Loading…
Loading…
Connect DmarcLock's trust workflow to your product, partner tooling, or internal operations. These 31 documented endpoints power Business Risk, Action Center, Security Passport, reports, and partner workflows.
Use JWT auth for in-product workflows and API keys for server-to-server automation. Most customer journeys should map to the trust workflow instead of isolated raw scans.
Pass X-API-Key: your_key in the request header. Best for partner automation, alerts, exports, and internal service calls.
Pass Authorization: Bearer <jwt_token>. Best for onboarding, TrustOps actions, Security Passport management, and dashboard flows.
curl -H "X-API-Key: sk_live_your_key_here" \
https://dmarclock-api.onrender.com
/api/v1/security/scan-statsKick off a fast TrustOps-style baseline instead of a one-off raw scan:
curl -X POST https://dmarclock-api.onrender.com
/api/v1/trustops/run-audit \
-H "Authorization: Bearer <jwt_token>" \
-H "Content-Type: application/json" \
-d "{"mode":"fast"}"Feature access and quotas are enforced per workspace plan:
| Plan | Scans/mo | Members | Features |
|---|---|---|---|
| Pilot | 25 | 1 | Quick audit, Business Risk, guided onboarding |
| Core | 1,000 | 5 | Action Center, recurring scans, monthly reporting |
| Compliance | 10,000 | 25 | Security Passport, compliance exports, proof bundle |
| Partner | Unlimited | Unlimited | Portfolio view, co-branded exports, partner workflows |
/api/v1/dmarc/inspect?domain=example.comAPI Key or JWTReal-time RFC 7489 DNS lookup, SPF 10-lookup count, DKIM selectors, and enforcement readiness verdict.
{
"domain": "example.com",
"score": 85,
"grade": "B",
"dmarc": { "policy": "none", "is_enforced": false },
"spf": { "lookup_count": 6, "lookup_limit_exceeded": false },
"enforcement_readiness": { "verdict": "QUARANTINE_READY", "blockers_count": 1 }
}/api/v1/dmarc/domains/{domain}/overviewJWTAggregated mail deliverability telemetry, observed sender IPs, pass/fail counts, and alignment score.
{
"domain": "example.com",
"alignment_score": 98.4,
"total_emails_30d": 142500,
"threat_emails_blocked": 120,
"dmarc_policy": "p=none",
"senders": [
{ "provider": "Google Workspace", "source_ip": "209.85.220.41", "volume": 84200, "spf": "pass", "dkim": "pass" }
]
}/api/v1/dmarc/domains/{domain}/readinessJWTEvaluates deterministic fail-closed safety gates required before safely advancing to p=reject.
{
"domain": "example.com",
"verdict": "NOT_READY",
"status_badge": "1 BLOCKER ACTIVE",
"blockers": [
{
"id": "spf-lookup-pressure",
"severity": "critical",
"title": "SPF Lookup Limit Exceeded (12/10)",
"remediation": "Flatten SPF record to avoid RFC 7208 PermError delivery drops"
}
]
}/api/v1/dmarc/spf/flattenAPI Key or JWTRecursively collapses nested SPF includes into a cached, IP-optimized record under the 10-lookup ceiling.
{
"domain": "example.com",
"qualifier": "~all"
}{
"status": "success",
"original_lookups": 12,
"flattened_lookups": 1,
"lookups_saved": 11,
"flattened_spf": "v=spf1 ip4:198.51.100.0/24 ip4:203.0.113.0/24 ~all"
}/api/v1/dmarc/dns/syncJWTPublishes validated DMARC/SPF fixes directly to Cloudflare, GoDaddy, DigitalOcean, or Vercel with automatic rollback snapshot and HMAC audit entry.
{
"domain": "example.com",
"provider": "cloudflare",
"api_token": "...",
"records": [
{ "type": "TXT", "name": "_dmarc.example.com", "content": "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@ingest.dmarclock.com;" }
],
"dry_run": false
}{
"status": "success",
"dry_run": false,
"applied_changes": [{ "action": "CREATE", "type": "TXT", "name": "_dmarc.example.com" }],
"rollback_snapshot_id": "snap-98a72b",
"audit_entry_id": "aud-148102"
}/api/v1/dmarc/placement/testJWTAudits deliverability across a 30-seed mailbox cluster (Google Workspace, Microsoft 365, Yahoo, Apple Mail) with content spam scoring.
{
"domain": "example.com",
"from_email": "security@example.com",
"subject": "System Verification Digest",
"body": "Your one-time verification code is 849201."
