API Playground
API console
Build a request. Inspect the response.
ismalicious / playground
Without API key
idleCtrl / ⌘ + Enter
API reference
Explore all endpoints and code examples.
Spec merges Rust (
api.ismalicious.com) with Next.js scam routes on ismalicious.com/api (/analyze, phone, crypto, email). Pick the matching server in Scalar before “Try it”. Written examples also in API docs.Reference
Every endpoint you can call from this playground
63 operations across 20 groups, generated from isMalicious - Threat Intelligence API v1.2.0 — the same OpenAPI document the interactive reference above loads.
- Production server
- https://api.ismalicious.com
- Next.js web API (analyze / phone / crypto / email)
- https://ismalicious.com/api
- Auth header
- X-API-KEY
| Method | Endpoint | Purpose |
|---|---|---|
| monitoring— Watch ownership and authenticated monitoring | ||
| POST | /monitoring/claim-pending | Verified pending watches transferred, possibly partially |
| check— Threat intelligence check endpoints for IPs, domains, URLs, and file hashes | ||
| GET | /bulk/check | Bulk check limits and usage |
| POST | /bulk/check | Bulk entity check |
| GET | /check | Full Threat Analysis |
| GET | /check/certificates | Check Certificates |
| GET | /check/location | Check Geolocation |
| POST | /check/password | Breach exposure of a password, checked as an indicator. |
| GET | /check/reputation | Check Reputation |
| GET | /check/stream | Report stream (SSE) |
| GET | /check/tenant | Microsoft 365 tenant |
| GET | /check/vulnerabilities | Check Vulnerabilities |
| GET | /check/whois | Check WHOIS |
| POST | /indicator-context | Existing evidence with optional, separately metered context qualification |
| GET | /pwned-passwords/range/{prefix} | k-anonymity lookup in Have I Been Pwned's Pwned Passwords corpus. |
| search— Search for similar malicious domains | ||
| POST | /search | Search Keywords |
| blocklist— Download blocklists and read their generation stats | ||
| GET | /blocklist/download/{filename} | Download Blocklist |
| GET | /blocklist/stats | Get Blocklist Stats |
| submit— Submit new threat intelligence sources | ||
| POST | /submit | Submit Sources |
| gate— isinjected gate: prompt-injection scanning and link reputation for AI agents (own scan meter) | ||
| GET | /gate/quota | GET /gate/quota |
| POST | /gate/scan | POST /gate/scan |
| GET | /gate/url | GET /gate/url?u= |
| mail— Inbound-message scan: what a mail's structure and the dataset say about it (gate scan meter, one unit per message) | ||
| POST | /mail/scan | POST /mail/scan |
| platform— Dataset freshness and data-ops pipeline status | ||
| GET | /platform/data-freshness | Dataset freshness, version, and SLA status |
| GET | /platform/data-ops/pipeline | Data operations pipeline phases and last recorded run |
| cases— SOC case workspace: cases and their evidence timeline | ||
| GET | /cases | Case workspace list, wrapped as `{"cases": […]}` |
| POST | /cases | Created case |
| PATCH | /cases/{id} | Updated case |
| POST | /cases/{id}/evidence | Updated case with appended evidence |
| action-center— Prioritized SOC action queue | ||
| GET | /action-center/overview | Prioritized SOC action center overview |
| alerts— Alerting trends and metrics | ||
| GET | /alerts/trends | Opened/resolved per day plus MTTR percentiles for the signed-in scope |
| webhooks— Webhook event catalog | ||
| GET | /user/webhooks/events | Supported webhook events, signature scheme, and management path |
| briefs— Executive risk briefs | ||
| GET | /risk-brief/latest | Latest organization risk brief summary |
| trust— Trust assessment contract | ||
| GET | /trust/assessment/schema | Canonical trust assessment field contract |
| taxii— TAXII 2.1 / STIX 2.1 threat-intelligence feed (Pro and Enterprise). Never decrements the monthly request quota | ||
| GET | /taxii | TAXII discovery |
| GET | /taxii/api-root | TAXII API root |
| GET | /taxii/api-root/collections | List TAXII collections |
| GET | /taxii/api-root/collections/{collectionId} | Get a TAXII collection |
| GET | /taxii/api-root/collections/{collectionId}/manifest | Get object manifests |
| GET | /taxii/api-root/collections/{collectionId}/objects | Get collection objects |
| POST | /taxii/api-root/collections/{collectionId}/objects | Add objects (refused) |
| GET | /taxii/api-root/collections/{collectionId}/objects/{objectId} | Get an object |
| GET | /taxii/api-root/collections/{collectionId}/objects/{objectId}/versions | Get object versions |
| GET | /taxii/api-root/status/{statusId} | Get status |
| stats— Public dataset statistics — no authentication, not metered | ||
| GET | /stats | Public dataset statistics |
| cve— CVE catalog: lookup by id, search and recent list (authenticated, one request each) and public statistics (EPSS, exploitation signals, time series — no authentication, not metered) | ||
| GET | /cve | CVE lookup, search and recent list |
| GET | /cve/{id} | CVE by id (path form) |
| GET | /cve/recent | Recent CVEs (bare array) |
| GET | /cve/stats/epss | CVE EPSS statistics |
| GET | /cve/stats/timeseries | CVE time series |
| ransomware— Ransomware intelligence from the cached ransomware.live datasets: victims, groups, sectors, press. Authenticated, one request each except `/ransomware/live-quota` | ||
| GET | /ransomware/feed | Recent ransomware victims |
| GET | /ransomware/group-profile | Ransomware group profile |
| GET | /ransomware/groups | Ransomware groups |
| GET | /ransomware/live-quota | ransomware.live call budget |
| GET | /ransomware/press | Ransomware press |
| GET | /ransomware/sector-risk | Sector risk |
| GET | /ransomware/sector-risk/history | Sector risk history |
| GET | /ransomware/sector-victims | Sector victims |
| GET | /ransomware/stats | Ransomware statistics |
| Scam Intelligence— Next.js routes for analyze / email / phone / crypto (ismalicious.com/api). | ||
| POST | ismalicious.com/api/analyze | Unified analyze (auto-detect type) |
| GET | ismalicious.com/api/check/crypto | Check crypto wallet address |
| GET | ismalicious.com/api/check/email | Check email address |
| GET | ismalicious.com/api/check/phone | Check phone number risk |
| Account | ||
| POST | ismalicious.com/api/keys/instant | Get an API key instantly (email only) |
Calling one without the playground
# X-API-KEY carries Base64(apiKey:apiSecret)
curl -H "X-API-KEY: $ISMALICIOUS_KEY" \
"https://api.ismalicious.com/check?query=example.com"