API reference

Domain Reputation

Checks a hostname against the domain blacklists (RHSBL zones such as Spamhaus DBL, SURBL and URIBL, plus phishing, scam, malware and crypto-scam feeds) and returns the DNS, WHOIS and certificate facts you would otherwise fetch separately.

POST/api/domain-reputationCosts 1 creditAPI key

Check domain reputation

How matching works

The exact hostname is checked. Feeds that list URLs (URLhaus, VXVault, PhishTank …) are indexed by host, except that shared platforms are never blamed for their tenants: a malware file on github.com does not list github.com, and a phishing site at brand.weebly.com lists only that subdomain.
Two logic engines run alongside the feeds: d_sinkhole (the domain resolves to a known sinkhole) and d_suspicious_hosting (its A record sits in blacklisted IP space).
Disabled or probe-only engines are still present in engines with status: "disabled" for transparency, but do not count toward engines_count.

Request

JSON body
Field	Type	Description
domain*	string	Domain name to check (e.g. example.com)

Authenticate with API key. Send it as the X-API-Key header.

POST /api/domain-reputation

curl -X POST "https://api.senapati.io/api/domain-reputation" \
  -H "X-API-Key: $SENAPATI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.com"}'

Response

Every success is wrapped in { "data": … } with a request_id; the fields below describe data. See Errors for the failure shape.

response: 200 OKDomainReputationData

{
  "request_id": "req_8f2c1a7e",
  "timestamp": "2026-08-27T12:00:01.830727+00:00",
  "data": {
    "domain": "example.com",
    "blacklists": {
      "engines": {
        "d_spamhaus_dbl": {
          "name": "Spamhaus DBL",
          "detected": false,
          "reference": "https://www.spamhaus.org/",
          "status": "checked"
        },
        "d_surbl": {
          "name": "SURBL",
          "detected": false,
          "reference": "https://surbl.org/",
          "status": "checked"
        },
        "d_uribl": {
          "name": "URIBL",
          "detected": false,
          "reference": "https://uribl.com/",
          "status": "checked"
        },
        "…": "45 more engines omitted from this example"
      },
      "detections": 0,
      "engines_count": 35,
      "detection_rate": "0%",
      "scan_time_ms": 15521
    },
    "dns": {},
    "whois": {
      "registrar": "RESERVED-Internet Assigned Numbers Authority",
      "creation_date": "1995-08-14T04:00:00+00:00",
      "expiration_date": "2027-08-13T04:00:00+00:00",
      "domain_age_days": 11336,
      "name_servers": [
        "elliott.ns.cloudflare.com",
        "hera.ns.cloudflare.com"
      ]
    },
    "ssl": {
      "valid": false,
      "issuer": null,
      "subject": null,
      "not_before": null,
      "not_after": null,
      "san": []
    },
    "risk_score": {
      "result": 0
    },
    "sia_enrichment": null,
    "elapsed_ms": 15550
  }
}

blacklists.engines is abbreviated; engine ids for domain engines are prefixed d_.

data · DomainReputationData
Field	Type	Description
domain*	string
blacklists	object
dns	object
whois	object
ssl	object
risk_score	object
sia_enrichment	object \| null
elapsed_ms	integer	default 0

Errors

401missing or invalid API key / token
402not enough credits on the account
422the request body or a parameter failed validation
429plan rate limit exceeded

Risk score

Same curve as IP reputation: one listing scores 40, two 70, three or more 100. Reputable domains that no feed lists score 0 regardless of age or registrar.

Notes

Send a bare hostname (example.com, login.example.com). For full URLs use URL reputation.
whois and ssl can be partially empty when the registry rate-limits or the host has no TLS; the blacklist verdicts are unaffected.