manifest rides every record; only redistributable sources are ever served. Each data response carries an X-Data-Attribution header naming the sources — honour it and you may resell what you receive.

◈ Redacted by design

No endpoint returns a plaintext credential, cookie, or personal identifier. You get counts, scores, and exposure booleans — never the secret itself.

◈ Deterministic

Scores are rule-derived and reproducible: same domain, same corpus, same number, with every factor's contribution shown. An auditor gets the same answer twice.

We deliberately never expose the raw storage-engine envelope, column metadata, or query statistics to API consumers. Responses are clean, documented DTOs — nothing about the database leaks through the wire.

Authentication

Every /v1 endpoint requires an API key, sent as either header:

# X-API-Key header
curl "$BASE/v1/portfolio" \
  -H "X-API-Key: sk_live_..."

# or Authorization: Bearer
curl "$BASE/v1/portfolio" \
  -H "Authorization: Bearer sk_live_..."

Keys are tenant-scoped and role-limited. Manage them in the dashboard under Settings, or issue them per member with granular permissions.

Rate limits & errors

Each key has a per-minute sliding-window limit (default 1000/min; public endpoints are limited per IP). Exceeding it returns 429. Errors are RFC 7807 application/problem+json:

{ "type": "about:blank", "title": "rate limit exceeded", "status": 429 }

Exposure & score

GET/v1/exposure/{domain}headline exposure summary
GET/v1/exposure/{domain}/scorenormalised, explainable score + velocity
curl "$BASE/v1/exposure/acme.com/score" -H "X-API-Key: $KEY"

{
  "domain": "acme.com", "score": 72.4, "band": "high",
  "factors": [ { "factor": "sensitive_services", "weight": 20,
              "signal": 0.9, "contribution": 18.0 }, ... ],
  "threat_velocity": { "value": 1.6, "label": "accelerating" }
}

Snapshot report

GET/v1/exposure/{domain}/snapshotshareable one-pager

Returns the full aggregates-only snapshot as JSON, or a self-contained HTML one-pager with ?format=html — score, factor breakdown, prioritised actions, 30-day trend. Safe to forward to a domain owner.

curl "$BASE/v1/exposure/acme.com/snapshot?format=html" \
  -H "X-API-Key: $KEY" > acme-exposure.html

Portfolio & trends

GET/v1/portfolioevery domain & vendor, scored & ranked
GET/v1/trends/{domain}daily score history
GET/v1/third-partysupply-chain risk board

Ransomware

GET/v1/ransomware/claimsleak-site claims feed
GET/v1/ransomware/victimclaims naming a domain
QueryTypeNotes
groupstringfilter by threat group
country, sectorstringfilter by victim attributes
limitint1–500, default 100
Honest framing: leak-site entries are unverified claims by threat groups until independently corroborated, and every response says so. We never present a claim as a confirmed breach.

Breaches

GET/v1/breachesbreach catalogue (redistributable only)

STIX / SIEM export

GET/v1/export/stixSTIX 2.1 bundle
GET/v1/export/siemNDJSON feed with since cursor

Both are licence-gated — only redistributable records leave — and take since (ISO-8601) plus limit. Point your SIEM poller at the SIEM feed; feed the STIX bundle to any TAXII-aware platform.

curl "$BASE/v1/export/siem?since=2026-08-01&limit=500" \
  -H "X-API-Key: $KEY"

Free public API

GET/public/snapshot/{domain}no auth rate-limited per IP

Unauthenticated and aggregates-only — the safe inverse of a "free breach check". ?format=teaser returns the headline (score, band, counts); ?format=html returns the full one-pager. Rate-limited per IP.

curl "$BASE/public/snapshot/acme.com?format=teaser"

{ "domain":"acme.com", "score":72.4, "band":"high",
  "headline":{ "infostealer_infections":3394, "sensitive_services":35 },
  "gated":true }