API reference

URL Reputation

For a full URL, not just its host. The exact URL is matched against URL feeds (URLhaus, VXVault, OpenPhish, PhishTank …), the host goes through the domain blacklists, and the page is fetched so the report can flag the things phishing kits have in common: credential forms, redirects, punycode, raw-IP hosts, unusual ports and the like.

POST/api/url-reputationCosts 2 creditsAPI key

Check URL reputation

Reading the report

url_fetch_status: ok, timeout, error or blocked. Blacklist verdicts do not depend on the fetch succeeding.
report: structural findings about the URL and the fetched page (scheme, host shape, path/query heuristics, response status, redirects). Each finding is a boolean or small value so you can build your own policy on top of the score.
blacklists: the same shape as the other products; an exact-URL hit and a host-level hit are both reported.

Request

JSON body
Field	Type	Description
url*	string	Full URL to analyze

Authenticate with API key. Send it as the X-API-Key header.

POST /api/url-reputation

curl -X POST "https://api.senapati.io/api/url-reputation" \
  -H "X-API-Key: $SENAPATI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/"}'

Response

Every success is wrapped in { "data": … } with a request_id; the fields below describe data. See Errors for the failure shape.

response: 200 OKURLReputationData

{
  "request_id": "req_8f2c1a7e",
  "timestamp": "2026-08-27T12:00:18.527579+00:00",
  "data": {
    "url": "https://example.com/",
    "url_fetch_status": "error",
    "report": {
      "risk_score": {
        "result": 5
      },
      "most_abused_tld": false,
      "geo_countries": "",
      "domain_recent": false,
      "domain_very_recent": false,
      "risky_category": false,
      "suspicious_url_pattern": false,
      "suspicious_file_extension": false,
      "robots_noindex": false,
      "suspended_page": false,
      "phishing_heuristic": false,
      "suspicious_content": false,
      "non_standard_port": false,
      "url_accessible": false,
      "suspicious_redirect": false,
      "server_ip": "",
      "isp": "",
      "asn": "",
      "http_status_code": null,
      "empty_page_content": false,
      "domain_blacklisted": false,
      "domain_blacklist_detections": 0,
      "domain_blacklist_engines_count": 35,
      "suspicious_domain": false,
      "sinkholed_domain": false,
      "valid_https": false,
      "ssl_blacklisted": false,
      "defaced_heuristic": false,
      "masked_file_type": false,
      "windows_exe_file": false,
      "linux_elf_file": false,
      "credit_card_form_field": false,
      "password_form_field": false
    },
    "blacklists": {
      "engines": {
        "d_spamhaus_dbl": {
          "name": "Spamhaus DBL",
          "detected": false,
          "reference": "https://www.spamhaus.org/",
          "status": "checked"
        },
        "d_surbl": {
          "name": "SURBL",
          "detected": false,
          "reference": "https://surbl.org/",
          "status": "checked"
        },
        "d_uribl": {
          "name": "URIBL",
          "detected": false,
          "reference": "https://uribl.com/",
          "status": "checked"
        },
        "…": "45 more engines omitted from this example"
      },
      "detections": 0,
      "engines_count": 35,
      "detection_rate": "0%",
      "scan_time_ms": 16522
    },
    "elapsed_ms": 16565
  }
}

data · URLReputationData
Field	Type	Description
url*	string
url_fetch_status	string \| null
report	object
blacklists	object
elapsed_ms	integer	default 0

Errors

401missing or invalid API key / token
402not enough credits on the account
422the request body or a parameter failed validation
429plan rate limit exceeded

Notes

This is the only product that costs two credits, because it makes an outbound request to the target. The page fetch has a short timeout and never follows more than a few redirects; hosts that resolve to private or reserved address space are not fetched.

Include the scheme. http:// and https:// are treated as different URLs for exact matching.
For hostname-only questions the cheaper domain reputation call is the right tool.