Playground API
Console API
Préparez une requête. Inspectez la réponse.
ismalicious / playground
Sans clé API
inactifCtrl / ⌘ + Enter
Référence API
Explorez tous les endpoints et les exemples de code.
La spécification fusionne Rust (
api.ismalicious.com) et les routes anti-arnaque Next.js sur ismalicious.com/api (/analyze, téléphone, crypto, e-mail). Choisissez le bon serveur dans Scalar avant « Try it ». Exemples rédigés également dans la documentation API.Référence
Tous les endpoints appelables depuis ce playground
63 opérations réparties en 20 groupes, générées depuis isMalicious - Threat Intelligence API v1.2.0 — le document OpenAPI que charge la référence interactive ci-dessus.
- Production server
- https://api.ismalicious.com
- Next.js web API (analyze / phone / crypto / email)
- https://ismalicious.com/api
- En-tête d’authentification
- X-API-KEY
| Méthode | Endpoint | Rôle |
|---|---|---|
| monitoring— Watch ownership and authenticated monitoring | ||
| POST | /monitoring/claim-pending | Verified pending watches transferred, possibly partially |
| check— Threat intelligence check endpoints for IPs, domains, URLs, and file hashes | ||
| GET | /bulk/check | Bulk check limits and usage |
| POST | /bulk/check | Bulk entity check |
| GET | /check | Full Threat Analysis |
| GET | /check/certificates | Check Certificates |
| GET | /check/location | Check Geolocation |
| POST | /check/password | Breach exposure of a password, checked as an indicator. |
| GET | /check/reputation | Check Reputation |
| GET | /check/stream | Report stream (SSE) |
| GET | /check/tenant | Microsoft 365 tenant |
| GET | /check/vulnerabilities | Check Vulnerabilities |
| GET | /check/whois | Check WHOIS |
| POST | /indicator-context | Existing evidence with optional, separately metered context qualification |
| GET | /pwned-passwords/range/{prefix} | k-anonymity lookup in Have I Been Pwned's Pwned Passwords corpus. |
| search— Search for similar malicious domains | ||
| POST | /search | Search Keywords |
| blocklist— Download blocklists and read their generation stats | ||
| GET | /blocklist/download/{filename} | Download Blocklist |
| GET | /blocklist/stats | Get Blocklist Stats |
| submit— Submit new threat intelligence sources | ||
| POST | /submit | Submit Sources |
| gate— isinjected gate: prompt-injection scanning and link reputation for AI agents (own scan meter) | ||
| GET | /gate/quota | GET /gate/quota |
| POST | /gate/scan | POST /gate/scan |
| GET | /gate/url | GET /gate/url?u= |
| mail— Inbound-message scan: what a mail's structure and the dataset say about it (gate scan meter, one unit per message) | ||
| POST | /mail/scan | POST /mail/scan |
| platform— Dataset freshness and data-ops pipeline status | ||
| GET | /platform/data-freshness | Dataset freshness, version, and SLA status |
| GET | /platform/data-ops/pipeline | Data operations pipeline phases and last recorded run |
| cases— SOC case workspace: cases and their evidence timeline | ||
| GET | /cases | Case workspace list, wrapped as `{"cases": […]}` |
| POST | /cases | Created case |
| PATCH | /cases/{id} | Updated case |
| POST | /cases/{id}/evidence | Updated case with appended evidence |
| action-center— Prioritized SOC action queue | ||
| GET | /action-center/overview | Prioritized SOC action center overview |
| alerts— Alerting trends and metrics | ||
| GET | /alerts/trends | Opened/resolved per day plus MTTR percentiles for the signed-in scope |
| webhooks— Webhook event catalog | ||
| GET | /user/webhooks/events | Supported webhook events, signature scheme, and management path |
| briefs— Executive risk briefs | ||
| GET | /risk-brief/latest | Latest organization risk brief summary |
| trust— Trust assessment contract | ||
| GET | /trust/assessment/schema | Canonical trust assessment field contract |
| taxii— TAXII 2.1 / STIX 2.1 threat-intelligence feed (Pro and Enterprise). Never decrements the monthly request quota | ||
| GET | /taxii | TAXII discovery |
| GET | /taxii/api-root | TAXII API root |
| GET | /taxii/api-root/collections | List TAXII collections |
| GET | /taxii/api-root/collections/{collectionId} | Get a TAXII collection |
| GET | /taxii/api-root/collections/{collectionId}/manifest | Get object manifests |
| GET | /taxii/api-root/collections/{collectionId}/objects | Get collection objects |
| POST | /taxii/api-root/collections/{collectionId}/objects | Add objects (refused) |
| GET | /taxii/api-root/collections/{collectionId}/objects/{objectId} | Get an object |
| GET | /taxii/api-root/collections/{collectionId}/objects/{objectId}/versions | Get object versions |
| GET | /taxii/api-root/status/{statusId} | Get status |
| stats— Public dataset statistics — no authentication, not metered | ||
| GET | /stats | Public dataset statistics |
| cve— CVE catalog: lookup by id, search and recent list (authenticated, one request each) and public statistics (EPSS, exploitation signals, time series — no authentication, not metered) | ||
| GET | /cve | CVE lookup, search and recent list |
| GET | /cve/{id} | CVE by id (path form) |
| GET | /cve/recent | Recent CVEs (bare array) |
| GET | /cve/stats/epss | CVE EPSS statistics |
| GET | /cve/stats/timeseries | CVE time series |
| ransomware— Ransomware intelligence from the cached ransomware.live datasets: victims, groups, sectors, press. Authenticated, one request each except `/ransomware/live-quota` | ||
| GET | /ransomware/feed | Recent ransomware victims |
| GET | /ransomware/group-profile | Ransomware group profile |
| GET | /ransomware/groups | Ransomware groups |
| GET | /ransomware/live-quota | ransomware.live call budget |
| GET | /ransomware/press | Ransomware press |
| GET | /ransomware/sector-risk | Sector risk |
| GET | /ransomware/sector-risk/history | Sector risk history |
| GET | /ransomware/sector-victims | Sector victims |
| GET | /ransomware/stats | Ransomware statistics |
| Scam Intelligence— Next.js routes for analyze / email / phone / crypto (ismalicious.com/api). | ||
| POST | ismalicious.com/api/analyze | Unified analyze (auto-detect type) |
| GET | ismalicious.com/api/check/crypto | Check crypto wallet address |
| GET | ismalicious.com/api/check/email | Check email address |
| GET | ismalicious.com/api/check/phone | Check phone number risk |
| Account | ||
| POST | ismalicious.com/api/keys/instant | Get an API key instantly (email only) |
Appeler un endpoint sans le playground
# X-API-KEY carries Base64(apiKey:apiSecret)
curl -H "X-API-KEY: $ISMALICIOUS_KEY" \
"https://api.ismalicious.com/check?query=example.com"