}{
"test_id": "pl-81920",
"overall_rates": { "inbox": 93.3, "promotions": 6.7, "spam": 0.0, "missing": 0.0 },
"authentication": { "spf": "pass", "dkim": "pass", "dmarc": "pass" }
}/api/v1/security/scan-fileJWTUpload a file for local malware analysis (ClamAV isolated execution). Max 10 MB.
# multipart/form-data
file: <binary>{
"is_safe": true,
"status": "CLEAN",
"threat_name": null,
"filename": "report.pdf",
"file_hash": "8a7b3c...",
"clamav": { "available": true, "malicious": 0 }
}/api/v1/security/check-phishing-urlAPI KeyAnalyze a URL using our 100% Native Heuristics engine + DistilBERT Model. Returns risk score and detailed indicators.
{ "url": "https://example.com/login" }{
"is_safe": true,
"risk_level": "LOW",
"risk_score": 5.0,
"indicators": [],
"engines": { "distilbert": {...}, "heuristics": {...} }
}/api/v1/security/check-phishing-emailJWTAnalyze email content and sender for phishing indicators, urgency patterns, and spoofed domains.
{
"email_body": "Dear user, your account has been compromised...",
"sender": "security@bank-alert.com"
}{
"is_safe": false,
"risk_level": "HIGH",
"risk_score": 85.0,
"indicators": ["urgency_language", "suspicious_domain"]
}/api/v1/advanced/domain-spoofingJWTEvaluates whether a target domain's SPF and DMARC records leave it susceptible to direct email spoofing.
{ "domain": "example.com" }{
"domain": "example.com",
"spoofing_vulnerable": false,
"risk_score": 10.0,
"risk_level": "LOW",
"dmarc_policy": "reject",
"spf_record": "v=spf1 include:_spf.google.com ~all",
"findings": []
}/api/v1/security/scan-history?scan_type=malware&limit=50JWTGet scan history for your team, optionally filtered by scan type. Supports pagination.
{
"scans": [
{
"id": "uuid-...",
"scan_type": "malware",
"target": "report.pdf",
"result": "safe",
"risk_score": 0,
"risk_level": "LOW",
"created_at": "2025-01-15T10:30:00Z"
}
],
"count": 42
}/api/v1/security/scan-statsJWTGet aggregate scan statistics — total scans, threats found, breakdown by type.
{
"total_scans": 1250,
"threats_found": 23,
"safe_scans": 1227,
"scans_by_type": { "malware": 500, "phishing_url": 300, ... }
}/api/v1/security/remediation-guide?scan_type=breach_checkAPI KeyGet step-by-step MSME-friendly fix instructions for a specific scan type. Includes CERT-In references.
{
"scan_type": "breach_check",
"guides": [
{
"title": "Data Breach Detected — Credentials Exposed",
"severity": "CRITICAL",
"what": "Your email or domain was found in a known breach...",
"steps": ["1. Change passwords...", "2. Enable 2FA..."],
"verify": "Re-run Breach Check after 30 days",
"cert_in_ref": "CIAD-2023-0067"
}
]
}/api/v1/security/check-breach?domain=example.comJWTCheck if a domain appears in DmarcLock's curated breach intelligence.
{
"breached": true,
"breach_count": 3,
"breaches": [
{ "name": "LinkedIn", "date": "2012-05-05", "data_types": ["email", "password"] }
],
"risk_level": "HIGH",
"risk_score": 75.0
}/api/v1/security/check-breach-email?email=user@example.comJWTCheck if a specific email address appears in known data breaches. Returns breach details and recommendations.
{
"email": "user@example.com",
"breached": true,
"breach_count": 2,
"breaches": [...],
"risk_level": "HIGH",
"recommendations": ["Change passwords", "Enable 2FA"]
}/api/v1/security/check-ssl?domain=example.comJWTComprehensive SSL/TLS certificate health and expiry check. Detects weak protocols, expired certs, and misconfigurations.
{
"valid": true,
"issuer": "Let's Encrypt",
"expires_at": "2025-12-01T00:00:00Z",
"days_remaining": 180,
"protocol_version": "TLSv1.3",
"risk_level": "LOW",
"risk_score": 5.0
}/api/v1/security/dark-web-monitorJWTContinuous dark web monitoring for a domain. Compares with previous scans to detect NEW breach exposures only.
{
"domain": "mycompany.com",
"emails": ["ceo@mycompany.com", "admin@mycompany.com"]
}{
"domain": "mycompany.com",
"total_breaches": 3,
"new_breaches_found": 1,
"new_breach_names": ["RecentLeak2024"],
"risk_level": "CRITICAL",
"risk_score": 80,
"recommendations": [...]
