Skip to main content
Changelog

API Changelog

Every change that can affect an integration, newest first.

View API Docs
  1. v3.1.1New Feature

    Certificates: what the site serves, and its CT history

    The certificate section no longer depends on crt.sh alone. certificateFacts gives two parts, each with its source: the certificate the site serves now, read by our own TLS handshake on port 443, and the Certificate Transparency history from crt.sh. A source that did not answer reads unknown, never none.

    • certificateFacts on /check (every enrichment level), /check/certificates and the report stream; dataTrust.certificates gives its state and source
    • certificates (crt.sh rows) now holds at most ten rows, current certificates first, with the precertificate/final duplicate removed; certificateFacts.ctHistory gives currentCount and totalSeen
    • /check/certificates and the report stream open one TLS connection to the target on port 443 (no HTTP request, never to a domain we rate malicious); /check, /check/domain-risk and bulk read caches only
    • An IP address has no certificate section: certificateFacts reads not_applicable and nothing is contacted
  2. v3.1.0New Feature

    Mail scan: POST /mail/scan

    Read one inbound email message for phishing and malware in a single call: a verdict, a recommended action and the reasons. It counts on the scan meter, one scan per message, never on the request quota.

    • Send the raw message (eml or emlBase64, up to 10 MiB) or the fields you already parsed (message)
    • The answer carries a verdict (malicious, suspicious, clean or inconclusive), a recommended action (quarantine, review, warn or deliver), a risk score and the reasons
    • It reads the sender, Reply-To, link hosts, attachment hashes and structure, look-alikes of well-known brands, and the DMARC and SPF policy the sender publishes; it never opens an attachment, follows a link or keeps the message
  3. v3.0.1New Feature

    HTTP Basic Auth for API credentials

    Authorization: Basic is accepted everywhere X-API-KEY is. Standard form is username=apiKey and password=apiSecret. The TAXII/Sentinel form (any username, password = Base64 credential) still works.

    • curl -u apiKey:apiSecret works on /check, blocklists, TAXII, and the rest of the API
    • Appliances that cap a single API-key field at 64 characters can use Basic Auth
    • Legacy username api + Base64 password remains valid
  4. v3.0.0Breaking Change

    Canonical API host and paths (Rust)

    Public REST API lives at https://api.ismalicious.com with root paths (/check, /bulk/check, …). Docs updated to match.

    • Authentication: X-API-KEY = Base64(apiKey:apiSecret) — not Authorization: Bearer for API keys
    • Single lookup: GET /check?query= — removed /v1/lookup/... examples
    • Bulk: POST /bulk/check JSON { entities[], enrichment? }
    • Progressive check: SSE GET /check/stream?query=
    • User webhooks: CRUD at /user/webhooks for paid plans; OpenAPI at /openapi.json

Start with a free API key

250 requests a month. No credit card required.

Create Account