}/api/v1/security/scan-websiteAPI KeyFull website security audit: SSL, HTTP headers, security grade (A+ to F), missing protections.
{ "url": "https://mymsme.co.in" }{
"is_safe": true,
"grade": "B",
"score": 75,
"headers": { "csp": false, "hsts": true, "x_frame": true },
"risk_level": "MEDIUM"
}/api/v1/reports/generateAPI KeyGenerate a downloadable PDF security audit report from recent scan history.
{
"title": "Monthly Audit Report",
"scan_type": "all",
"limit": 50
}{
"report_id": "abc123def456",
"download_url": "/api/v1/reports/download/abc123def456",
"scans_included": 42,
"file_size_kb": 156.3
}/api/v1/reports/certinJWTGenerate a CERT-In MSME readiness PDF mapping scan results to recommended controls. Supports Hindi (language: 'hi').
{
"target": "mymsme.co.in",
"company_name": "My MSME Pvt Ltd",
"language": "hi",
"limit": 100
}{
"report_id": "abc123.certin",
"download_url": "/api/v1/reports/download/abc123.certin",
"scans_included": 87,
"file_size_kb": 245.7
}/api/v1/reports/download/{report_id}API KeyDownload a previously generated PDF report. Reports expire after 24 hours.
# Returns application/pdf binary file/api/v1/teams/JWTCreate a new team/organization. The creator becomes admin.
{ "name": "My MSME Security Team" }{
"id": "uuid-...",
"name": "My MSME Security Team",
"plan": "free",
"created_at": "2025-01-01T00:00:00Z"
}/api/v1/teams/{team_id}/membersJWTGet all members of a team with their roles (admin, editor, viewer).
{
"members": [
{ "user_id": "...", "email": "admin@co.in", "role": "admin" }
]
}/api/v1/teams/{team_id}/inviteJWTInvite a user to join your team with a specified role.
{ "email": "dev@company.com", "role": "editor" }{ "message": "Invitation sent", "invited_email": "dev@company.com" }/api/v1/schedules/API KeySet up automated recurring scans. Runs website + breach + SSL + dark web checks on schedule.
{
"target": "mymsme.co.in",
"scan_type": "website",
"cron_expression": "0 6 * * *"
}{
"id": "uuid-...",
"target": "mymsme.co.in",
"scan_type": "website",
"cron_expression": "0 6 * * *",
"is_active": true
}/api/v1/schedules/API KeyGet all scheduled scans for the authenticated user.
[
{
"id": "uuid-...",
"target": "mymsme.co.in",
"scan_type": "website",
"cron_expression": "0 6 * * *",
"is_active": true,
"last_run": "2025-01-15T06:00:00Z"
}
]/api/v1/advanced/domain-spoofing?domain=example.comAPI Key or JWTCheck SPF, DKIM, DMARC records to assess email spoofing vulnerability.
{
"domain": "example.com",
"spf_valid": true,
"dkim_valid": true,
"dmarc_valid": true,
"spoofable": false,
"risk_level": "LOW"
}/api/v1/advanced/attack-surface?domain=example.comAPI Key or JWTDiscover subdomains, open ports, and exposed services for a domain using crt.sh + DNS enumeration.
{
"domain": "example.com",
"subdomains": ["mail.example.com", "vpn.example.com"],
"open_ports": [80, 443, 8080],
"risk_level": "MEDIUM"
}/api/v1/advanced/threat-intel?indicator=1.2.3.4API Key or JWTQuery AlienVault OTX for threat intelligence on IPs, domains, or file hashes.
{
"indicator": "1.2.3.4",
"pulse_count": 5,
"malicious": true,
"tags": ["malware", "c2"],
"country": "RU"
}/api/v1/monitoring/dashboardAPI KeyGet summary of all Uptime Kuma monitors — up/down counts, status overview.
{
"total_monitors": 5,
"up_monitors": 4,
"down_monitors": 1,
"monitors": [...]
}/api/v1/billing/planJWTGet the team's current plan, usage, and limits (scans used, features available).
{
"plan": "starter",
"scans_used": 142,
"scan_limit": 1000,
"features": ["advanced_tools", "certin_reports", "scheduled_scans"],
"team_members": 3,
"member_limit": 5
}DmarcLock API v1 · FastAPI backend at /api/v1 · Interactive Swagger docs at Swagger UI (/docs)